# Connecting an AWS account

> Creating the read-only role, verifying the connection, and scoping the first sync.

Connecting an AWS account takes four steps: create the connection, create a read-only role in AWS, verify it, then scope a diagram.

You need a Teams licence and `cloud_connections.manage` on the owning organisation or team. Below Teams the action refuses with "Continuum is a Teams-plan feature."

> [!IMPORTANT]
> Set the connection scope correctly at the start. `Single account` and `AWS Organization` stay changeable only while the connection is a draft, by going Back in the wizard. Once a role has been recorded the choice is fixed: "This connection already has a role, so its scope can't be changed. Create a new connection instead."

> [!STEPS]
>
> === Create the connection
>
> Open `Settings → Continuum` on the organisation or team, select the AWS card, then choose `New connection`. Enter the 12-digit `AWS account number`, choose `Single account` or `AWS Organization`, pick the region to discover, and give it a display name.
>
> Single account creates one read-only role in one account. AWS Organization creates a management role that enumerates the organisation plus a StackSet member role in every account, including accounts created later.
>
> === Create the role in AWS
>
> The connection page shows the stack name, the role name and the external ID. Choose `Launch with CloudFormation` to open the AWS console with those values filled in. To deploy it yourself instead, open `Or do it manually - AWS console or CLI` for the same template and parameters.
>
> An AWS Organization connection uses the org StackSet template, launched from the management or delegated-admin account. It needs trusted access between AWS Organizations and CloudFormation StackSets, enabled once per organisation.
>
> === Verify
>
> Blueprintr watches the account and picks the role up on its own once the stack finishes. To finish immediately, paste the role ARN into `Or paste the role ARN` and choose `Verify`. The header changes to `Verified` and the page reports that the role assumed and responded.
>
> === Scope a diagram
>
> In the blueprint, open the `+` menu in the tab bar and choose `Continuum`. Select the connection, name the tab, confirm the account and regions, then choose `Create`. Narrow it first with `Refine VPCs / subnets` or a tag filter.

Regions are fixed when you create the connection: one region in single-account mode, a set of regions in AWS Organization mode. There is no region control on the connection afterwards, so covering a new region means a new connection.

## What the role can do

The template grants list and describe actions. Nothing in it changes infrastructure, and Continuum never writes to your cloud account. The external ID stops another Blueprintr tenant assuming your role, so do not omit it. On the current template it is filled in for you.

Reading Terraform state is not included. Adding a state backend to this connection also needs `s3:GetObject` on the state object added to the role policy.

## If a sync will not start

An `AWS Organization` connection needs the org StackSet role. Pointing one at a single-account role fails to load the account list, because the single-account template grants no `organizations:` permissions. Create a `Single account` connection instead, or deploy the StackSet.

A finished sync reports what it could not read, under `Adapter errors`. Read that list before concluding a resource was decommissioned.

Reaching the connection cap refuses with "Connection cap reached (3 per org)", or "(3 per team)". Blueprintr first reclaims your own drafts that have sat untouched for a day with no credential and nothing referencing them; drafts from the last 24 hours, and anyone else's, are left alone.

## Next

[Scopes and syncing](/foliums/continuum-integrations/continuum-cloud/scopes-and-syncing) covers what a diagram covers and how to keep it current.