Set up AWS access

Connect your AWS account so InfraNest can manage your Route 53 DNS zones, Route 53 Domains, and read your ACM certificates. This article is for anyone setting up AWS access for the first time.

#Overview

• InfraNest needs access to Route 53, Route 53 Domains and ACM to show and manage your domains and DNS records.
• You can grant access with an IAM role (recommended) or with access keys.
• Either method needs permission to change things, not just read them — read-only access will fill in your lists, but every edit you try to make in InfraNest will be refused.

NoteIf you don't use a particular AWS feature (for example Route 53 Domains), you can leave its permissions out — just untick that group on the connection in InfraNest. Lists will still load without write access, but changes will be refused.

#Set up an IAM role (recommended)

A role means InfraNest never stores your secrets, and you can revoke access at any time by deleting the role.

1. In InfraNest, open Integrations → AWS, select Connect, and choose IAM role under Connection method. The form will show InfraNest's AWS account ID and a generated External ID — make a note of both, you'll need them.

2. In the AWS IAM console, go to Roles → Create role, choose AWS account → Another AWS account, enter InfraNest's account ID, tick Require external ID, and paste in the External ID.
3. Attach a policy with the permissions listed below.
4. Name the role (for example InfraNest), create it, then copy its ARN from the role's summary page.

#Set up access keys instead

1. In the AWS IAM console, go to Users → Create user and attach a policy with the permissions listed below.
2. Open the user's Security credentials and choose Create access key → Third-party service.
3. Copy the Access key ID and Secret access key. The secret access key is only shown once, so save it somewhere safe.

#Choose the right permissions

The quickest option is to use AWS's managed policies: AmazonRoute53FullAccess, AmazonRoute53DomainsFullAccess, and AWSCertificateManagerReadOnly.

If you'd rather write your own policy, these are the actions InfraNest uses:

• Route 53 (DNS) — route53:ListHostedZones, route53:ListResourceRecordSets, route53:ChangeResourceRecordSets, route53:CreateHostedZone, route53:DeleteHostedZone.
• Route 53 Domains — route53domains:ListDomains, GetDomainDetail, CheckDomainAvailability, CheckDomainTransferability, ListPrices, RegisterDomain, TransferDomain, RenewDomain, RetrieveDomainAuthCode, UpdateDomainNameservers, UpdateDomainContact, UpdateDomainContactPrivacy, EnableDomainTransferLock, DisableDomainTransferLock, EnableDomainAutoRenew, DisableDomainAutoRenew, AssociateDelegationSignerToDomain, DisassociateDelegationSignerToDomain.
• ACM (certificates) — acm:ListCertificates, acm:GetCertificate, acm:DescribeCertificate. This is read-only.
• Access keys only — sts:GetCallerIdentity, so InfraNest can tell which AWS account the keys belong to.

#Finish connecting in InfraNest

1. Go back to InfraNest and follow Connect Amazon Web Services (AWS).
2. Enter your role ARN (if you set up an IAM role) or your access keys (if you created those instead).

#Tips

TipPrefer the IAM role method if you can — it avoids storing long-lived secrets and is easy to revoke by deleting the role in AWS.