AWS
Connect to your AWS account with an IAM role.
IAM role setup
Create an IAM role in your AWS account that trusts the INT21 AgentPlatform AWS Principal shown below. This allows INT21 AgentPlatform to assume the role and obtain short-lived STS credentials. Those credentials can call only the AWS APIs permitted by the role's policies. The example grants read-only access to one S3 bucket.
Paste each step into the same terminal. Edit the placeholders before running steps 2 and 3.
AWS_PRINCIPAL='arn:aws:iam::690845170369:role/sandbox-service-core-role'Replace YOUR_ROLE_NAME with the IAM role name you want to use.
ROLE_NAME=YOUR_ROLE_NAMEReplace YOUR_BUCKET_NAME with the S3 bucket you want this role to read.
BUCKET_NAME=YOUR_BUCKET_NAMEcat > /tmp/int21-role-trust.json <<EOF
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"AWS": "$AWS_PRINCIPAL"},
"Action": "sts:AssumeRole"
}]
}
EOFaws iam create-role \
--role-name "$ROLE_NAME" \
--assume-role-policy-document file:///tmp/int21-role-trust.jsonS3 read access is an example. You can customize the role's permissions for the AWS APIs your agent needs.
cat > /tmp/int21-agentplatform-access.json <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::$BUCKET_NAME"
},
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::$BUCKET_NAME/*"
}
]
}
EOFaws iam put-role-policy \
--role-name "$ROLE_NAME" \
--policy-name Int21AgentPlatformAccess \
--policy-document file:///tmp/int21-agentplatform-access.jsonaws iam get-role \
--role-name "$ROLE_NAME" \
--query 'Role.Arn' \
--output textCopy the role ARN printed by the final command into the field on the left.
You can later change the permissions in the AWS Console by modifying the IAM policy Int21AgentPlatformAccess.