# Create a RudderStack IAM role for AWS-based destinations


{{< announcement >}}
This guide is applicable only for [RudderStack dashboard](https://app.rudderstack.com/) users. As the [access keys-based authentication](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-user.html) method is deprecated, RudderStack recommends setting up a RudderStack IAM role for authenticating your AWS destinations.

Note that this guide is **not applicable** for the following users:

- [RudderStack Open Source](https://github.com/rudderlabs/rudder-server):  You can use the [access keys-based method](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-user.html) to authenticate your AWS destinations.
- Customers with on-premise RudderStack deployments. [Contact](mailto:support@rudderstack.com) the RudderStack team to set up the IAM role.
{{< /announcement >}}

This guide contains the steps to create an IAM role for authenticating RudderStack while setting up the following AWS destinations:

#### Cloud destinations

{{< ftrdestinations ftrsupport="yes" type="streaming">}}

#### Warehouse destinations

{{< ftrdestinations ftrsupport="yes" type="warehouse">}}

<br />

{{< info >}}
See the [RudderStack IAM Role for Redshift]({{< ref "destinations/aws-iam-role-for-rudderstack/redshift-iam-role.md" >}}) guide to create an IAM role for authenticating RudderStack while setting up the Redshift destination.
{{< /info >}}

## Create RudderStack IAM role

To set up a new RudderStack IAM role, follow these steps:

1. Sign in to your AWS Management Console and open the [IAM console](https://console.aws.amazon.com/iam/).
2. In the left navigation pane, click **Roles** followed by **Create role**.
3. Under **Trusted entity type**, select **AWS account**:

{{< image src="images/destinations/aws-role-1.webp" alt="Setting up AWS IAM Role for RudderStack" >}}

4. Select **Another AWS account** and under **Account ID**, enter `422074288268`, the account ID associated with RudderStack.
5. Under **Options** check **Require external ID** and enter your [workspace ID]({{< ref "dashboard-guides/_index.md#workspace-id" >}}) as the **External ID**.

{{< warning >}}
RudderStack currently **does not support** MFA setting that restricts the role only to the users who sign in using [multi-factor authentication (MFA)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html). Hence, do not check the **Require MFA** option.
{{< /warning >}}

{{< image src="images/destinations/aws-role-2.webp" alt="Setting up AWS IAM Role for RudderStack" >}}

6. Review all settings carefully and click **Next** to proceed.
7. Select your destination-specific permission policies applicable for the RudderStack IAM role. To create a new policy from scratch, click **Create policy**. For more information, refer to the [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-start) guide.
8. **Optional**: You can also set a [permissions boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html). Expand the **Set permissions boundary** section, choose **Use a permissions boundary to control the maximum role permissions**, and select the policy to use for the permissions boundary. An example is shown below:

{{< image src="images/destinations/aws-role-3.webp" alt="Setting up AWS IAM Role for RudderStack" >}}

9. Review all settings carefully and click **Next** to proceed.
10. Enter a unique name for your role. Note that this name cannot be distinguished by case. For example, you cannot create a role named `RUDDERSTACK` if `rudderstack` already exists.

{{< warning >}}
You cannot edit the name of the role after it has been created.
{{< /warning >}}

11. **Optional**: Enter the description for this role.
12. To edit the use case or permissions for the role, click the **Edit** button next to the **Step 1: Select trusted entities** or **Step 2: Add permissions**, respectively.

{{< image src="images/destinations/aws-role-4.webp" alt="Setting up AWS IAM Role for RudderStack" >}}

13. **Optional**: You can also add metadata to the role by attaching tags as key-value pairs. For more information, refer to the [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) guide.
14. Click **Create role** to complete the setup.
15. Finally, note the **ARN** of this newly created role. 

{{< image src="images/destinations/aws-role-5.webp" alt="Setting up AWS IAM Role for RudderStack" >}}

This ARN is required while configuring your AWS destination when you enable the **Role-based Authentication** setting:

{{< image src="images/destinations/aws-role-6.webp" alt="Setting up AWS IAM Role for RudderStack" >}}

## Destination-specific policy permissions

Refer to the following sections for the destination-specific policy permissions:

- [EventBridge]({{< ref "destinations/streaming-destinations/amazon-eventbridge.md#policy-permissions" >}})
- [Kinesis]({{< ref "destinations/streaming-destinations/amazon-kinesis.md#policy-permissions" >}})
- [Kinesis Firehose]({{< ref "destinations/streaming-destinations/amazon-kinesis-firehose.md#policy-permissions" >}})
- [Lambda]({{< ref "destinations/streaming-destinations/aws-lambda.md#policy-permissions" >}})
- [Personalize]({{< ref "destinations/streaming-destinations/aws-personalize.md#policy-permissions" >}})
- [Redshift]({{< ref "destinations/aws-iam-role-for-rudderstack/redshift-iam-role.md" >}})
- [S3]({{< ref "destinations/streaming-destinations/amazon-s3.md#option-1-use-rudderstack-iam-role" >}})