Connector · AWS
Connect AWS
Cross-account access key + STS probe. The same scope an auditor signs off on.
Permission scope
- sts:GetCallerIdentity — returns the account ID and ARN. The probe will not pass without this.
- iam:ListAccessKeys + iam:RotateAccessKey — rotates keys Yarrow considers stale.
- ec2:DescribeInstances + tag:GetResources — discover resources that match a sprinkle.
- Secrets Manager + KMS access in the regions you govern (write only via rotates/patches).
- No org admin, no root keys, no *. The IAM user gets scoped to the accounts you designate.
What Yarrow asks for
These are the exact fields the live connector setup flow accepts for AWS. Anything you prepare here matches what you provide there.
| Field | Required | Note |
|---|---|---|
| label | required | Short workspace identifier. e.g. prod-aws-account. |
| accessKeyId | required | Begins with AKIA… — the 20-char IAM access key ID. |
| secretAccessKey | required | The 40-char secret string. Stored encrypted, never echoed back. |
| region | required | Default reconcile region. Format like us-east-1, eu-west-2, ap-southeast-1. |
Steps
- 1
Create an IAM user in the target AWS account
Use the AWS console or `aws iam create-user`. Attach the inline policy at the bottom of this page. Save the access-key ID + secret somewhere safe.
- 2
Open the workspace connector roster
From the dashboard, go to /workspaces/<slug>/connectors and choose the AWS setup guide.
- 3
Prepare label, access key, secret, region
Match the values to what you created. Region codes follow the {area}-{location}-{number} convention.
- 4
Return to the roster to review status
Once the connection is configured, Yarrow runs sts:GetCallerIdentity in the supplied region. A green card means the IAM user has the minimum required scope. A red card shows the AWS error verbatim — typically a missing permission or a wrong region.
- 5
Watch the probe status on the connectors list
The AWS card updates with the latest reachability status and timestamp.
Verify
After the AWS connection is configured, Yarrow runs a reachability probe: one minimal permissions call against the cloud, then stores the encrypted bundle under the chosen label. A green card confirms the probe passed. A red card shows the cloud's error verbatim — rotate keys, fix the IAM policy, and try again.
Failed probes still save the bundle so you can inspect and rotate without re-pasting.