> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Connect AWS to Layer to inventory IAM users and roles, S3 buckets, EC2 instances, and generate SOC 2, ISO 27001, and HIPAA compliance evidence automatically.

The AWS integration discovers IAM users, S3 buckets, and your account identity via STS. Use it to maintain a complete cloud infrastructure inventory and generate compliance evidence for access-control and asset-management controls in [Axiom Codex](/codex/index).

## What you'll need

* AWS account with permission to create an IAM user (or IAM role for cross-account access).
* Three minutes.

## Set it up

<Steps>
  <Step title="Create an IAM user in AWS">
    In the AWS Console, go to **IAM → Users → Add users**.

    * Name: `axiom-layer-readonly`
    * Access type: **Programmatic access**

    On the permissions step, attach the AWS-managed policy **`ReadOnlyAccess`** (or use the trimmed policy below if you want least privilege).
  </Step>

  <Step title="Save the access key">
    On the final step, copy the **Access key ID** and **Secret access key**. The secret is only shown once.
  </Step>

  <Step title="Paste into Layer">
    In Layer, go to **Integrations**, find AWS, and click **Connect**. Paste the Access Key ID, Secret Access Key, and your default region (e.g. `us-east-1`). Click **Connect**.
  </Step>

  <Step title="Wait for the first sync">
    The initial sync pulls your account identity, IAM users, and S3 bucket inventory. Typically finishes in under 10 minutes.
  </Step>
</Steps>

## Least-privilege policy

If you don't want to grant `ReadOnlyAccess`, attach this trimmed policy instead:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "iam:ListUsers",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    }
  ]
}
```

## What gets synced

| Object           | Fields             | Refresh cadence |
| ---------------- | ------------------ | --------------- |
| Account identity | account ID, region | Daily           |
| IAM users        | username           | Daily           |
| S3 buckets       | bucket name        | Daily           |

## Compliance evidence

AWS data generates evidence records for the following SOC 2 controls:

| Evidence            | Controls            |
| ------------------- | ------------------- |
| IAM user inventory  | CC6.1, CC6.2, CC6.3 |
| S3 bucket inventory | CC6.6, CC6.7        |

See the [SOC 2 evidence catalog](/codex/soc2-evidence-catalog) for full control descriptions.

## Troubleshooting

<AccordionGroup>
  <Accordion title="AccessDenied on first sync">
    Verify the IAM user has the permissions listed in the least-privilege policy above. If you're using a more restrictive policy, confirm that `sts:GetCallerIdentity`, `iam:ListUsers`, and `s3:ListAllMyBuckets` are all allowed.
  </Accordion>

  <Accordion title="I want to use cross-account roles instead of an access key">
    Cross-account role support is on the roadmap. Email [support@axiomancer.io](mailto:support@axiomancer.io) to be notified when it ships.
  </Accordion>
</AccordionGroup>