The Deployer documentation
Connecting your accounts

Connect AWS

Amazon Web Services (AWS) is one of the largest cloud providers — a place to rent servers and other computing resources on demand. To let The Deployer build things inside your AWS account, you'll create a dedicated access key (a machine username-and-password pair) and paste three values into The Deployer.

Current credential model. The Deployer connects to AWS with a long-lived IAM user access key, and deploys currently need broad permissions. Create the key in a dedicated AWS account used only for The Deployer's resources, so it can't reach unrelated production systems, and make it a key used by nothing else. Role-based access through STS is planned. See Permissions & security.

What you'll collect

By the end you'll have three things to paste in:

  • Access Key ID — the public half of the key (looks like AKIA…).
  • Secret Access Key — the private half (a long random string). Shown only once.
  • Default Region — which part of the world your servers run in (for example us-east-1).

You create the first two by making an IAM user. IAM ("Identity and Access Management") is simply AWS's system for creating logins and deciding what each one is allowed to do. A key belonging to an IAM user is what apps like The Deployer use instead of your personal AWS password.

Step 1 — Create an IAM user

Do this signed in to your AWS account in a separate tab:

  1. Go to aws.amazon.com, sign in, and in the top search bar type IAM and open the IAM service.
  2. In the left menu choose Users, then click Create user.
  3. Give it a name you'll recognize, such as deployer, and continue.

Step 2 — Give it permission to work

The Deployer's agents create, adjust, and clean up several kinds of AWS resources (servers, networking, storage, DNS). We don't yet publish a least-privilege policy for each architecture, so today deploys finish reliably only with broad access. In the dedicated account from the note above:

  1. On the permissions step, choose Attach policies directly.
  2. Search for and tick AdministratorAccess.
  3. Finish creating the user.

Why broad access? A deploy that stops on a missing permission leaves half-built infrastructure. Broad access in an account that holds nothing else lets the deploy finish while limiting what the key can reach. You can scope the policy down, but a policy missing a permission a deploy needs will make that deploy fail. See Permissions & security.

Step 3 — Create the access key

  1. Open the user you just created and go to the Security credentials tab.
  2. Under Access keys, click Create access key.
  3. When asked about the use case, choose Third-party service (or "Other"), acknowledge the note, and continue.
  4. AWS now shows the Access Key ID and the Secret Access Key. Copy both now — the secret is shown only once. If you navigate away without copying it, delete the key and create a fresh one.

Step 4 — Pick a region

A region is the physical location of the data center your app runs in. Choose one close to where most of your users are — that makes your app feel faster. If you're unsure, us-east-1 (Northern Virginia) is a safe, widely supported default. You enter the region as its short code, e.g. us-east-1, eu-west-1, or ap-south-1. The Resources links below include AWS's full list of region codes.

Step 5 — Paste it all into The Deployer

  1. In The Deployer, open Connections from the left sidebar.
  2. Under Cloud providers, click Add provider and choose Amazon Web Services.
  3. In Label, type a name for yourself, e.g. My personal AWS.
  4. Fill in the three fields:
    • Access Key ID — paste the AKIA… value.
    • Secret Access Key — paste the long secret.
    • Default Region (e.g. us-east-1) — type your chosen region code.
  5. Click Connect & verify.

The Deployer signs in to AWS with the key to confirm it works. A verified badge means you're set. An error usually means a mistyped key, a secret that was only partially copied, or a region typo — double-check and try again.

Safety notes

  • The Secret Access Key is as powerful as a password. Don't email it, paste it into chats, or store it in plain text elsewhere.
  • The Deployer encrypts your key before storing it. It's used by the deployment engine and isn't placed in AI prompts.
  • Access keys don't expire on their own. Rotate the key on a schedule with Replace credentials.
  • If a key is ever exposed, go to the IAM user's Security credentials in AWS, deactivate/delete the old key, create a new one, and use Replace credentials in The Deployer to swap it in — see Viewing & replacing your credentials.

The Resources links and video below walk through creating an IAM access key on AWS. Once AWS shows verified, you can create a project.