> ## Documentation Index
> Fetch the complete documentation index at: https://xerg.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Xerg can only list and describe resources (functions, databases, buckets, queues, APIs, certificates, DNS zones, secret names) and read 30-day cost totals.

Read-only. Xerg can only list and describe resources (functions, databases, buckets, queues, APIs, certificates, DNS zones, secret names) and read 30-day cost totals. It can't read stored data or secret values, or change anything. Listing Lambda functions also returns their environment variables: Xerg drops them without storing them.

Only admins and owners can connect services. See [Connecting a service](https://xerg.ai/docs/connect/overview.md) for where to find Connect, refreshing and disconnecting.

## Permissions

The read-only user and the read-only role both get exactly these actions, and nothing else ([the policy](https://overwatch.xerg.ai/aws/xerg-readonly-policy.json)):

* `ec2:DescribeRegions`
* `ec2:DescribeInstances`
* `lambda:ListFunctions`
* `rds:DescribeDBInstances`
* `dynamodb:ListTables`
* `ecs:ListClusters`
* `ecs:DescribeClusters`
* `sqs:ListQueues`
* `acm:ListCertificates`
* `ecr:DescribeRepositories`
* `secretsmanager:ListSecrets`
* `s3:ListAllMyBuckets`
* `cloudfront:ListDistributions`
* `route53:ListHostedZones`
* `ce:GetCostAndUsage`
* `apigateway:GET` on `arn:aws:apigateway:*::/apis` and `arn:aws:apigateway:*::/restapis`

## Connect

**Read-only role (recommended)**

1. Open AWS CloudShell in the account you want mapped (the >\_ icon at the top of the AWS console).
2. Paste the command Xerg shows you. It creates a role named XergReadOnly that only Xerg can use, and prints its ARN.
3. Paste the ARN into Xerg. To revoke later, delete the xerg-readonly stack.

Xerg asks for: Role ARN.

**Access key for a read-only user**

1. [Open IAM policies in the AWS console](https://console.aws.amazon.com/iam/home#/policies/create)
2. [Create a policy from the JSON in Xerg's read-only policy](https://overwatch.xerg.ai/aws/xerg-readonly-policy.json)
3. Create an IAM user (no console access) named xerg-readonly and attach only that policy.
4. In the user's Security credentials tab, create an access key (third-party service). Paste both parts into Xerg.

Xerg asks for: Access key ID; Secret access key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.