--- title: Set up AWS credentials source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/set-up-aws-credentials --- Configure AWS authentication for New Relic workflow automation. Choose between IAM roles, IAM users, or session tokens to securely connect workflows with AWS services like EC2, SQS, and DynamoDB. ## Prerequisites Before setting up AWS credentials, ensure you have: - An AWS account with permission to create IAM roles or users. - Your [New Relic account ID](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/account-id). - Admin access to the [AWS IAM Console](https://console.aws.amazon.com/iam/). ## Required permissions [#required-permissions] Before creating credentials, understand what permissions your workflows need. Grant only the permissions your workflows actually use—this follows the principle of least privilege and minimizes security risk. ### Common workflow permissions | **Workflow type** | **Required AWS permissions** | **Description** | | ------------------ | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | **EC2 management** | `ec2:DescribeInstances` `ec2:StopInstances` `ec2:StartInstances` `ec2:ModifyInstanceAttribute` | Stop, start, or modify EC2 instances in response to alerts | | **SQS messaging** | `sqs:SendMessage` `sqs:GetQueueAttributes` | Send messages to SQS queues for downstream processing | | **DynamoDB** | `dynamodb:Query` `dynamodb:GetItem` `dynamodb:PutItem` | Read from or write to DynamoDB tables | > #### 💡 TIP > > Start with read-only permissions (`Describe*`, `Get*`, `List*`), then add write permissions (`Put*`, `Create*`, `Delete*`) only as needed. This prevents accidental destructive actions during testing. See [AWS policy examples](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/policy-examples) for complete IAM policy templates for these workflow types. ## Choose your authentication method [#choose-method] | **Method** | **Use cases** | **Characteristics** | | --------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | [**IAM role**](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-role-setup)(recommended) | Production workflows, all AWS services | - Credentials rotate automatically - Access is time-limited by design - All actions are logged in AWS CloudTrail - Aligns with AWS security best practices | | [**IAM user with access keys**](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-user-setup) | - Testing and development environments - AWS configurations that don't support cross-account role assumption - Simplified authentication workflows | - Access keys are long-lived credentials - Rotate them regularly (every 90 days) - Limit permissions to only what your workflows need | | [**Session tokens**](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/session-tokens-setup) | - Local development and testing - CI/CD pipelines requiring credential rotation - Environments with compliance requirements for time-limited access (typically 1-12 hours) | - Temporary credentials with automatic expiration - Session tokens expire (typically after 1 hour) - Set a reminder to refresh them before expiration | ## Using credentials in workflows [#use-credentials] After setting up authentication, reference your credentials in workflow configurations: ### IAM role (recommended) Paste the role ARN directly into workflow inputs—no [secrets manager](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-best-practices#secure-credentials) needed: ```yaml awsRoleArn: arn:aws:iam::123456789012:role/NewRelicWorkflowAutomationRole ``` > #### ⚠️ IMPORTANT > > Role ARNs are resource identifiers, not sensitive credentials. Don't store them in secrets manager—paste them directly into workflow configurations. ### IAM user or session tokens Reference [secrets manager](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-best-practices#secure-credentials) for access keys: ```yaml awsAccessKeyId: ${{ :secrets:awsAccessKeyId }} awsSecretAccessKey: ${{ :secrets:awsSecretAccessKey }} awsSessionToken: ${{ :secrets:awsSessionToken }} # Only for session tokens ``` New Relic retrieves secrets at runtime, authenticates with AWS, then discards them. Your credentials never appear in logs or workflow history. ## Related topics [#related-topics] [IAM role setup](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-role-setup) Configure IAM role for production workflows (recommended) [IAM user setup](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-user-setup) Set up IAM user with access keys for testing [Session tokens setup](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/session-tokens-setup) Generate temporary session tokens for local development [AWS policy examples](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/policy-examples) Complete IAM policies for EC2, SQS, DynamoDB, and more [AWS actions](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/actions-catalog) Browse EC2, Lambda, S3, SQS, and other AWS actions [EC2 management example](https://docs.newrelic.com/docs/workflow-automation/workflow-examples/advanced/ec2-management) See AWS credentials in action with EC2 workflows