> For the complete documentation index, see [llms.txt](https://docs.strongdm.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.strongdm.com/admin/deployment/integrations/aws.md).

# AWS

The Amazon Web Services (AWS) cloud can be used to host StrongDM nodes and manage secrets. StrongDM can govern access to AWS CLI and many AWS resource types.

### Secrets Management

StrongDM integrates with the AWS Secrets Manager to allow your nodes to proxy access to resources using secrets that are added and maintained in your cloud-native secrets manager.

{% content-ref url="/pages/5jr3alldYkQSVkuISSsj" %}
[AWS Secrets Manager](/admin/access/secret-stores/aws-secrets-manager.md)
{% endcontent-ref %}

### Node Management

When configuring gateways or relays to proxy client traffic to resources, the EC2 Nodes guide can be of use for setup.

{% content-ref url="/pages/v774LhiTuRh13hmMf000" %}
[EC2 Nodes](/admin/networking/gateways-and-relays/ec2-nodes.md)
{% endcontent-ref %}

### Resources

Additionally, StrongDM offers proxied access to cloud resources using the following resource types.

#### Cloud Resources

* **AWS (Instance Profile)** - Proxy access to manage your Amazon Cloud via the aws command line tool, using EC2 instances for your nodes and Instance Profile access to authenticate the nodes to the cloud. See the [AWS (Instance Profile) guide](/admin/resources/clouds/aws-instance-profile.md) for more details.
* **AWS Cloud** - Proxy access to manage your Amazon cloud via the aws command line tool, using Secret Access Keys to authenticate your nodes to the cloud. See the [AWS Cloud guide](/admin/resources/clouds/aws.md) for more details.
* **AWS Management Console** - Proxy access to manage your Amazon Cloud for service accounts via the aws command line tool, using environment-loaded credentials on your nodes or Secret Access Keys to authenticate your nodes to the cloud. See the [AWS Management Console guide](/admin/resources/clouds/aws-console.md) for more details.

#### Cluster Resources

When setting up Kubernetes, it's advisable to use a Helm chart and the Kubernetes (Pod Identity) resource type. If you're manually setting up a Kubernetes resource in the cloud, you can also use the AWS-specific EKS and EKS (Instance Profile) resource types. See the following for more information:

* [Deploy Kubernetes via Helm chart](https://github.com/strongdm/charts/blob/main/deployments/sdm-relay/README.md)
* [Kubernetes (Pod Identity) resource guide](/admin/resources/clusters/kubernetes-podidentity.md)
* [EKS resource guide](/admin/resources/clusters/eks.md)
* [EKS (Instance Profile) resource guide](/admin/resources/clusters/eks-instance-profile.md)

#### Server Resources

Any of StrongDM's SSH resource types (listed on the [Servers](/admin/resources/servers.md) page) can be used to set up AWS server instances as resources in StrongDM.

#### Datasource Resources

Several of StrongDM's datasource resource types can be used to set up resources within AWS, but there are also several bespoke AWS resource types. See the guides for any of those resource types for more details:

* [Amazon Elasticsearch (IAM)](/admin/resources/datasources/amazon-es-iam.md)
* [Amazon Elasticsearch](/admin/resources/datasources/amazon-es.md)
* [Amazon Neptune](/admin/resources/datasources/amazon-neptune.md)
* [Amazon MQ AMQP](/admin/resources/datasources/amazon-mq-amqp.md)
* [Amazon MQ (AMQP 0.9.1)](/admin/resources/datasources/amazon-mq.md)

### User Management

StrongDM provides a generic SAML integration and the StrongDM SCIM API specification that can be used to integrate with the AWS Identity Center.

{% content-ref url="/pages/C1GtF1cjIprccZHL29Fw" %}
[SSO With SAML](/admin/principals/sso/saml.md)
{% endcontent-ref %}

{% content-ref url="/spaces/4XOJmXFslCMVCzIG2rKp/pages/taSBT9Zw8dcwKPTbA6gb" %}
[StrongDM SCIM API Specification](/references/scim.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.strongdm.com/admin/deployment/integrations/aws.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.