# Amazon Web Services

Baton AWS Connector - Sync IAM users, roles, groups, and policies from AWS

## Prerequisites

- A Mesh administrator account with permission to manage connectors.
- `global_region` (optional) — AWS region for global operations (default: us-east-1)
- `global_access_key_id` (optional) — AWS Access Key ID for authentication
- `global_role_arn` (optional) — ARN of IAM role to assume (alternative to access keys)
- `use_assume` (optional) — Enable assume role authentication
- `external_id` (optional) — External ID for assume role (required if use_assume is true, 32-65 chars)
- `role_arn` (optional) — ARN of role to assume when use_assume is enabled
- `global_aws_orgs_enabled` (optional) — Enable AWS Organizations support
- `global_aws_sso_enabled` (optional) — Enable AWS IAM Identity Center (SSO) support
- `global_aws_sso_region` (optional) — AWS region for SSO identities (default: us-east-1)
- `scim_enabled` (optional) — Enable SCIM API for SSO user status
- `scim_endpoint` (optional) — SCIM v2 endpoint URL for AWS Identity Center
- `sync_secrets` (optional) — Whether to sync AWS Secrets Manager secrets
- `iam_assume_role_name` (optional) — IAM role name for assuming roles across accounts
- Credentials for authentication: global_secret_access_key, scim_token (stored write-only).

## Authentication

**Method:** Bearer token

Mesh authenticates with a token (personal access token, API token, or bot token).

| Field | Required | Secret | Description |
| --- | --- | --- | --- |
| `global_secret_access_key` | No | Yes (write-only) | AWS Secret Access Key (stored as secret) |
| `scim_token` | No | Yes (write-only) | SCIM v2 authentication token (stored as secret) |

## Capabilities

<CapabilityMatrix
  capabilities={[
    { name: "Identity & entitlement sync", supported: true },
    { name: "Writeback / remediation", supported: false, notes: "Read-only" },
  ]}
/>

## Data model

_This information is not yet available from the connector schema._

## Setup

1. Gather the required value: `global_region`.
2. Gather the required value: `global_access_key_id`.
3. Gather the required value: `global_role_arn`.
4. Gather the required value: `use_assume`.
5. Gather the required value: `external_id`.
6. Gather the required value: `role_arn`.
7. Gather the required value: `global_aws_orgs_enabled`.
8. Gather the required value: `global_aws_sso_enabled`.
9. Gather the required value: `global_aws_sso_region`.
10. Gather the required value: `scim_enabled`.
11. Gather the required value: `scim_endpoint`.
12. Gather the required value: `sync_secrets`.
13. Gather the required value: `iam_assume_role_name`.
14. Create the required credentials in the source system: global_secret_access_key, scim_token.
15. In Admin → Connectors, add the connector and enter its configuration.
16. Save and run an initial collection.

## Troubleshooting

_This information is not yet available from the connector schema._