Amazon Web Services
How to issue scoped AWS IAM credentials and connect them to Nora.The AWS integration is the broad-spectrum equivalent of S3 — same shape, but the credentials cover whichever services your agent’s IAM policy permits (EC2, Lambda, SES, DynamoDB, etc.).
Where to apply for credentials
AWS IAM — Users
1
Create a programmatic-access user
IAM → Users → Create user. Name it (e.g.
nora-agent-prod). Skip console access — it’s a service identity.2
Attach least-privilege policies
Don’t reach for
AdministratorAccess. Compose a custom policy that lists exactly the actions your
agent needs (e.g. ec2:DescribeInstances, lambda:InvokeFunction, ses:SendEmail).3
Generate an access key
Open the user → Security credentials → Create access key → Application running outside AWS. Copy the Access Key ID + Secret Access Key (only shown once).
Connect in Nora
1
Paste the keys
Access Key ID + Secret Access Key.
2
Set the default region
Required for most AWS SDK calls. The agent runtime exposes this as
AWS_DEFAULT_REGION.3
Connect
Click Connect. Nora validates the access key format (must start with
AKIA followed by 16 alphanumeric chars) and stores the credentials encrypted. It does not sign a test request — that happens in the agent runtime via the AWS SDK.