# Set up AWS access

> To connect AWS, InfraNest needs access to your Route 53, Route 53 Domains and ACM. You can grant it with an IAM role (recommended) or with access keys.

Source: https://infranest.io/docs/set-up-aws-access
Last updated: 2026-08-30

---

Connect your AWS account so InfraNest can manage your Route 53 hosted zones, registered domains, and certificates — for anyone setting up AWS as a provider in InfraNest.

## Overview

- To connect AWS, InfraNest needs access to your Route 53, Route 53 Domains and ACM.
- You can grant this access in one of two ways: with an IAM role (recommended) or with access keys.
- An IAM role is the safer option since InfraNest never stores any secrets, and you can revoke access at any time by deleting the role.

## Option A: Connect with an IAM role (recommended)

> [!TIP]
> Choose this option if you can — it means InfraNest never stores any secrets, and you can revoke access any time by deleting the role in AWS.

1. In InfraNest, go to **Integrations → AWS** to start connecting AWS. This shows you the **InfraNest account ID** and a generated **External ID** — you'll need both in the next step.

   <!-- manual-screenshot: set-up-aws-access-1 — taken by hand in the AWS console; the capture rig cannot reach it -->
2. In the **AWS IAM console**, create a role for another AWS account, entering the InfraNest account ID and the External ID.
3. Give the role read access to the services you use (Route 53, Route 53 Domains, ACM).
4. Copy the role's ARN.

   <!-- manual-screenshot: set-up-aws-access-2 — taken by hand in the AWS console; the capture rig cannot reach it -->

## Option B: Connect with access keys

1. In the **AWS IAM console**, create an access key for a user with the same read access.
2. Copy the **Access key ID** and **Secret access key**.

## Finish connecting in InfraNest

1. Go back to InfraNest and follow **Connect Amazon Web Services (AWS)**.
2. Enter your role ARN, or your access keys, depending on which option you used.
3. Select **Connect** to finish.

> [!NOTE]
> You only need to grant read access to Route 53, Route 53 Domains and ACM — InfraNest doesn't need any other permissions to manage these services.