> ## Documentation Index
> Fetch the complete documentation index at: https://serval-hannah-docs-custom-access.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

## About AWS

Amazon Web Services (AWS) is a public-cloud platform, offering on-demand compute, storage, database, and networking services. Connecting AWS to Serval lets you automate everyday cloud-ops and security workflows—from listing IAM roles to spinning down unused EC2 instances—directly from chat.

## What the AWS integration enables

| Capability           | Description                                                       |
| -------------------- | ----------------------------------------------------------------- |
| Access Management    | Create, update, and manage users and their permissions            |
| Automation workflows | Manage resources, create roles, and automate lifecycle management |

***

## AWS configuration (in the AWS console)

Follow these steps to create a cross-account role that Serval can assume. The role's policies determine exactly which AWS APIs Serval can call.

1. **Open the modal in Serval**\
   In the Serval UI navigate to **Apps → Connect AWS**. Leave this window open; it shows the **Account ID** and **External ID** you will need shortly.
   <img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/aws_serval_modal.png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=933f4ced4a9526c906d77a5d06cd311a" alt="Image Pn" width="1160" height="786" data-path="images/integrations/aws/aws_serval_modal.png" />

2. **Create a new IAM role**\
   In AWS go to **IAM → Roles → Create role** and choose **Another AWS account** as the trusted entity.\
   Enter the **Account ID** shown in Serval, then tick **Require external ID** and paste the **External ID**.

   <img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/image(1).png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=2001953fe0cff2fe8f34857cf1b2fb18" alt="Image(1) Pn" width="2776" height="946" data-path="images/integrations/aws/image(1).png" />

   <img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/aws_create_role.png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=9ed3a12b09aaeaab0d68c4e411744ad7" alt="Image Pn" width="2076" height="1202" data-path="images/integrations/aws/aws_create_role.png" />

3. **Attach policies**\
   Select AWS-managed or custom policies that grant the actions Serval needs (e.g. `IAMReadOnlyAccess`).\\
   <img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/image(3).png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=5d866729b559c8009cf9f238b6bc5e9a" alt="Image(3) Pn" width="2108" height="1340" data-path="images/integrations/aws/image(3).png" />

4. **Finish the role wizard** — name the role something memorable and click **Create role**.\\
   <img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/image(4).png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=b43cdf0a141238e9e79b8d16f26ba53a" alt="Image(4) Pn" width="2138" height="848" data-path="images/integrations/aws/image(4).png" />

5. **Update the trust policy**\
   Open the new role → **Trust relationships → Edit trust policy** and replace the document with the version below (adds the required `sts:TagSession` action).\\
   <img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/image(5).png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=950d9d526b79c9a958340f9e48e436b1" alt="Image(5) Pn" width="2270" height="1134" data-path="images/integrations/aws/image(5).png" />

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::992382851720:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "<replace-with-your-external-id>" }
      }
    },
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::992382851720:root" },
      "Action": "sts:TagSession"
    }
  ]
}
```

* Here is an example of the updated policy in the UI.

<img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/aws_ui_trust_policy.png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=8faee498c9b96d9f2a1a7696fb07bb03" alt="Image Pn" width="2738" height="1384" data-path="images/integrations/aws/aws_ui_trust_policy.png" />

6. **Copy the Role ARN & Account ID** — you will paste these into Serval in the next section.

***

## Serval Configuration

1. Return to the **AWS** connection modal in Serval.
2. Paste the **Role ARN** and **Account ID**, then click **Save**.

<img src="https://mintcdn.com/serval-hannah-docs-custom-access/GQpN5Xgp7Zumq9UK/images/integrations/aws/aws_serval_modal.png?fit=max&auto=format&n=GQpN5Xgp7Zumq9UK&q=85&s=933f4ced4a9526c906d77a5d06cd311a" alt="Image Pn" width="1160" height="786" data-path="images/integrations/aws/aws_serval_modal.png" />

Your AWS account is now connected—try running the *List IAM Roles* workflow to verify connectivity.