> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/pam-with-devolutions-cloud/providers/aws-iam-provider.md). # AWS IAM provider Configure the AWS IAM provider in Devolutions Cloud to enable account discovery, heartbeat monitoring, and password rotation for AWS IAM users. Integrating an AWS IAM provider with Devolutions Cloud allows you to centralize identity and access management by leveraging your existing AWS credentials. This configuration enables [account discovery](/pam/knowledge-base/knowledge-base-articles/custom-pam-provider-action-scripts-in-devolutions-server.md#account-discovery), [heartbeat ](/pam/knowledge-base/knowledge-base-articles/custom-pam-provider-action-scripts-in-devolutions-server.md#heartbeat)monitoring, and [password rotation](/pam/concepts/password-rotation.md) for your AWS resources. ### Prerequisite * Create a user in AWS who will act as a provider. * Create an access key. * The following permissions are required for the AWS identity provider: | **ACTION** | **DESCRIPTION** | | ----------------------------- | ------------------------------------------------------------------- | | `iam:GetUser` | To ensure the necessary permissions are in place before proceeding. | | `iam:SimulatePrincipalPolicy` | To ensure the necessary permissions are in place before proceeding. | #### Account discovery | **ACTION** | **DESCRIPTION** | | -------------------- | ----------------------------- | | `iam:ListAccessKeys` | To get a list of access keys. | | `iam:ListUsers` | To get a list of IAM users. | #### Password reset - Password | **ACTION** | **DESCRIPTION** | | ------------------------ | ---------------------------------------------------------------- | | `iam:GetLoginProfile` | To check whether a login profile needs to be created or updated. | | `iam:CreateLoginProfile` | To generate a password if non exists. | | `iam:UpdateLoginProfile` | To update the password. | #### Password reset - Access key | **ACTION** | **DESCRIPTION** | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | `iam:CreateAccessKey` | To generate an access key on import or rotation. | | `iam:DeleteAccessKey` | To delete the previous access key after rotation. | | `iam:UpdateAccessKey` | To disable the previous access key before deletion. | | `iam:ListUserTags` | To verify if we need to update the tag of an access key | | `iam:TagUser` | To add a tag to the user in the format ``. Note that tags are applied to the user, not the access key. | | `iam:UntagUser` | To remove an existing access key tag. | #### .JSON policy for the AWS console Here is the full .JSON policy for the AWS console. It can be used on a user or a group. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "iam:SimulatePrincipalPolicy", "iam:GetUser", "iam:ListUsers", "iam:ListAccessKeys", "iam:GetLoginProfile", "iam:CreateLoginProfile", "iam:UpdateLoginProfile", "iam:CreateAccessKey", "iam:DeleteAccessKey", "iam:UpdateAccessKey", "iam:ListUserTags", "iam:TagUser", "iam:UntagUser" ], "Resource": "*" } ] } ``` ### Configure the AWS IAM provider for Devolutions Cloud 1. In Devolutions Cloud, go to ***Administration*** – ***Privileged access management*** – ***Providers***. 2. Click ***Add*** and select ***AWS Identity and Access Management (IAM)***. 3. Enter a name and, optionally, a description. 4. Leave the ***Credential type*** on ***Custom***, then enter the access key and the secret key from AWS. 5. Click ***Test connection*** to validate the information. 6. Adjust the [checkout policy](#checkout-policy) and the [account lifecycle policy](#account-lifecycle-policy) if needed.

To do a reset password on import, the account lifecycle policy that applies to the provider must use a password policy that follows the AWS default password policy.

7. Click ***Add*** to close the window. ### General | SETTINGS | DESCRIPTION | | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | Display name of the provider. | | **Description** | Description of the provider. | | **Credential type** |

Choose where the provider gets its AWS credentials:

| | **Linked vault** | Vault that contains the privileged account. Available when the credential type is ***Privileged account***. | | **Linked credential** | AWS IAM privileged account that holds the provider credentials. Available when the credential type is ***Privileged account*** and a linked vault is selected. | | **Convert to managed PAM account** | Move the access key and secret key of an existing provider into a managed privileged account. Available when editing a saved provider that uses the ***Custom*** credential type. | | **Access key** | Access key ID of the AWS user acting as the provider. Available when the credential type is ***Custom***. | | **Secret key** | Secret access key of the AWS user acting as the provider. Available when the credential type is ***Custom***. | | **Test connection** | Test the connection. If the connection fails, check the validity of the information you have entered and try again. | ### Checkout policy | SETTINGS | DESCRIPTION | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Checkout policy mode** |

Choose a checkout policy mode:

| ### Account lifecycle policy | SETTINGS | DESCRIPTION | | --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Account lifecycle policy mode** |

Choose an account lifecycle policy mode:

| ### Security | SETTINGS | DESCRIPTION | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Manually create PAM account** | Select the users and user groups allowed to manually create privileged accounts that use this provider. The number in parentheses shows how many users and user groups are assigned. Administrators and users with the system-wide ***Manually create PAM account*** permission can use any provider. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/pam/pam-with-devolutions-cloud/providers/aws-iam-provider.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.