AWS connection - Infisical

An AWS connection authenticates Infisical to your AWS account, either by assuming an IAM role or with an IAM user’s access keys.

This guide doesn’t configure any behavior—it just authenticates Infisical with AWS. Once the app connection is ready, you can use it to set up integrations.

Prerequisites

An AWS account where you can create IAM roles or users and attach policies to them

Step 1: Create an IAM role or IAM user

Infisical can either assume an IAM role in your account or sign in as an IAM user with an access key. We recommend using an IAM role, since Infisical never holds a long-lived credential for it.

Assume Role (Recommended)
Access Key

If you self-host Infisical

To assume a role, your Infisical instance needs AWS credentials of its own.If your instance runs on AWS (for example on EC2, ECS, or EKS), leave INF_APP_CONNECTION_AWS_ACCESS_KEY_ID and INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY unset. Infisical then uses the credentials of the instance profile, task role, or IAM role for service accounts (IRSA), and that role needs the sts:AssumeRole policy below.If your instance doesn’t run on AWS, give it an IAM user:

In the IAM console, create an IAM user for your Infisical instance.

Attach this inline policy to the user, so it can assume the roles your connections use:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAssumeAnyRole",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/*"
        }
    ]
}

Open the user’s Security credentials tab and create an access key. Access Key Step 1

Set the access key ID as INF_APP_CONNECTION_AWS_ACCESS_KEY_ID and the secret access key as INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY in your instance’s environment, then restart the instance.

When you create the role’s trust policy, enter the AWS account ID of this IAM user or instance role, not an Infisical Cloud account ID.

In the IAM console, go to Create role. Under Trusted entity type, select AWS account. IAM Role Creation

Select Another AWS account, and enter the AWS account ID that Infisical assumes the role from:

Infisical Cloud (US): 381492033652
Infisical Cloud (EU): 345594589636
Dedicated instance: contact Infisical support for your account ID
Self-hosted: the account ID of your instance’s credentials (see If you self-host Infisical)

Select Next to go to the Add permissions page. Then, select Next again without choosing a policy. You’ll add the permissions as an inline policy after the role exists.

Enter a Role name that includes Infisical and what the connection is for, such as infisical-payments-prod, then select Create role. CloudTrail logs every action Infisical takes under this role’s name, so a descriptive name shows anyone reading the logs where those actions came from.

In the IAM console, create an IAM user for Infisical. Give it a User name that includes Infisical and what the connection is for, such as infisical-payments-prod, so CloudTrail logs show where its actions came from. On the Set permissions page, select Next without choosing a policy. You’ll add the permissions as an inline policy after the user exists.

Open the user’s Security credentials tab, create an access key, and copy the Access key ID and Secret access key. AWS shows the secret access key only once. Access Key Step 1

Step 2: Add permissions

Next, add the required policies to the IAM role or user from Step 1:

In the IAM console, open the IAM role or user.

On the Permissions tab, select Add permissions > Create inline policy. IAM Role Create Policy

Switch to the JSON editor, and replace the policy in the editor with this one. It combines the permissions of every integration you picked:

Select Next. Enter a Policy name that says which integrations the policy covers, such as secrets-manager-sync. Then, select Create policy. The policy belongs to the role or user, which already names Infisical, so the policy name only has to say what the policy grants.

Step 3: Create the app connection

Next, create the app connection in Infisical.

To create the connection using the API, use the Create AWS Connection endpoint.

In the sidebar, select Integrations, then open the App Connections tab. App Connections Tab

Select Add Connection and choose AWS. Select AWS Connection

Fill out the form’s fields:

Assume Role (Recommended)
Access Key

Name: A descriptive name for the connection
Description (optional): A note for future reference
Method: Assume Role (Recommended)
Role ARN: The role’s ARN, shown in the Summary section of the role in the IAM console
STS Endpoint URL (optional): A regional AWS STS endpoint to use instead of AWS’s default, such as https://sts.us-east-1.amazonaws.com (leave it empty unless your network can’t reach the default)

Then, select Connect to AWS. AWS Connection Form

When you select Connect to AWS, Infisical checks the credentials. For Assume Role, it assumes the role, so the role’s trust policy has to name the right AWS account and External ID. For Access Key, it signs in with the access key. Infisical doesn’t check the permissions from Step 2 until an integration uses them.

Your AWS app connection is ready to use.

Step 4: Configure integrations

Now that your AWS app connection is configured, you can use it to set up the following integrations:

​Prerequisites

​Step 1: Create an IAM role or IAM user

​Step 2: Add permissions

​Step 3: Create the app connection

​Step 4: Configure integrations

Prerequisites

Step 1: Create an IAM role or IAM user

Step 2: Add permissions

Step 3: Create the app connection

Step 4: Configure integrations