> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Honey Tokens Setup

> One-time organization setup for AWS honey tokens.

<Info>
  This setup is performed **once per organization** by an admin. After
  completing these steps, any project member with the appropriate [permissions](/documentation/platform/honey-tokens/overview#permissions) can [create honey
  tokens](/documentation/platform/honey-tokens/aws/usage) without repeating this
  process.
</Info>

## Prerequisites

* You must have the organization-level **Honey Tokens → Setup** permission. By default, only organization **Admins** have this permission.

* Create an [AWS App Connection](/integrations/app-connections/aws) at the organization level with the following IAM permissions:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "HoneyTokenIAMManagement",
      "Effect": "Allow",
      "Action": [
        "iam:CreateUser",
        "iam:DeleteUser",
        "iam:CreateAccessKey",
        "iam:DeleteAccessKey"
      ],
      "Resource": "arn:aws:iam::*:user/inf_ht_*"
    },
    {
      "Sid": "HoneyTokenStackVerification",
      "Effect": "Allow",
      "Action": ["cloudformation:DescribeStacks"],
      "Resource": "*"
    }
  ]
}
```

<Note>
  The IAM permissions are scoped to users prefixed with `inf_ht_`, which is the
  naming convention Infisical uses for honey token IAM users.
</Note>

## Connect

<Steps>
  <Step title="Open Honey Token settings">
    Go to **Organization Settings** → **Product Settings**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/product-settings.png" alt="AWS Honey Tokens section" />
  </Step>

  <Step title="Click Connect">
    Click **Connect** to open the configuration modal.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/connect.png" alt="Click Connect" />
  </Step>

  <Step title="Fill required fields and save">
    Configure:

    * **App Connection** — select your AWS App Connection.
    * **Webhook Signing Key** — auto-generated by default; customize it if needed. This key is used to validate webhook calls from AWS.

    Optionally expand **Advanced Options**:

    * **CloudFormation Stack Name** (default: `infisical-honey-tokens`)
    * **AWS Region** (default: `us-east-1`)

    Click **Save**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/connecting.png" alt="Configure and Save" />
  </Step>

  <Step title="Deploy CloudFormation Stack">
    Copy the command shown under **Deploy CloudFormation Stack**.

    Run the command in a terminal with AWS credentials that can deploy CloudFormation stacks in your target account and region.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/cloudformation-deploy.png" alt="Deploy CloudFormation Stack Command" />
  </Step>

  <Step title="Verify deployment">
    After the CloudFormation stack finishes deploying, click **Verify connection** in the **AWS Honey Tokens** section.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/verify-connection-click.png" alt="Click Verify connection" />

    Once verification succeeds, confirm the status badge is updated to **Verified**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/verify-connection-verified-badge.png" alt="Verified status badge" />
  </Step>
</Steps>

## Manage

After setup is saved, the **Connect** button changes to **Manage**.

Use **Manage** any time you need to update:

* AWS App Connection
* Webhook signing key
* CloudFormation stack name
* AWS region

In the modal, you can also copy the pre-filled AWS CLI command under **Deploy CloudFormation Stack** and run it to deploy the stack.

You can also verify directly in AWS CLI:

```bash theme={"dark"}
aws cloudformation describe-stacks \
  --stack-name infisical-honey-tokens \
  --query "Stacks[0].StackStatus"
```

You can only [create honey tokens](/documentation/platform/honey-tokens/aws/usage) after the stack status is **Verified**.