> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up an AWS Account Access Manager connector

> C1 provides identity governance and just-in-time provisioning for AWS Account Access Manager. Integrate your AWS Account Access Manager instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

## Capabilities

The AWS Account Access Manager connector syncs the following resources:

| Resource | Sync | Provision |
| :- | :- | :- |
| Applications | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | |
| Roles | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

<Note>
  This connector emits Role grants whose principal is an AWS Identity Center user or group, but it has no Identity Center sync of its own — so those grants carry an `ExternalResourceMatchID` annotation and the platform correlates them against whatever *other* connector (for example, an AWS Identity Center connector) already syncs that same identity. Once correlation runs, every grant principal is that connector's own user or group resource.

  The two placeholder resource types this uses are declared internally only to supply the principal resource-type IDs, and have no syncer, so they are not capabilities and do not appear above.

  **An Identity Center connector is a prerequisite, not an optimisation.** This connector declares that it requires an external connector, so a ConductorOne-hosted sync with none configured fails outright rather than completing with unresolved principals. If a sync errors saying an external connector is required, pair this connector with one that syncs the same IAM Identity Center instance.
</Note>

<Note>
  **Stale access can linger in AWS after you remove something.** Account Access Manager does not clean
  entitlements up on its own, so an assignment survives the deletion of the IAM role it points at, and the
  removal of the user or group from IAM Identity Center. Those rows keep appearing in synced grants until
  someone revokes them. Renaming an AWS account is not reflected either -- the account name captured when
  the assignment was created is the one you will see.
</Note>

## Gather AWS Account Access Manager credentials

<Warning>
  To configure the AWS Account Access Manager connector, you need IAM administrator permissions in the AWS account or organization where Account Access Manager is enabled.
</Warning>

C1 reaches your AWS account through an IAM role that you create and that trusts ConductorOne. You hand over no long-lived credentials, and you revoke access by editing that one trust policy. This is the only option for a C1-hosted connector — the access key fields are not offered there.

<Steps>
  <Step>
    In C1, open the connector's **Settings** and copy the value of **AWS Role External ID**. You will paste it into the trust policy below.
  </Step>

  <Step>
    Navigate to the [IAM Dashboard](https://us-east-1.console.aws.amazon.com/iamv2/home?) and select **Roles** > **Create role**.
  </Step>

  <Step>
    Select **Custom trust policy** and paste the following into the trust policy JSON editor, replacing `EXTERNAL_ID_FROM_C1` with the External ID you copied from C1:

    ```json theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::765656841499:role/ConductorOneService"
          },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": {
              "sts:ExternalId": "EXTERNAL_ID_FROM_C1"
            }
          }
        }
      ]
    }
    ```

    **Notes on the trust policy:**

    **`"Principal"`**: `arn:aws:iam::765656841499:role/ConductorOneService` is ConductorOne's isolated AWS service account. It is the only entity this policy trusts, so no other account can assume the role.

    **`"Action": "sts:AssumeRole"`**: the only action allowed, and it lets ConductorOne take a temporary session in your account rather than hold a standing credential.

    **`"Condition"`** on `sts:ExternalId`: a shared identifier confirming which trust relationship is in use, which is what prevents the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html). It must match character for character.
  </Step>

  <Step>
    Click **Next**, then attach the permissions policy from the next step (or *skip* **Add permissions** and attach it afterwards).
  </Step>

  <Step>
    Give the role a name, add any tags relevant to your organization, and click **Create role**. Open the new role and copy its **ARN** — that is the value for **AWS Role ARN** in C1.
  </Step>

  <Step>
    Attach a policy granting `account-access:ListApplications`, `account-access:GetApplication`, `account-access:ListEntitlements`, `account-access:CreateEntitlement`, and `account-access:DeleteEntitlement`, plus `organizations:ListAccounts`. `sso:ListInstances` is **optional but recommended**. `organizations:ListAccounts` is what lets the connector find the accounts to look for role assignments in; without it no roles are discovered. `organizations:ListAccounts` is not only an IAM question: AWS answers it from the organization's management account or a delegated administrator, and refuses it from an ordinary member account whatever the policy grants. So the connector has to run from one of those two. `sso:ListInstances` (the IAM prefix for IAM Identity Center is `sso`, not `sso-admin`, which is only the SDK's name for the API) is used only at setup, to confirm the **Identity Store ID** you enter is really this account's. Setup never fails over it: with the permission the connector can tell you when the ID is not one this account can see, and without it that check simply does not run. Granting it is still worth doing, because a wrong ID is otherwise invisible — **the sync succeeds, the roles appear, and every grant silently disappears**. If you cannot see the connector's logs, you can check it yourself: the ID here must match the **Identity Store ID** in the IAM Identity Center console under **Settings**, and a sync that produces roles but no grants is the symptom of a mismatch.
  </Step>

  <Step>
    For every IAM role you intend to grant access to through Account Access Manager, add a trust policy statement allowing the `account-access.amazonaws.com` service principal to `sts:AssumeRole` and `sts:SetContext`, with a `Condition` block matching `aws:SourceAccount` and `aws:SourceArn` for your application — without it, granting access to that role fails with a validation error.
  </Step>

  <Step>
    If a sync later fails with `AccessDenied: ... is not authorized to perform: sts:AssumeRole`, check the external ID before changing any permissions. AWS returns that same message for a mismatched `sts:ExternalId` as it does for a role that genuinely denies access. The connector's error names which hop failed and which field feeds it. Regenerating the External ID in C1 means updating this trust policy too.
  </Step>

  <Step>
    Look up the AWS Identity Store ID (Identity Center console → **Settings**, format `d-xxxxxxxxxx`) backing this Application's Identity Center instance, and copy the role ARN and Identity Store ID for the configuration step below.
  </Step>

  <Step>
    Make sure a connector that syncs the **same** IAM Identity Center instance is already set up in C1 — an AWS connector with Identity Center enabled, for example. This connector emits every role grant against an Identity Center user or group and syncs none of those identities itself, so without that pair there is nothing to correlate the grants to and the sync fails.
  </Step>
</Steps>

## Configure the AWS Account Access Manager connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **AWS Account Access Manager** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new AWS Account Access Manager connector:

        * Add the connector to a currently unmanaged app
        * Add the connector to a managed app
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the required configuration:

        * **AWS Region**: the primary region of your IAM Identity Center instance. Account access manager must be enabled in that same region.
        * **Identity Store ID** (required): the Identity Store ID for your IAM Identity Center instance, from the AWS IAM Identity Center console under **Settings**. Format `d-1234567890`, or a UUID if migrated from legacy AWS SSO. It must be the same identity store your AWS connector syncs.
        * **Application ARN** (optional): scope sync to a single Application. Leave blank to sync every Application visible to the credentials below.
        * **AWS Role ARN** / **AWS Role External ID**: the role C1 assumes in your account, and the external ID its trust policy must require.
      </Step>

      <Note>
        **AWS Region** is a fixed list of the AWS commercial regions enabled by default; opt-in regions, GovCloud and China are not offered, because account access manager is not available in them.

        **AWS Role ARN**'s trust policy has to authorize ConductorOne with the exact value shown in **AWS Role External ID** — see the trust-policy step above.

        If the connector fails on setup with **no Account Access Manager Applications are visible to these credentials**, the usual cause is **AWS Region**: it has to be the primary region of your IAM Identity Center instance, and account access manager has to be enabled there. The same message appears if the region is right but no Application has been created yet.
      </Note>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your AWS Account Access Manager connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to use the [AWS Account Access Manager](https://github.com/conductorone/baton-aws-account-access-manager) connector, hosted and run in your own environment.

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.

    ### Step 1: Set up a new AWS Account Access Manager connector

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new AWS Account Access Manager connector:

        * Add the connector to a currently unmanaged app
        * Add the connector to a managed app
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        In the **Settings** area of the page, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new Client ID and Secret.

        Carefully copy and save these credentials.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your AWS Account Access Manager connector deployment:

    #### Secrets configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-aws-account-access-manager-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-aws-account-access-manager-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # AWS Account Access Manager credentials
      BATON_REGION: <primary region of your IAM Identity Center instance>
      BATON_IDENTITY_STORE_ID: <identity store ID, e.g. d-1234567890>

      # Credentials: a static key pair, or omit both to use the ambient AWS
      # credential chain (instance role, IRSA). Add BATON_ROLE_ARN, and
      # BATON_EXTERNAL_ID if the role's trust policy requires one, to assume a
      # role on top of either.
      BATON_ACCESS_KEY_ID: <AWS access key ID>
      BATON_SECRET_ACCESS_KEY: <AWS secret access key>
    ```

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-aws-account-access-manager.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-aws-account-access-manager
      labels:
        app: baton-aws-account-access-manager
    spec:
      selector:
        matchLabels:
          app: baton-aws-account-access-manager
      template:
        metadata:
          labels:
            app: baton-aws-account-access-manager
            baton: "true"
            baton-app: aws-account-access-manager
        spec:
          containers:
          - name: baton-aws-account-access-manager
            image: public.ecr.aws/conductorone/baton-aws-account-access-manager:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-aws-account-access-manager
            envFrom:
            - secretRef:
                name: baton-aws-account-access-manager-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In C1, click **Applications**. On the **Managed apps** tab, locate and click the name of the application you added the AWS Account Access Manager connector to. AWS Account Access Manager data should be found on the **Entitlements** and **Resources** tabs.
      </Step>
    </Steps>

    **Done.** Your AWS Account Access Manager connector is now pulling access data into C1.
  </Tab>
</Tabs>

***

<Tip>
  All versions of this connector are available at [dist.conductorone.com](https://dist.conductorone.com/ConductorOne/baton-aws-account-access-manager).
</Tip>