> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/aws.md).

# AWS

Installing P0 IAM management on AWS takes about 10 minutes.

### Before you begin

* Choose at least one account on which to install P0.
* Make sure you have the ability to create roles, add trust relationships, and create and assign role polices. You can do this if you have the [IAMFullAccess managed policy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/IAMFullAccess.html) attached to your user.

### Setting up AWS IAM management

{% hint style="info" %}
For fine-grained Kubernetes access in EKS use the [P0 Kubernetes integration](/integrations/resource-integrations/kubernetes.md).
{% endhint %}

1. Navigate to "Integrations" on [p0.app](https://p0.app), then select "AWS". Choose the "IAM management" component:

<figure><img src="/files/oquAhMb0mBYOJ09LP6wn" alt="" width="563"><figcaption></figcaption></figure>

2. Click the "Add account" button to begin the installation

<figure><img src="/files/z4gQZ03LnBvoPUrcLSjg" alt="" width="563"><figcaption></figcaption></figure>

3. Enter an AWS numeric account ID, then click "Next".

<figure><img src="/files/z5wK5Io1jQJKkDVbrUjT" alt="" width="563"><figcaption></figcaption></figure>

4. The next page will display commands you can run using the AWS CLI to provision P0. You can also run these commands using AWS Cloud Shell.

<figure><img src="/files/GEXzt4K8bsrybnZOTW1p" alt="" width="563"><figcaption></figcaption></figure>

5. Copy and run these commands or use the Terraform configuration to deploy the changes. Click "Next" to verify the installation. If verification is successful you will be taken to the integration configuration page.

<figure><img src="/files/W7bGF1OVzFzIA6xAO4a4" alt="" width="563"><figcaption></figcaption></figure>

### Configuring P0 with AWS

On the configuration page, you define how users are provisioned in AWS:

{% tabs %}
{% tab title="As AWS IAM users" %}
If users are defined in the account's IAM service, choose "As AWS IAM users".

If the user's names equal their email addresses choose "User name is user email".

If users are defined in the account's IAM service, but their user names do not equal their email, you'll need to add a tag to each user you want to allow access via P0. For example, with a tag named "Email":

<figure><img src="/files/OVE6o1Qxn6PaAhd30jm1" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="/files/KhgU3e8n9oIejaIQZVAq" alt="" width="459"><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Via AWS Identity Center" %}
If users are provisioned via Identity Center (for example, if you provision via SSO), choose "Via AWS Identity Center".

One requirement applies:

* P0 must be installed on the management account where the Identity Center instance resides

Use the "How are users identified in AWS Identity Center?" dropdown to tell P0 which Identity Center attribute holds the user's email address:

* **Username is user's email** (default): Select this option if each user's Identity Center user name equals their email address. P0 matches users by user name.
* **User's IDC email is user's email**: Select this option if user names don't equal email addresses and the email appears in the Identity Center email attribute instead. P0 matches users by email address.

To finish the configuration, select the management account in which the Identity Center instance resides, choose how to identify users, and click "Next".

<figure><img src="/files/OGhwC1ArOSI6FpfmIKhb" alt="" width="422"><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Via a federated identity provider" %}
If you use an IAM identity provider to sign in users to your AWS account choose "Via a federated identity provider". This is a legacy sign in method. AWS recommends using Identity Center.

{% hint style="info" %}
Currently only Okta SAML federation is supported via an AWS Account Federation.

An installed [Okta directory integration](/integrations/directory-integrations/okta.md) is required. Your AWS Account Federation Okta app must be in the same Okta organization as the one installed as the directory integration.
{% endhint %}

Saving the configuration by clicking "Next" automatically applies the following changes to your AWS Account Federation app:

* Adds a custom attribute `managedByP0` to your Okta app's user profile. This allows P0 to clean up dynamically assigned users from your AWS SSO Okta app.
* Enables the [`Join all roles`](https://help.okta.com/en-us/content/topics/deploymentguides/aws/aws-configure-aws-app.htm) flag. This allows users to assume AWS roles assigned by P0 directly to their Okta user.

<figure><img src="/files/H2KmylvLc4GtEbVzzwTX" alt="" width="499"><figcaption></figcaption></figure>

> When editing or making changes to your role-pool always refresh your application data. You can find this action by navigating to your Okta environment as a super admin.
>
> \ <img src="/files/I721z9NSHFqmslCNR5nx" alt="" data-size="original">
>
> <https://support.okta.com/help/s/article/Refresh-Application-Data-Functionality-and-Usage?language=en_US>
> {% endtab %}

{% tab title="Via AWS Identity Center (merged permission set)" %}
{% hint style="info" %}
This option is in beta.
{% endhint %}

Choose "Via AWS Identity Center (merged permission set)" to provision access through a single shared Identity Center permission set per user, rather than creating a new permission set for each access request. Each request attaches its own customer-managed policy to the shared permission set, which avoids Identity Center permission-set sprawl.

This option requires a separately installed AWS Identity Center (merged) integration on the account that hosts the Identity Center instance. Install it first — see [Installing the AWS Identity Center (merged) integration](#installing-the-aws-identity-center-merged-integration).

To finish the configuration, select the account that hosts the Identity Center instance, then click "Next".
{% endtab %}
{% endtabs %}

### Installing the AWS Identity Center (merged) integration

{% hint style="info" %}
This integration is in beta.
{% endhint %}

The "Via AWS Identity Center (merged permission set)" provisioning option requires a dedicated AWS Identity Center (merged) integration. Install it on the AWS account that hosts your Identity Center instance — typically your management or delegated administrator account. With this integration, P0 manages a single shared permission set per user and attaches a per-request customer-managed policy to it, instead of creating a separate permission set for every request.

1. Navigate to "Integrations" on [p0.app](https://p0.app), then select the "AWS MIDC" integration.
2. Enter the AWS account ID of the account that hosts the Identity Center instance.
3. Enter the AWS region where Identity Center is installed (for example, `us-east-1`). This region must match the region where your Identity Center instance resides.
4. Select the AWS partition: `aws` for commercial regions or `aws-us-gov` for GovCloud.
5. Run the displayed AWS CLI commands to provision P0's access. You can also run these commands using AWS Cloud Shell. These commands create the `P0RoleMergedIdc` role, which grants P0 permission to manage Identity Center permission sets and account assignments.
6. Click "Next" to verify the installation.
7. After verification, choose how P0 identifies users in Identity Center:
   * **Username is user's email** (default): P0 matches users by their Identity Center user name.
   * **User's IDC email is user's email**: P0 matches users by the email attribute on their Identity Center profile.

After you install the integration, return to your AWS IAM management configuration and select "Via AWS Identity Center (merged permission set)".

### Setting up AWS resource inventory

Installing P0 resource inventory on AWS takes about 10 minutes.

The resource inventory component extends the IAM management integration and allows requesting [fine-grained resource-level](/integrations/resource-integrations/aws/requesting-access.md#fine-grained-resource-level-access) access in AWS.

{% hint style="info" %}
An installed AWS IAM management integration is required
{% endhint %}

1. Navigate to "Integrations" on [p0.app](https://p0.app), then select "AWS". Choose the "Resource inventory" component:

<figure><img src="/files/oquAhMb0mBYOJ09LP6wn" alt="" width="563"><figcaption></figcaption></figure>

2. Click "Add account"

<figure><img src="/files/wOjhtUBgqT8olp6ze1bc" alt="" width="563"><figcaption></figcaption></figure>

3. Choose one of the AWS accounts already installed for IAM management:

<figure><img src="/files/7UXfgMD0eYoBfbrHoPEW" alt="" width="563"><figcaption></figcaption></figure>

4. Run the AWS CLI commands to configure Resource Explorer

<figure><img src="/files/mloqJw1rQrEjneavX6In" alt="" width="563"><figcaption></figcaption></figure>

5. Click "Next" to validate your setup. You will land on the resource inventory configuration page. Clicking "Next" again takes you back to the Resource inventory overview page.

<figure><img src="/files/XCWuYwPfvV5G0nKepE6P" alt="" width="563"><figcaption></figcaption></figure>

And that's it. You're all set to start granting just-in-time, least-privileged access to AWS with P0.