---
sidebar_label: AWS
toc_max_heading_level: 3
doc_id: f3a8e2c1-7b9d-4e5f-8a6b-0c1d2e3f4a5b
description: >-
  Prerequisites and IAM permissions for running the Static files scope on AWS
  with CloudFront, Route 53, and S3.
keywords:
  - static files
  - AWS
  - CloudFront
  - IAM policy
  - Route 53
  - S3
---

# AWS setup

## Prerequisites

| Requirement | Description |
|---|---|
| Cloud provider | An AWS cloud-provider with `hosted_public_zone_id` set |
| Assets repository | An S3-based assets-repository provider at the correct NRN level |
| Agent environment variables | `AWS_REGION`, `TOFU_PROVIDER_BUCKET` |
| ACM certificate (optional) | Wildcard certificate (`*.example.com`) in `us-east-1` for HTTPS on custom domains |

## IAM policy

The agent's IAM role or user needs the following permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TofuStateBackend",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_STATE_BUCKET",
        "arn:aws:s3:::YOUR_STATE_BUCKET/*"
      ]
    },
    {
      "Sid": "Route53Network",
      "Effect": "Allow",
      "Action": [
        "route53:GetHostedZone",
        "route53:ChangeResourceRecordSets",
        "route53:ListResourceRecordSets"
      ],
      "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
    },
    {
      "Sid": "Route53ListZones",
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZones",
        "route53:ListHostedZonesByName"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Route53ChangePolling",
      "Effect": "Allow",
      "Action": [
        "route53:GetChange"
      ],
      "Resource": "arn:aws:route53:::change/*"
    },
    {
      "Sid": "CloudFrontDistribution",
      "Effect": "Allow",
      "Action": [
        "cloudfront:CreateDistribution",
        "cloudfront:UpdateDistribution",
        "cloudfront:DeleteDistribution",
        "cloudfront:GetDistribution",
        "cloudfront:TagResource",
        "cloudfront:UntagResource",
        "cloudfront:ListTagsForResource",
        "cloudfront:CreateInvalidation",
        "cloudfront:CreateOriginAccessControl",
        "cloudfront:GetOriginAccessControl",
        "cloudfront:UpdateOriginAccessControl",
        "cloudfront:DeleteOriginAccessControl"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3BucketAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy",
        "s3:DeleteBucketPolicy",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::YOUR_ASSETS_BUCKET"
    },
    {
      "Sid": "ACMCertificateLookup",
      "Effect": "Allow",
      "Action": [
        "acm:ListCertificates",
        "acm:DescribeCertificate",
        "acm:GetCertificate"
      ],
      "Resource": "*"
    },
    {
      "Sid": "STSIdentity",
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    }
  ]
}
```

Replace `YOUR_STATE_BUCKET`, `YOUR_REGION`, `YOUR_ACCOUNT_ID`, `YOUR_HOSTED_ZONE_ID`, and `YOUR_ASSETS_BUCKET` with the values from your environment.

## Next steps

- [WAF protection](/docs/agent-backed-scopes/static-files/waf): optional, attach an existing AWS WAFv2 WebACL to the CloudFront distribution
- [Set up the Static files scope](/docs/agent-backed-scopes/static-files/setup): back to the setup overview
- [Static files scope](/docs/agent-backed-scopes/static-files): overview of the scope type and how it works