> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure an IAM role

This tutorial walks you through creating an AWS IAM role and chaining it to Anaconda Platform so your flows and workstations can access AWS services with the permissions you define.

> [!NOTE]
>
> Creating a resource integration requires an administrator role. If you do not have administrator access, ask your administrator to create the integration before you begin.

By the end of this tutorial, you will have:

* An IAM role with the permissions your workloads need
* The role registered as a platform integration
* Verified access to AWS services from a workstation or flow

## Create an IAM role

1. In the AWS IAM console, create a new role.

2. In Anaconda Platform, select  **Integrations** in the left-hand navigation, then click **AWS** in the **Add an Integration** section.

3. Copy the trust policy statement shown in the integration panel and add it to your role's trust policy in AWS.

4. Tag your role in AWS with the key and value shown in the integration panel:

   * Key: `outerbounds.com/accessible-by-deployment`
   * Value: the value shown in the panel

5. Attach the AWS managed policies or custom policies your workloads need (Example: `AmazonS3ReadOnlyAccess`, `AWSAthenaFullAccess`).

6. Copy the role's ARN. You need it for the next step.

7. In the integration panel, enter a name, a description, and the role ARN, then click **Add**.

After the integration is created, the **How to use** tab shows a code snippet with the exact `role_arn` value for your flows.

## Test S3 access

To use your role with S3, pass the role ARN when creating the S3 client:

```python theme={null}
from metaflow import S3

s3 = S3(role='arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>')

data = s3.get('s3://<BUCKET_NAME>/<FILE_NAME>')
```

Comments

Replace \<ACCOUNT\_ID> with your AWS account ID, \<ROLE\_NAME> with the name of your IAM role, \<BUCKET\_NAME> with your S3 bucket name, and \<FILE\_NAME> with the path to your file.

## Test other AWS services

For other AWS services, use `get_aws_client` with your role ARN:

```python theme={null}
from metaflow import get_aws_client

# Example with EMR
emr_client = get_aws_client('emr', role_arn='arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>')

# Example with Athena
athena_client = get_aws_client('athena', role_arn='arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>')
```

Comments

Replace \<ACCOUNT\_ID> with your AWS account ID and \<ROLE\_NAME> with the name of your IAM role.

This pattern works in workstation notebooks and in Metaflow tasks.

## Next steps

To build on this tutorial:

* Add additional AWS service permissions to the role as needed.
* Use the role in your Metaflow flows to access AWS services.
* For security guidance, see [AWS IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html).