# Connect AWS

Canonical URL: https://docs.fuse.init.inc/integrations/aws/setup

Connect a dedicated least-privilege AWS IAM user with an access key and default commercial Region.



## Before you start [#before-you-start]

AWS uses **customer access keys** (`aws_access_key`). Init verifies the key with regional STS `GetCallerIdentity` and accepts only a commercial IAM user principal.

**Connection admin/user** creates a dedicated IAM user (no console password) and an access key, then submits the key pair with a commercial default Region.

You need:

* Permission to create IAM users and access keys in the target account.
* A commercial AWS partition account (not GovCloud or China).
* The commercial Region where regional APIs should run by default.

## Configure the provider [#configure-the-provider]

### Create a dedicated IAM user (**Connection admin/user**) [#create-a-dedicated-iam-user-connection-adminuser]

1. In the AWS console, open **IAM → Users** and create a user dedicated to Init.
2. Do **not** enable console password access for this user.
3. Attach least-privilege policies that cover only the Init action permission labels you will enable (see Permissions).
4. Open the user **Security credentials** tab and create an access key for programmatic access.
5. Copy the access key ID and secret access key immediately; AWS shows the secret once.

### Choose a default commercial Region [#choose-a-default-commercial-region]

Pick one commercial Region from the AWS Regions list (for example `us-east-1` or `eu-west-1`). Init rejects GovCloud and China Regions.

## Connect to Init [#connect-to-init]

**Connection admin/user** starts an AWS Connect session and submits:

| Field               | Required | Notes                                            |
| ------------------- | -------- | ------------------------------------------------ |
| `access_key_id`     | Yes      | Uppercase alphanumeric, 16–128 characters.       |
| `secret_access_key` | Yes      | 40–128 characters.                               |
| `default_region`    | Yes      | One of the commercial Region codes Init accepts. |

Do not submit session tokens, custom endpoints, partitions, account IDs, or role ARNs; the Connect contract rejects them.

Select at least one enabled action when connecting so Init can record capability labels.

## Permissions [#permissions]

Grant only the IAM permission labels required by the actions you enable. Init derives capability labels from those selected actions during Connect.

Prefer a dedicated automation user so key rotation and revocation stay independent of human console access.

## Verify the connection [#verify-the-connection]

1. Complete Connect and confirm the connection is ready.
2. Init calls STS `GetCallerIdentity` with the submitted key and binds the 12-digit account ID plus IAM user ARN.
3. Run Init’s connection test or a safe read action allowed by the user’s policies.

Success looks like STS returning a commercial `arn:aws:iam::<account>:user/...` principal without `401`/`403`.

## Rotate or revoke access [#rotate-or-revoke-access]

1. Create a new access key on the same IAM user (or a replacement user with the same least-privilege policies).
2. Reconnect in Init with the new `access_key_id`, `secret_access_key`, and the same `default_region`. Existing action grants are preserved on reconnect.
3. Deactivate or delete the previous access key in IAM.

Init deletes Vault material on disconnect but does **not** deactivate the key in AWS, because the same key might be used elsewhere. Revoke exposed keys immediately in IAM.

## Troubleshooting [#troubleshooting]

| Symptom                     | What to check                                                                                            |
| --------------------------- | -------------------------------------------------------------------------------------------------------- |
| Connect rejects Region      | Use a commercial Region code; GovCloud/China are not accepted.                                           |
| Connect rejects principal   | The key must belong to an IAM user (`arn:aws:iam::…:user/…`), not root, assumed-role, or federated user. |
| Actions return AccessDenied | Attach the IAM permissions for the enabled Init actions to the dedicated user.                           |
| Wrong account metadata      | Confirm you submitted the intended account’s access key; Init binds whatever STS returns.                |