Set up AWS IAM role

Create the role in AWS

1. Sign in to the AWS IAM Console
2. Navigate to Roles and click Create role
3. Under Trusted entity type, select AWS account
4. Select Another AWS account
5. In the Account ID field, enter: 253490767857
6. Under Options, check Require external ID
7. In the External ID field, enter your New Relic account ID and click Next.
   • Don't have it? Find your account ID here
8. On the Add permissions page, attach policies based on your workflows. For example:
   • For EC2 workflows: Attach AmazonEC2ReadOnlyAccess or create a custom policy
   • For SQS workflows: Attach AmazonSQSFullAccess or limit to specific queues
   • For other services, see AWS policy examples
9. Click Next.
10. Enter a role name: NewRelicWorkflowAutomationRole (or your preferred name)
11. Optionally add a description: Allows New Relic workflow automation to perform actions in AWS, and click Create role.

Verify the trust policy

After creating the role, verify the trust relationship:

1. In the IAM console, select your newly created role
2. Click the Trust relationships tab
3. Confirm the policy matches this structure (replace <YOUR_NR_ACCOUNT_ID> with your actual account ID):

{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "sts:AssumeRole",
              "Principal": {
                  "AWS": "arn:aws:iam::253490767857:root"  ← Must be this account
              },
              "Condition": {
                  "StringEquals": {
                      "sts:ExternalId": "<YOUR_NR_ACCOUNT_ID>"  ← Must match your NR account
                  }
              }
          }
      ]
  }

What to verify

• Principal AWS account is 253490767857 (New Relic's account)

• External ID matches your New Relic account ID exactly

• Action is sts:AssumeRole

  Prudence

  Trust policy doesn't match? If the account ID is different, delete the role and recreate it. The account ID must be 253490767857.

Copy your role ARN

You'll need the role ARN to configure workflows.

To get your role ARN:

1. In the IAM console, select your role

2. In the Summary section, locate the ARN field

3. Copy the full ARN—it looks like: arn:aws:iam::123456789012:role/NewRelicWorkflowAutomationRole

   The role is now ready. Use the ARN in your workflows.