How to Connect Your AWS Account to InfraSync

1. In InfraSync, open Connect your account.
2. Choose Cross-account role as the connection method.
3. Note the two values shown: InfraSync's AWS account ID (529928147507) and the external ID generated for this account.

Download the template, or copy it from below.

1. Open the AWS CloudFormation console and choose Create stack, then With new resources (standard).
2. Choose Upload a template file and select infrasync-readonly-role.yaml.
3. For ExternalId, enter the external ID from step 1.
4. Select I acknowledge that AWS CloudFormation might create IAM resources with custom names, then create the stack.
5. When the stack reaches CREATE_COMPLETE, open the Outputs tab and copy the RoleArn value.

To do the same with the AWS CLI, save the template as infrasync-readonly-role.yaml and run:

aws cloudformation deploy \
  --template-file infrasync-readonly-role.yaml \
  --stack-name infrasync-readonly-role \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides ExternalId=EXTERNAL_ID

aws cloudformation describe-stacks \
  --stack-name infrasync-readonly-role \
  --query "Stacks[0].Outputs[?OutputKey=='RoleArn'].OutputValue" \
  --output text

The template itself:

AWSTemplateFormatVersion: "2010-09-09"
Description: "InfraSync read-only cross-account role."

Parameters:
  ExternalId:
    Type: String
    NoEcho: true
    Description: "The External ID InfraSync showed you for this account."
  RoleName:
    Type: String
    Default: "infrasync-readonly-role"

Resources:
  InfraSyncReadOnlyRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::529928147507:root"
            Action: "sts:AssumeRole"
            Condition:
              StringEquals:
                "sts:ExternalId": !Ref ExternalId
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/ReadOnlyAccess"

Outputs:
  RoleArn:
    Description: "Paste this Role ARN into InfraSync."
    Value: !GetAtt InfraSyncReadOnlyRole.Arn

1. Open the IAM console and choose Roles, then Create role.
2. For trusted entity type, choose Custom trust policy.
3. Paste the trust policy below, replacing EXTERNAL_ID with the value from step 1.
4. Attach the ReadOnlyAccess managed policy.
5. Name the role — for example infrasync-readonly-role — and create it.
6. Open the role and copy its Role ARN.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::529928147507:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "EXTERNAL_ID" }
      }
    }
  ]
}

# 1. Save the trust policy, using the external ID from step 1
cat > infrasync-trust.json <<'JSON'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::529928147507:root" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "EXTERNAL_ID" } }
  }]
}
JSON

# 2. Create the role and attach ReadOnlyAccess
aws iam create-role \
  --role-name infrasync-readonly-role \
  --assume-role-policy-document file://infrasync-trust.json

aws iam attach-role-policy \
  --role-name infrasync-readonly-role \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# 3. Print the Role ARN to paste into InfraSync
aws iam get-role --role-name infrasync-readonly-role \
  --query "Role.Arn" --output text

1. Open the IAM console and choose Users, then Create user.
2. Name the user — for example infrasync-readonly — and do not grant console access.
3. Choose Attach policies directly and select ReadOnlyAccess.
4. Create the user, then open it and choose Security credentials, Create access key.
5. For the use case, choose Third-party service.
6. Copy both the access key ID and the secret access key.

aws iam create-user --user-name infrasync-readonly

aws iam attach-user-policy \
  --user-name infrasync-readonly \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# Prints the access key ID and secret — paste both into InfraSync
aws iam create-access-key --user-name infrasync-readonly \
  --query "AccessKey.[AccessKeyId,SecretAccessKey]" --output table

AWS Compute Optimizer is opt-in per account and returns nothing until enrolled. Grant this to make the Enable Compute Optimizer button work; otherwise enable it yourself in the AWS console and skip this. Everything else works either way.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "compute-optimizer:UpdateEnrollmentStatus",
    "Resource": "*"
  }]
}

Only needed if you turn on the S3 remote-state backend with a bucket you own. InfraSync writes the generated terraform.tfstate there using the credentials you connected, so that role or user needs write access to that one bucket. ReadOnlyAccess already allows the reads; this adds the writes.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket"],
    "Resource": [
      "arn:aws:s3:::TFSTATE_BUCKET",
      "arn:aws:s3:::TFSTATE_BUCKET/*"
    ]
  }]
}

1. In InfraSync, open Connect your account.
2. Paste your role ARN (Method 1) or your access key ID and secret (Method 2).
3. Choose a default region.
4. Choose Save. InfraSync validates the credentials immediately.