---
title: Set up AWS IAM role
source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-role-setup
---

An IAM role allows New Relic to assume temporary credentials in your AWS account without requiring permanent access keys. This approach offers several advantages:

-   Credentials rotate automatically
-   Access is time-limited by design
-   All actions are logged in AWS CloudTrail
-   Aligns with AWS security best practices

## Prerequisites

Before creating an IAM role, ensure you have:

-   An AWS account with permission to create IAM roles
-   Your [New Relic account ID](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/account-id)
-   Admin access to the [AWS IAM Console](https://console.aws.amazon.com/iam/)

## Set up the IAM role

### Create the role in AWS [#create-role]

1.  Sign in to the [AWS IAM Console](https://console.aws.amazon.com/iam/)
2.  Navigate to **Roles** and click **Create role**
3.  Under **Trusted entity type**, select **AWS account**
4.  Select **Another AWS account**
5.  In the **Account ID** field, enter: `253490767857`
6.  Under **Options**, check **Require external ID**
7.  In the **External ID** field, enter your New Relic account ID and click **Next**.
    -   Don't have it? [Find your account ID here](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/account-id)
8.  On the **Add permissions** page, attach policies based on your workflows. For example:
    -   For EC2 workflows: Attach `AmazonEC2ReadOnlyAccess` or create a custom policy
    -   For SQS workflows: Attach `AmazonSQSFullAccess` or limit to specific queues
    -   For other services, see [AWS policy examples](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/policy-examples)
9.  Click **Next**.
10. Enter a role name: `NewRelicWorkflowAutomationRole` (or your preferred name)
11. Optionally add a description: **Allows New Relic workflow automation to perform actions in AWS**, and click **Create role**.

### Verify the trust policy [#trust-policy]

After creating the role, verify the trust relationship:

1.  In the IAM console, select your newly created role
2.  Click the **Trust relationships** tab
3.  Confirm the policy matches this structure (replace `<YOUR_NR_ACCOUNT_ID>` with your actual account ID):

```json
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "sts:AssumeRole",
              "Principal": {
                  "AWS": "arn:aws:iam::253490767857:root"  ← Must be this account
              },
              "Condition": {
                  "StringEquals": {
                      "sts:ExternalId": "<YOUR_NR_ACCOUNT_ID>"  ← Must match your NR account
                  }
              }
          }
      ]
  }
```

### What to verify

-   Principal AWS account is `253490767857` (New Relic's account)
-   External ID matches your New Relic account ID exactly
-   Action is `sts:AssumeRole`

    > #### ⚠️ CAUTION
    >
    > **Trust policy doesn't match?** If the account ID is different, delete the role and recreate it. The account ID must be `253490767857`.

### Copy your role ARN [#role-arn]

You'll need the role ARN to configure workflows.

> #### ⚠️ IMPORTANT
>
> Role ARNs are resource identifiers, not sensitive credentials. Don't store them in [secrets manager](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-best-practices#secure-credentials)—paste them directly into workflow configurations.

**To get your role ARN:**

1.  In the IAM console, select your role
2.  In the **Summary** section, locate the **ARN** field
3.  Copy the full ARN—it looks like: `arn:aws:iam::123456789012:role/NewRelicWorkflowAutomationRole`

    The role is now ready. Use the ARN in your workflows.

## Related topics [#related-topics]

[AWS credentials overview](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials)

Compare IAM role with other authentication methods

[AWS policy examples](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/policy-examples)

Find the right IAM permissions for your workflows

[IAM user setup](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-user-setup)

Alternative: Use IAM user for testing environments

[EC2 management example](https://docs.newrelic.com/docs/workflow-automation/workflow-examples/advanced/ec2-management)

See IAM roles in action with EC2 workflows