> For the complete documentation index, see [llms.txt](https://docs.untab.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.untab.io/setup/setting-up-access-on-aws.md).

# Setting up access on AWS

1. In the AWS console, navigate to the [IAM roles page](https://console.aws.amazon.com/iam/home?#/roles).
2. Start creating a new role
   * Click "Create role"
   * Select "Another AWS account" as the type of trusted entity
   * Use **949355348315** as the Account ID (this is Untab's AWS account ID)
   * Select "Require external ID" and enter the external ID provided on the Infrastructure Providers settings page in the Untab UI
   * Make sure that the "Require MFA" option is **not** selected
3. At the permissions screen, click "Create Policy"
   * This will open a new window. Choose "JSON" and paste the following policy document:

     ```javascript
     {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Action": [
             "ce:GetCostAndUsage",
             "ce:GetTags",
             "ce:GetDimensionValues",
             "ce:GetReservationUtilization",
             "ec2:Describe*",
             "elasticloadbalancing:Describe*",
             "cloudwatch:ListMetrics",
             "cloudwatch:GetMetricStatistics",
             "cloudwatch:Describe*",
             "autoscaling:Describe*"
           ],
           "Resource": "*"
         }
       ]
     }
     ```
   * Click "Review Policy"
   * Enter a name for the policy, e.g. "untab-agent"
   * Click "Create Policy"
4. Finish creating the role
   * Close the policy creation window and go back to the role creation window
   * Click the <img src="https://946920320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LiFLRmUCSDNaFG76OOD%2F-LiyoOMmalIj5hqwIPaF%2F-Liyop1ESlh7kg-xJnY2%2FScreen%20Shot%202019-07-04%20at%202.10.28%20PM.png?alt=media&amp;token=3dc4b84e-91e8-4712-9fbb-1a3c411ad4e2" alt="" data-size="line"> button in the top right corner to refresh the list of policies
   * Search for and select the policy you created in step 4
   * Click "Next: Tags"
   * Add any tags you might want to identify this policy
   * Click "Next: Review"
   * Enter a name for this role, e.g. "untab-agent"
   * Click "Create Role"
5. Enter the role ARN into the Settings&#x20;
   * Find the role you just created in the IAM UI and click on it to see the "Summary" page for this role
   * Copy role ARN, which is shown at the top of the page
   * Navigate to the [Infrastructure Providers settings page](https://app.untab.io/settings/providers).
   * In the AWS provider, turn on the "Use real billing information" option
   * Paste the role ARN into the designated field and click "Save".

{% hint style="info" %}
Ensure you are using the **role** ARN, not the **policy** ARN.
{% endhint %}