Skip to main content
The AWS plugin enables formae to manage AWS resources using the AWS Cloud Control API.

Configuration

Target

Configure an AWS target in your Forma file:
Config field mutability: See Replacing a target for details.

Credentials

The plugin uses the standard AWS credential chain. Configure credentials using one of the following methods: Environment Variables:
Named Profile:
You can also restrict credential usage to a named profile using the profile property:
IAM Instance Profile / ECS Task Role: When running on EC2 or ECS, credentials are automatically retrieved from the instance metadata service. OIDC (for CI/CD): For GitHub Actions, use aws-actions/configure-aws-credentials with OIDC federation.

Required IAM permissions

The credentials above must be allowed to perform the operations the plugin needs. Two distinct sets of permissions apply:
  • Apply / destroy: create, read, update, and delete the resource types in your formas. The AWS-managed PowerUserAccess policy covers most services, but excludes IAM; managing IAM resources (roles, policies, users, instance profiles) requires explicit iam:* grants.
  • Discovery: the agent continuously discovers existing resources via the CloudControl ListResources API. This needs read-only List* / Describe* / Get* permissions across the services you want discovered. For IAM in particular, PowerUserAccess does not grant iam:List* / iam:Get*, so without them discovery logs recurring 403 errors (e.g. iam:ListServerCertificates, iam:ListSAMLProviders, iam:ListOpenIDConnectProviders, iam:ListGroups).
For a complete, copy-pasteable task-role policy, including the IAM management and read-only discovery statements, see Install on AWS: Create IAM roles.