Configuration
Target
Configure an AWS target in your Forma file:
See Replacing a target for details.
Credentials
The plugin uses the standard AWS credential chain. Configure credentials using one of the following methods: Environment Variables:profile property:
aws-actions/configure-aws-credentials with OIDC federation.
Required IAM permissions
The credentials above must be allowed to perform the operations the plugin needs. Two distinct sets of permissions apply:- Apply / destroy: create, read, update, and delete the resource types in your formas. The AWS-managed
PowerUserAccesspolicy covers most services, but excludes IAM; managing IAM resources (roles, policies, users, instance profiles) requires explicitiam:*grants. - Discovery: the agent continuously discovers existing resources via the CloudControl
ListResourcesAPI. This needs read-onlyList*/Describe*/Get*permissions across the services you want discovered. For IAM in particular,PowerUserAccessdoes not grantiam:List*/iam:Get*, so without them discovery logs recurring403errors (e.g.iam:ListServerCertificates,iam:ListSAMLProviders,iam:ListOpenIDConnectProviders,iam:ListGroups).

