Set up AWS credentials

Use this method for testing environments or when IAM roles aren't supported. Access keys are long-lived credentials that require manual rotation.

Use cases:

• Testing and development environments

• AWS configurations that don't support cross-account role assumption

• Simplified authentication workflows

  Caution

  Access keys are long-lived credentials. Rotate them regularly (every 90 days) and limit permissions to only what your workflows need.

  Create the IAM user

1. Sign in to the AWS IAM Console

2. Navigate to Users > Create user and enter a username: workflow-automation-user (or your preferred name)

3. Click Next

4. On the Set permissions page, choose Attach policies directly

5. Search for and select policies based on your workflows:

   • For SQS: Select AmazonSQSFullAccess
   • For EC2: Select AmazonEC2ReadOnlyAccess
   • Or create a custom policy with limited permissions (recommended)

6. Click Next, then Create user

   Generate access keys

   1. In the users list, select your newly created user

   2. Click the Security credentials tab

   3. In the Access keys section, choose Create access key

   4. Select Application running outside AWS and click Next

   5. (Optional) Add a description tag: "New Relic workflow automation"

   6. Choose Create access key

   7. Copy both credentials immediately:

      • Access key ID (starts with AKIA...)
      • Secret access key (shown only once)

      Important

      AWS displays the secret access key only once during creation. If you don't save it, you'll need to generate a new key pair.

   Store credentials securely

   Never hardcode AWS credentials in workflows. Store them in New Relic's secrets manager instead.

   1. Open the NerdGraph GraphiQL explorer

   2. Run this mutation to store your Access Key ID (replace the placeholder values):

      mutation {
        secretsManagementCreateSecret(
          scope: { type: ACCOUNT, id: "YOUR_NR_ACCOUNT_ID" }
          namespace: "aws"
          key: "awsAccessKeyId"
          description: "AWS Access Key ID for workflow automation"
          value: "YOUR_AWS_ACCESS_KEY_ID"
        ) {
          key
        }
      }

      Copy

   3. Run another mutation for your Secret Access Key:

      mutation {
        secretsManagementCreateSecret(
          scope: { type: ACCOUNT, id: "YOUR_NR_ACCOUNT_ID" }
          namespace: "aws"
          key: "awsSecretAccessKey"
          description: "AWS Secret Access Key for workflow automation"
          value: "YOUR_AWS_SECRET_ACCESS_KEY"
        ) {
          key
        }
      }

      Copy

      Reference these secrets in workflows using the syntax: ${{ :secrets:awsAccessKeyId }}

      Tip

      Use the namespace field to organize secrets by environment (aws-prod, aws-staging) or team name.

Session tokens provide temporary credentials with automatic expiration.

Use cases:

• Local development and testing

• CI/CD pipelines requiring credential rotation

• Environments with compliance requirements for time-limited access (typically 1-12 hours)

  Prerequisites

• AWS CLI installed and configured

• An existing IAM role you can assume

  Generate temporary credentials

1. Open your terminal and run this command (replace with your role ARN):

   bash

   Copy

   $
   aws sts assume-role \
   >
     --role-arn "arn:aws:iam::YOUR_ACCOUNT:role/YOUR_ROLE" \
   >
     --role-session-name "WorkflowAutomationSession"

   If this is your first time using AWS CLI, you may need to configure it with aws configure and enter your access credentials:

   

2. AWS returns three values—you need all three:

   {
     "Credentials": {
       "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
       "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
       "SessionToken": "FQoGZXIvYXdzEBk...",
       "Expiration": "2025-01-25T12:00:00Z"
     }
   }

   Copy

3. Store all three credentials in secrets manager:

• AccessKeyId store as awsAccessKeyId

• SecretAccessKey store as awsSecretAccessKey

• SessionToken store as awsSessionToken

  Caution

  Session tokens expire (typically after 1 hour). Set a reminder to refresh them before the Expiration timestamp, or your workflows will fail with authentication errors.