> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onepatch.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect your AWS account

> Give the OnePatch agent access to your AWS account through an IAM role you control.

The OnePatch agent can act in your AWS account while it investigates — describe resources, read logs, take whatever actions you permit. Access goes through an IAM role in your account: you decide what the role can do, and your CloudTrail records everything it does.

## Connect

An org admin connects on the **Integrations** page under **AWS account**. The card shows two values: the **Principal** — the AWS identity your role will trust — and an **External ID** unique to your organization.

<Steps>
  <Step title="Create the role">
    In your AWS account, create an IAM role whose trust policy names that principal and external ID. **Copy trust policy JSON** on the card gives you the exact document:

    ```json theme={null}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": { "AWS": "<principal from the card>" },
          "Action": "sts:AssumeRole",
          "Condition": { "StringEquals": { "sts:ExternalId": "<external ID from the card>" } }
        }
      ]
    }
    ```
  </Step>

  <Step title="Attach permissions">
    Attach the permissions you want the agent to have. `ReadOnlyAccess` is a reasonable start. The agent can do exactly what the role's policies allow, and you can widen or narrow them at any time without touching OnePatch.
  </Step>

  <Step title="Paste the role ARN">
    Paste the role's ARN into the card and click **Connect**. OnePatch verifies by assuming the role from your workspace, and the card flips to **Connected** within a few seconds. If it stays on **Verifying…**, it shows the error from the last attempt — usually a trust policy that doesn't match yet.
  </Step>
</Steps>

## How access works

Credentials are short-lived STS sessions, one hour at most, requested on demand while the agent works. Nothing long-lived is stored on either side.

Every API call appears in your CloudTrail under a session named for the chat that made it, so you can trace any action back to the conversation.

## Disconnect

**Disconnect** on the card stops OnePatch from requesting new credentials within about 30 seconds; sessions already issued expire within the hour. To revoke immediately, delete the role — or just its trust policy — in your account.