Amazon Web Services

Baton AWS Connector - Sync IAM users, roles, groups, and policies from AWS

Prerequisites

• A Mesh administrator account with permission to manage connectors.
• global_region (optional) — AWS region for global operations (default: us-east-1)
• global_access_key_id (optional) — AWS Access Key ID for authentication
• global_role_arn (optional) — ARN of IAM role to assume (alternative to access keys)
• use_assume (optional) — Enable assume role authentication
• external_id (optional) — External ID for assume role (required if use_assume is true, 32-65 chars)
• role_arn (optional) — ARN of role to assume when use_assume is enabled
• global_aws_orgs_enabled (optional) — Enable AWS Organizations support
• global_aws_sso_enabled (optional) — Enable AWS IAM Identity Center (SSO) support
• global_aws_sso_region (optional) — AWS region for SSO identities (default: us-east-1)
• scim_enabled (optional) — Enable SCIM API for SSO user status
• scim_endpoint (optional) — SCIM v2 endpoint URL for AWS Identity Center
• sync_secrets (optional) — Whether to sync AWS Secrets Manager secrets
• iam_assume_role_name (optional) — IAM role name for assuming roles across accounts
• Credentials for authentication: global_secret_access_key, scim_token (stored write-only).

Authentication

Method: Bearer token

Mesh authenticates with a token (personal access token, API token, or bot token).

Field	Required	Secret	Description
global_secret_access_key	No	Yes (write-only)	AWS Secret Access Key (stored as secret)
scim_token	No	Yes (write-only)	SCIM v2 authentication token (stored as secret)

Capabilities

Capability	Supported	Notes
Identity & entitlement sync	✓
Writeback / remediation	—	Read-only

Data model

This information is not yet available from the connector schema.

Setup

1. Gather the required value: global_region.
2. Gather the required value: global_access_key_id.
3. Gather the required value: global_role_arn.
4. Gather the required value: use_assume.
5. Gather the required value: external_id.
6. Gather the required value: role_arn.
7. Gather the required value: global_aws_orgs_enabled.
8. Gather the required value: global_aws_sso_enabled.
9. Gather the required value: global_aws_sso_region.
10. Gather the required value: scim_enabled.
11. Gather the required value: scim_endpoint.
12. Gather the required value: sync_secrets.
13. Gather the required value: iam_assume_role_name.
14. Create the required credentials in the source system: global_secret_access_key, scim_token.
15. In Admin → Connectors, add the connector and enter its configuration.
16. Save and run an initial collection.

Troubleshooting

This information is not yet available from the connector schema.