> For the complete documentation index, see [llms.txt](https://docs.tonic.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tonic.ai/fabricate/workspaces/workspace-aws-roles.md).

# Configuring available AWS roles for a workspace

For authentication to a PostgreSQL, MySQL, or Amazon Redshift server connection, you can choose to use an IAM role instead of a password. The Data Agent can also use IAM roles to connect to Amazon S3 or Kafka.

You configure the available roles from the **AWS Roles** section of the workspace settings page.

<figure><img src="/files/SFvEeG7Cl1yRMvtUvxKf" alt=""><figcaption><p>AWS Roles section of the workspace settings page</p></figcaption></figure>

## Adding a role <a href="#role-add" id="role-add"></a>

To add an AWS role:

1. Click **Add AWS Role**.

<figure><img src="/files/ypV2a6Vjed2oa5FWYVa3" alt=""><figcaption><p>Add AWS role panel to add a role to the list</p></figcaption></figure>

2. In the **Name** field, provide the name of the role.
3. In the **Role ARN** field, provide the ARN of the role.
4. In the **Region** field, provide the AWS Region for the role.
5. Optionally, in the **Note** field, provide a description of how the role is intended to be used.
6. Note that before you can test or use the role, you must configure the role trust policy in AWS.\
   \
   To test the role, click **Test Role**.
7. To save the role, click **Save**.

## Configuring the trust policy for the role <a href="#role-trust-policy" id="role-trust-policy"></a>

The role's trust policy must allow the Fabricate's principal to call `sts:AssumeRole` with a condition that requires `sts:ExternalId` to equal the external ID.

Here is an example trust policy. The role creation panel also provides access to an example policy. To display the example policy, click **Show trust policy**. To copy the example policy, click **Copy**.

{% code overflow="wrap" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<Fabricate assumer role ARN>"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<external ID>"
        }
      }
    }
  ]
}
```

{% endcode %}

In the policy:

* Replace `<Fabricate assumer role ARN>` with the ARN for the assumer role.
  * On Fabricate Cloud, the example policy automatically populates the assumer role ARN.
  * On a self-hosted instance, the assumer role ARN is the value of the environment variable `FABRICATE_AWS_ASSUMER_ROLE_ARN`. You obtain the value from your Fabricate administrator.
* Replace `<external ID>` with the external identifier that Fabricate generates and displays in the **External ID** field.

## Editing a role <a href="#role-edit" id="role-edit"></a>

To edit the role configuration:

1. Click the edit icon for the role.
2. Update the role configuration.
3. Click **Save**.

## Deleting a role <a href="#role-delete" id="role-delete"></a>

You cannot delete a role that is currently used by a server connection.

To delete a role, click its delete icon.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.tonic.ai/fabricate/workspaces/workspace-aws-roles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.