> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leanly.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Web Services

> Connect your AWS account so Leanly can provision and manage infrastructure on your behalf.

Connect your AWS account by creating a single IAM role for Leanly — the operator role. Leanly uses it to create narrowly scoped, workload-specific roles as you deploy. No broader access is ever requested.

## Connect using our agent skill

The fastest way to connect your AWS account. The agent skill walks you through the setup and configures the required IAM role automatically.

<Prompt description="Copy and run this prompt to connect your AWS account automatically." actions={["copy"]}>
  Connect my AWS account to Leanly.
</Prompt>

## Manual setup

If you prefer to configure the IAM role yourself, follow the steps below.

<Accordion title="Set up manually">
  ### Before you begin

  * **AWS account access** — make sure you are logged in to the AWS account you want to connect.
  * **Your Leanly tenant ID** — find this in your Leanly dashboard under {/* TODO: confirm exact path */} **Settings**.

  ### 1. Deploy the operator role

  <Steps>
    <Step title="Open CloudFormation">
      In your AWS Management Console, navigate to **CloudFormation**.
    </Step>

    <Step title="Create a new stack">
      Click **Create stack** and choose **With new resources (standard)**.
    </Step>

    <Step title="Specify the template">
      Under **Specify template**, select **Amazon S3 URL** and enter the following, then click **Next**.

      ```
      https://s3.amazonaws.com/operatortemplates.leanly.cloud/AwsDevOpsEngineer.json
      ```
    </Step>

    <Step title="Name your stack">
      Enter a stack name to help you identify the resources this template creates later (e.g. `LeanlyOperator`).
    </Step>

    <Step title="Enter your Leanly tenant ID">
      Under **Parameters**, provide your Leanly tenant ID and click **Next**.
    </Step>

    <Step title="Review options">
      Optionally configure tags, permissions, and advanced options. You can skip this for most setups.
    </Step>

    <Step title="Acknowledge IAM capabilities">
      At the bottom of the page, acknowledge the required IAM capabilities and click **Next**.
    </Step>

    <Step title="Submit">
      Review your configuration and click **Submit**. Deployment usually takes 1–2 minutes.

      <Note>Wait until the stack status changes to **CREATE\_COMPLETE** before proceeding.</Note>
    </Step>

    <Step title="Copy the operator role ARN">
      Open the **Outputs** tab and copy the **OperatorRoleArn** value — you'll need it in the next step.
    </Step>
  </Steps>

  ### 2. Connect the role to Leanly

  <Steps>
    <Step title="Open integrations">
      In your Leanly dashboard, go to **Integrations**, select **Amazon Web Services**, and click **Connect Account**.
    </Step>

    <Step title="Acknowledge the deployment">
      Confirm that you have deployed the operator role. This will reveal the ARN input field.
    </Step>

    <Step title="Provide the role ARN">
      Paste the **OperatorRoleArn** value you copied and click **Connect Account**.
    </Step>
  </Steps>
</Accordion>

## Permissions

The operator role is granted the minimum permissions needed to manage workload infrastructure on your behalf.

| Permission                               | Access         | Why                                                      |
| ---------------------------------------- | -------------- | -------------------------------------------------------- |
| ReadOnlyAccess                           | Read           | Detect existing resources and read account configuration |
| IAM role and instance profile management | Read and write | Create and manage workload-specific IAM roles            |
| IAM policy management                    | Read and write | Attach and manage policies on workload roles             |
| `iam:PassRole`                           | Write          | Pass roles to AWS services when deploying workloads      |