Connect AWS

Agent markdown

Before you start

AWS uses customer access keys (aws_access_key). Init verifies the key with regional STS GetCallerIdentity and accepts only a commercial IAM user principal.

Connection admin/user creates a dedicated IAM user (no console password) and an access key, then submits the key pair with a commercial default Region.

You need:

• Permission to create IAM users and access keys in the target account.
• A commercial AWS partition account (not GovCloud or China).
• The commercial Region where regional APIs should run by default.

Configure the provider

Create a dedicated IAM user (Connection admin/user)

1. In the AWS console, open IAM → Users and create a user dedicated to Init.
2. Do not enable console password access for this user.
3. Attach least-privilege policies that cover only the Init action permission labels you will enable (see Permissions).
4. Open the user Security credentials tab and create an access key for programmatic access.
5. Copy the access key ID and secret access key immediately; AWS shows the secret once.

Choose a default commercial Region

Pick one commercial Region from the AWS Regions list (for example us-east-1 or eu-west-1). Init rejects GovCloud and China Regions.

Connect to Init

Connection admin/user starts an AWS Connect session and submits:

Do not submit session tokens, custom endpoints, partitions, account IDs, or role ARNs; the Connect contract rejects them.

Select at least one enabled action when connecting so Init can record capability labels.

Permissions

Grant only the IAM permission labels required by the actions you enable. Init derives capability labels from those selected actions during Connect.

Prefer a dedicated automation user so key rotation and revocation stay independent of human console access.

Verify the connection

1. Complete Connect and confirm the connection is ready.
2. Init calls STS GetCallerIdentity with the submitted key and binds the 12-digit account ID plus IAM user ARN.
3. Run Init’s connection test or a safe read action allowed by the user’s policies.

Success looks like STS returning a commercial arn:aws:iam::<account>:user/... principal without 401/403.

Rotate or revoke access

1. Create a new access key on the same IAM user (or a replacement user with the same least-privilege policies).
2. Reconnect in Init with the new access_key_id, secret_access_key, and the same default_region. Existing action grants are preserved on reconnect.
3. Deactivate or delete the previous access key in IAM.

Init deletes Vault material on disconnect but does not deactivate the key in AWS, because the same key might be used elsewhere. Revoke exposed keys immediately in IAM.

Troubleshooting