Connect AWS

Connect an AWS account so an agent can inspect resources through the AWS CLI. Pulumi ESC supplies credentials when the task runs. The setup is the same for Neo and agents you configure.

Choose the AWS role

Choose an IAM role with permissions for the agent’s work. For example, checking versioning on a known S3 bucket in your account requires s3:GetBucketVersioning on that bucket. It doesn’t require access to its objects or permission to change versioning.

If you reuse a deployment role, check for permissions the investigation doesn’t need. See Design access around the job for guidance on identities and credential scope.

Prepare an ESC environment

Use an ESC environment that supplies credentials for the role, or configure OpenID Connect for AWS to create one.

Use the AWS login provider’s OIDC configuration to expose temporary credentials as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. Set AWS_REGION to the region you want the agent to use.

The agent also needs permission to open the environment.

Connect the environment

With permission to manage organization integrations (org_integrations:update):

1. Open your organization’s Agent settings > Integrations > CLI tools.
2. Under Available, choose AWS and select Connect.
3. Enter a Name and select the ESC environment that supplies the credentials.
4. In Notes (optional), describe when the agent should use this connection.
5. Select Connect.

For example, name the connection production-aws-investigation and include the AWS account ID in its notes.