> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS connection

> Learn how to configure an AWS connection for Infisical.

I want the connection to work with

An AWS connection authenticates Infisical to your AWS account, either by assuming an [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) or with an [IAM user's access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).

> [!NOTE]
>
> This guide doesn’t configure any behavior—it just authenticates Infisical with AWS. Once the app connection is ready, you can [use it to set up integrations](#step-4-configure-integrations).

## Prerequisites

* An AWS account where you can create IAM roles or users and attach policies to them

- An [Amazon S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) for PAM session recordings

* An [Amazon S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) for Agent Vault session logs

- An [AWS Private CA](https://docs.aws.amazon.com/privateca/latest/userguide/create-CA.html) for Infisical to issue certificates from

* A [Route 53 hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.html) for the domain you'll issue certificates for

## Step 1: Create an IAM role or IAM user

Infisical can either assume an IAM role in your account or sign in as an IAM user with an access key. We recommend using an IAM role, since Infisical never holds a long-lived credential for it.

> [tab] Assume Role (Recommended)
>
> > [accordion] If you self-host Infisical
> >
> > To assume a role, your Infisical instance needs AWS credentials of its own.
> >
> > If your instance runs on AWS (for example on EC2, ECS, or EKS), leave `INF_APP_CONNECTION_AWS_ACCESS_KEY_ID` and `INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY` unset. Infisical then uses the credentials of the instance profile, task role, or IAM role for service accounts (IRSA), and that role needs the `sts:AssumeRole` policy below.
> >
> > If your instance doesn't run on AWS, give it an IAM user:
> >
> > **Step 1**
> >
> > In the IAM console, [create an IAM user](https://console.aws.amazon.com/iam/home#/users/create) for your Infisical instance.
> >
> > **Step 2**
> >
> > Attach this inline policy to the user, so it can assume the roles your connections use:
> >
> > ```json theme={"dark"}
> > {
> >     "Version": "2012-10-17",
> >     "Statement": [
> >         {
> >             "Sid": "AllowAssumeAnyRole",
> >             "Effect": "Allow",
> >             "Action": "sts:AssumeRole",
> >             "Resource": "arn:aws:iam::*:role/*"
> >         }
> >     ]
> > }
> > ```
> >
> > **Step 3**
> >
> > Open the user's **Security credentials** tab and create an access key.
> >
> > ![Access Key Step 1](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-1.png)
> >
> > ![Access Key Step 2](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-2.png)
> >
> > ![Access Key Step 3](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-3.png)
> >
> > **Step 4**
> >
> > Set the access key ID as `INF_APP_CONNECTION_AWS_ACCESS_KEY_ID` and the secret access key as `INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY` in your instance's environment, then restart the instance.
> >
> > When you create the role's trust policy, enter the AWS account ID of this IAM user or instance role, not an Infisical Cloud account ID.
>
> **Step 1**
>
> In the IAM console, go to [Create role](https://console.aws.amazon.com/iam/home#/roles/create?step=selectEntities). Under **Trusted entity type**, select **AWS account**.
>
> ![IAM Role Creation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integration-aws-iam-assume-role.png)
>
> **Step 2**
>
> Select **Another AWS account**, and enter the AWS account ID that Infisical assumes the role from:
>
> * Infisical Cloud (US): `381492033652`
> * Infisical Cloud (EU): `345594589636`
> * Dedicated instance: contact Infisical support for your account ID
> * Self-hosted: the account ID of your instance's credentials (see [If you self-host Infisical](#if-you-self-host-infisical))
>
> **Organization-level**
>
> Enable **Require external ID** and enter your Organization ID. It's shown under **Organization ID** in your organization's **Settings**.
>
> **Project-level**
>
> Enable **Require external ID** and enter the ID for the type of project you'll create the connection in:
>
> * **Secrets Management:** the project's ID, shown under **Project ID** in the project's settings
>
> * **Certificate Management:** your Organization ID, shown under **Organization ID** in your organization's **Settings**
>
> * **Agent Vault:** the project's ID, shown under **Project ID** in the project's **Administration** > **Settings**
>
> > [!NOTE]
> >
> > If you created a project-level connection before May 26, 2026 on Infisical Cloud (or before v0.160.7 if you self-host Infisical), Infisical sends your Organization ID for it. To use the Project ID instead, recreate the connection and update the role's trust policy.
>
> Infisical sends this ID every time it assumes the role, so the role only works for connections in the organization or project you named. This protects your account from the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
>
> **Step 3**
>
> Select **Next** to go to the **Add permissions** page. Then, select **Next** again without choosing a policy. You'll add the permissions as an inline policy after the role exists.
>
> **Step 4**
>
> Enter a **Role name** that includes Infisical and what the connection is for, such as `infisical-payments-prod`, then select **Create role**. CloudTrail logs every action Infisical takes under this role's name, so a descriptive name shows anyone reading the logs where those actions came from.

> [tab] Access Key
>
> **Step 1**
>
> In the IAM console, [create an IAM user](https://console.aws.amazon.com/iam/home#/users/create) for Infisical. Give it a **User name** that includes Infisical and what the connection is for, such as `infisical-payments-prod`, so CloudTrail logs show where its actions came from. On the **Set permissions** page, select **Next** without choosing a policy. You'll add the permissions as an inline policy after the user exists.
>
> **Step 2**
>
> Open the user's **Security credentials** tab, create an access key, and copy the **Access key ID** and **Secret access key**. AWS shows the secret access key only once.
>
> ![Access Key Step 1](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-1.png)
>
> ![Access Key Step 2](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-2.png)
>
> ![Access Key Step 3](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-3.png)

## Step 2: Add permissions

Next, add the required policies to the IAM role or user from [Step 1](#step-1-create-an-iam-role-or-iam-user):

**Step 1**

In the IAM console, open the IAM role or user.

**Step 2**

On the **Permissions** tab, select **Add permissions** > **Create inline policy**.

![IAM Role Create Policy](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/aws/assume-role-create-policy.png)

**Step 3**

Switch to the **JSON** editor, and replace the policy in the editor with this one. It combines the permissions of every integration you picked:

Then replace the placeholders for the integrations you picked:

* `<recording-bucket>`: the bucket you enter in the **Session Recording** card of a PAM account template (if you set a key prefix, such as `pam/prod`, add it after the bucket in both object ARNs)

- `<session-logs-bucket>` and `<key-prefix>`: the bucket and key prefix you'll enter in the **Session Logs** dialog in your Agent Vault project (if you won't set a key prefix, delete `<key-prefix>/` in both places)

* `<region>`, `<account-id>`, and `<ca-id>`: the parts of your CA's ARN (to use several CAs, list each ARN in a `Resource` array)

- `<hosted-zone-id>`: the ID of the Route 53 hosted zone for your domain

If you restrict `acm-pca:IssueCertificate` with an `acm-pca:TemplateArn` condition, include every template Infisical uses, or issuance fails with a permission error:

* `arn:aws:acm-pca:::template/BlankEndEntityCertificate_APICSRPassthrough/V1` for end-entity certificates
* `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen{0,1,2,3}_APICSRPassthrough/V1` for [CA certificates](https://infisical.com/docs/documentation/platform/pki/ca/aws-pca.md#issuing-ca-certificates)

If a different AWS account owns the hosted zone for an ACM public CA, move the `AllowRoute53ForAcmValidation` statement to a second connection in that account instead.

If a sync encrypts with a customer managed KMS key, select its KMS checkbox above the policy. If that key doesn't use the default key policy, also add the IAM role or user under **Key users** on the key's page in the AWS KMS console.

> [!WARNING]
>
> If you use the **Access Key** method, AWS may reject the policy as too large, because IAM users allow less inline policy than roles do.
>
> In this case, create it as a customer managed policy instead: in the IAM console, go to **Policies** > **Create policy**, paste the same JSON, and save it. Then open the IAM user and attach it under **Add permissions** > **Attach policies directly**.

**Step 4**

Select **Next**. Enter a **Policy name** that says which integrations the policy covers, such as `secrets-manager-sync`. Then, select **Create policy**. The policy belongs to the role or user, which already names Infisical, so the policy name only has to say what the policy grants.

### Add a CORS rule for PAM session recording

Your browser downloads recordings directly from the bucket during playback, so the bucket needs a CORS rule.

**Step 1**

In the Amazon S3 console, open the recording bucket, go to **Permissions**, and select **Edit** under **Cross-origin resource sharing (CORS)**.

**Step 2**

Paste this rule, then select **Save changes**. If the bucket already has CORS rules, add this rule's object to the existing array instead of replacing it, so other applications that use the bucket keep working:

```json Infisical Cloud (US) theme={"dark"}
[
    {
        "AllowedHeaders": ["*"],
        "AllowedMethods": ["GET"],
        "AllowedOrigins": ["https://app.infisical.com"],
        "ExposeHeaders": [],
        "MaxAgeSeconds": 3600
    }
]
```

```json Infisical Cloud (EU) theme={"dark"}
[
    {
        "AllowedHeaders": ["*"],
        "AllowedMethods": ["GET"],
        "AllowedOrigins": ["https://eu.infisical.com"],
        "ExposeHeaders": [],
        "MaxAgeSeconds": 3600
    }
]
```

If you self-host Infisical or use a dedicated instance, replace `AllowedOrigins` with your instance's URL.

### Add a CORS rule for Agent Vault session logs

Your browser downloads session logs directly from the bucket, so the bucket needs a CORS rule. To see the same rule with your Infisical URL filled in, select **View AWS Setup** in the **Session Logs** dialog.

**Step 1**

In the Amazon S3 console, open the session logs bucket, go to **Permissions**, and select **Edit** under **Cross-origin resource sharing (CORS)**.

**Step 2**

Paste this rule, then select **Save changes**. If the bucket already has CORS rules, add this rule's object to the existing array instead of replacing it, so other applications that use the bucket keep working:

```json Infisical Cloud (US) theme={"dark"}
[
    {
        "AllowedHeaders": ["*"],
        "AllowedMethods": ["GET"],
        "AllowedOrigins": ["https://app.infisical.com"],
        "MaxAgeSeconds": 3000
    }
]
```

```json Infisical Cloud (EU) theme={"dark"}
[
    {
        "AllowedHeaders": ["*"],
        "AllowedMethods": ["GET"],
        "AllowedOrigins": ["https://eu.infisical.com"],
        "MaxAgeSeconds": 3000
    }
]
```

If you self-host Infisical or use a dedicated instance, replace `AllowedOrigins` with your instance's URL.

## Step 3: Create the app connection

Next, create the app connection in Infisical.

> [!TIP]
>
> To create the connection using the API, use the [Create AWS Connection](https://infisical.com/docs/api-reference/endpoints/app-connections/aws/create.md) endpoint.

**Organization-level**

**Step 1**

In the sidebar, select **Integrations**, then open the **App Connections** tab.

![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)

**Step 2**

Select **Add Connection** and choose **AWS**.

![Select AWS Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/aws/select-aws-connection.png)

**Step 3**

Fill out the form's fields:

> [tab] Assume Role (Recommended)
>
> * **Name**: A descriptive name for the connection
> * **Description** (optional): A note for future reference
> * **Method**: **Assume Role (Recommended)**
> * **Role ARN**: The role's ARN, shown in the **Summary** section of the role in the IAM console
> * **STS Endpoint URL** (optional): A regional AWS STS endpoint to use instead of AWS's default, such as `https://sts.us-east-1.amazonaws.com` (leave it empty unless your network can't reach the default)

> [tab] Access Key
>
> * **Name**: A descriptive name for the connection
> * **Description** (optional): A note for future reference
> * **Method**: **Access Key**
> * **Access Key ID**: The access key ID you copied from the IAM user
> * **Secret Access Key**: The secret access key you copied from the IAM user

Then, select **Connect to AWS**.

![AWS Connection Form](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/aws/create-assume-role-method.png)

**Project-level**

**Step 1**

Open the project's app connections:

* **Secrets Management project:** select **Integrations** in the sidebar, then open the **App Connections** tab
* **Certificate Management project:** select **Settings** in the sidebar, then open the **App Connections** tab

**Step 2**

Select **Add Connection** and choose **AWS**.

**Step 3**

Fill out the form's fields:

> [tab] Assume Role (Recommended)
>
> * **Name**: A descriptive name for the connection
> * **Description** (optional): A note for future reference
> * **Method**: **Assume Role (Recommended)**
> * **Role ARN**: The role's ARN, shown in the **Summary** section of the role in the IAM console
> * **STS Endpoint URL** (optional): A regional AWS STS endpoint to use instead of AWS's default, such as `https://sts.us-east-1.amazonaws.com` (leave it empty unless your network can't reach the default)

> [tab] Access Key
>
> * **Name**: A descriptive name for the connection
> * **Description** (optional): A note for future reference
> * **Method**: **Access Key**
> * **Access Key ID**: The access key ID you copied from the IAM user
> * **Secret Access Key**: The secret access key you copied from the IAM user

Then, select **Connect to AWS**.

When you select **Connect to AWS**, Infisical checks the credentials. For **Assume Role**, it assumes the role, so the role's trust policy has to name the right AWS account and External ID. For **Access Key**, it signs in with the access key. Infisical doesn't check the permissions from [Step 2](#step-2-add-permissions) until an integration uses them.

> [!TIP]
>
> Your AWS app connection is ready to use.

## Step 4: Configure integrations

Now that your AWS app connection is configured, you can use it to set up the following integrations:

> [card] [AWS Secrets Manager sync](https://infisical.com/docs/integrations/secret-syncs/aws-secrets-manager.md)
>
> Sync secrets from Infisical to AWS Secrets Manager.

> [card] [AWS Parameter Store sync](https://infisical.com/docs/integrations/secret-syncs/aws-parameter-store.md)
>
> Sync secrets from Infisical to AWS Parameter Store.

> [card] [AWS IAM user secret rotation](https://infisical.com/docs/documentation/platform/secret-rotation/aws-iam-user-secret.md)
>
> Rotate an IAM user's access keys on a schedule.

> [card] [AWS Certificate Manager sync](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/aws-certificate-manager.md)
>
> Sync certificates from Infisical to AWS Certificate Manager.

> [card] [AWS Elastic Load Balancer sync](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/aws-elastic-load-balancer.md)
>
> Attach certificates from Infisical to load balancer listeners.

> [card] [AWS Secrets Manager certificate sync](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/aws-secrets-manager.md)
>
> Store certificates from Infisical as secrets in AWS Secrets Manager.

> [card] [AWS Private CA](https://infisical.com/docs/documentation/platform/pki/ca/aws-pca.md)
>
> Issue certificates from your AWS Private CA.

> [card] [AWS Certificate Manager public CA](https://infisical.com/docs/documentation/platform/pki/ca/aws-acm-public-ca.md)
>
> Issue publicly trusted certificates through AWS Certificate Manager.

> [card] [ACME CA with Route 53](https://infisical.com/docs/documentation/platform/pki/ca/acme-ca.md)
>
> Prove domain ownership for an ACME CA through Route 53.

> [card] [AWS honey tokens](https://infisical.com/docs/documentation/platform/honey-tokens/aws/setup.md)
>
> Detect leaked AWS credentials with decoy access keys.

> [card] [PAM session recording](https://infisical.com/docs/documentation/platform/pam/sessions/external-storage.md)
>
> Store PAM session recordings in your S3 bucket.

> [card] [Agent Vault session logs](https://infisical.com/docs/documentation/platform/agent-vault/session-logs.md)
>
> Record every request an AI agent makes in your S3 bucket.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.