AWS Connection
Learn how to configure an AWS Connection for Infisical.
Infisical supports two methods for connecting to AWS.
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
Self-Hosted Instance
Self-Hosted Instance
To connect your self-hosted Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the configured AWS IAM Role.
If your instance is deployed on AWS, the aws-sdk will automatically retrieve the credentials. Ensure that you assign the provided permission policy to your deployed instance, such as ECS or EC2.
The following steps are for instances not deployed on AWS:
Create an IAM User
Navigate to Create IAM User in your AWS Console.
Create an Inline Policy
Attach the following inline permission policy to the IAM User to allow it to assume any IAM Roles:
Obtain the IAM User Credentials
Obtain the AWS access key ID and secret access key for your IAM User by navigating to IAM > Users > [Your User] > Security credentials > Access keys.
Set Up Connection Keys
- Set the access key as INF_APP_CONNECTION_AWS_ACCESS_KEY_ID.
- Set the secret key as INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY.
Create the Managing User IAM Role for Infisical
-
Navigate to the Create IAM Role page in your AWS Console.
-
Select AWS Account as the Trusted Entity Type.
-
Select Another AWS Account and provide the appropriate Infisical AWS Account ID: use 381492033652 for the US region, and 345594589636 for the EU region. This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
-
(Recommended) Enable “Require external ID” and input your Organization ID to strengthen security and mitigate the confused deputy problem.
When configuring an IAM Role that Infisical will assume, it’s highly recommended to enable the “Require external ID” option and specify your Organization ID.
This precaution helps protect your AWS account against the confused deputy problem, a potential security vulnerability where Infisical could be tricked into performing actions on your behalf by an unauthorized actor.
Add Required Permissions to the IAM Role
Navigate to your IAM role permissions and click Create Inline Policy.
Depending on your use case, add one or more of the following policies to your IAM Role:
AWS Secrets Manager
AWS Secrets Manager
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
AWS Parameter Store
AWS Parameter Store
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
AWS Secrets Manager
AWS Secrets Manager
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
AWS Parameter Store
AWS Parameter Store
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
AWS IAM
AWS IAM
Use the following custom policy to grant the minimum permissions required by Infisical to rotate secrets to AWS Access Keys:
Copy the AWS IAM Role ARN
Setup AWS Connection in Infisical
-
Navigate to the App Connections tab on the Organization Settings page.
-
Select the AWS Connection option.
-
Select the Assume Role method option and provide the AWS IAM Role ARN obtained from the previous step and press Connect to AWS.
-
Your AWS Connection is now available for use.
-
Navigate to the App Connections tab on the Organization Settings page.
-
Select the AWS Connection option.
-
Select the Assume Role method option and provide the AWS IAM Role ARN obtained from the previous step and press Connect to AWS.
-
Your AWS Connection is now available for use.
To create an AWS Connection, make an API request to the Create AWS Connection API endpoint.
Sample request
Sample response
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
Self-Hosted Instance
Self-Hosted Instance
To connect your self-hosted Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the configured AWS IAM Role.
If your instance is deployed on AWS, the aws-sdk will automatically retrieve the credentials. Ensure that you assign the provided permission policy to your deployed instance, such as ECS or EC2.
The following steps are for instances not deployed on AWS:
Create an IAM User
Navigate to Create IAM User in your AWS Console.
Create an Inline Policy
Attach the following inline permission policy to the IAM User to allow it to assume any IAM Roles:
Obtain the IAM User Credentials
Obtain the AWS access key ID and secret access key for your IAM User by navigating to IAM > Users > [Your User] > Security credentials > Access keys.
Set Up Connection Keys
- Set the access key as INF_APP_CONNECTION_AWS_ACCESS_KEY_ID.
- Set the secret key as INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY.
Create the Managing User IAM Role for Infisical
-
Navigate to the Create IAM Role page in your AWS Console.
-
Select AWS Account as the Trusted Entity Type.
-
Select Another AWS Account and provide the appropriate Infisical AWS Account ID: use 381492033652 for the US region, and 345594589636 for the EU region. This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
-
(Recommended) Enable “Require external ID” and input your Organization ID to strengthen security and mitigate the confused deputy problem.
When configuring an IAM Role that Infisical will assume, it’s highly recommended to enable the “Require external ID” option and specify your Organization ID.
This precaution helps protect your AWS account against the confused deputy problem, a potential security vulnerability where Infisical could be tricked into performing actions on your behalf by an unauthorized actor.
Add Required Permissions to the IAM Role
Navigate to your IAM role permissions and click Create Inline Policy.
Depending on your use case, add one or more of the following policies to your IAM Role:
AWS Secrets Manager
AWS Secrets Manager
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
AWS Parameter Store
AWS Parameter Store
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
AWS Secrets Manager
AWS Secrets Manager
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
AWS Parameter Store
AWS Parameter Store
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
AWS IAM
AWS IAM
Use the following custom policy to grant the minimum permissions required by Infisical to rotate secrets to AWS Access Keys:
Copy the AWS IAM Role ARN
Setup AWS Connection in Infisical
-
Navigate to the App Connections tab on the Organization Settings page.
-
Select the AWS Connection option.
-
Select the Assume Role method option and provide the AWS IAM Role ARN obtained from the previous step and press Connect to AWS.
-
Your AWS Connection is now available for use.
-
Navigate to the App Connections tab on the Organization Settings page.
-
Select the AWS Connection option.
-
Select the Assume Role method option and provide the AWS IAM Role ARN obtained from the previous step and press Connect to AWS.
-
Your AWS Connection is now available for use.
To create an AWS Connection, make an API request to the Create AWS Connection API endpoint.
Sample request
Sample response
Infisical will use the provided Access Key ID and Secret Key to connect to your AWS instance.
Add Required Permissions to the IAM User
Navigate to your IAM user permissions and click Create Inline Policy.
Depending on your use case, add one or more of the following policies to your user:
AWS Secrets Manager
AWS Secrets Manager
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
AWS Parameter Store
AWS Parameter Store
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
AWS Secrets Manager
AWS Secrets Manager
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
AWS Parameter Store
AWS Parameter Store
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
AWS IAM
AWS IAM
Use the following custom policy to grant the minimum permissions required by Infisical to rotate secrets to AWS Access Keys:
Obtain Access Key ID and Secret Access Key
Retrieve an AWS Access Key ID and a Secret Key for your IAM user in IAM > Users > User > Security credentials > Access keys.
Setup AWS Connection in Infisical
-
Navigate to the App Connections tab on the Organization Settings page.
-
Select the AWS Connection option.
-
Select the Access Key method option and provide the Access Key ID and Secret Key obtained from the previous step and press Connect to AWS.
-
Your AWS Connection is now available for use.
-
Navigate to the App Connections tab on the Organization Settings page.
-
Select the AWS Connection option.
-
Select the Access Key method option and provide the Access Key ID and Secret Key obtained from the previous step and press Connect to AWS.
-
Your AWS Connection is now available for use.
To create an AWS Connection, make an API request to the Create AWS Connection API endpoint.