> ## Documentation Index
> Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Amazon Web Services (AWS IAM)
> Steps to integrate Amazon Web Services (AWS) with MoneyForward Admina, from logging in as an administrator to completing the integration.
## Supported Features
Account Deletion Account Provisioning
## Prerequisites
### How to Log In to Amazon Web Services
Go to the [AWS login page](https://console.aws.amazon.com) and sign in as a root user or IAM user.
### How to Create an Integration Policy
1. Go to [Identity and Access Management (IAM)](https://console.aws.amazon.com/iam), click **Policies** in the left menu, then click **Create policy**.
2. On the Create policy screen, click the `JSON` tab and overwrite it with the following script.
To retrieve the LastActivity of roles, add `"iam:GetRole",` below `"iam:ListRoles",` in the policy script.
```json theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:GetAccessKeyLastUsed",
"iam:ListAccessKeys",
"iam:ListAttachedUserPolicies",
"iam:ListGroupsForUser",
"iam:ListMFADevices",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:GetRole",
"iam:ListUsers",
"iam:ListUserTags",
"iam:DeleteUser",
"iam:DeleteAccessKey",
"iam:DeleteRole",
"iam:ListAttachedRolePolicies",
"iam:DetachRolePolicy",
"iam:DeleteLoginProfile",
"iam:ListAttachedUserPolicies",
"iam:DetachUserPolicy",
"iam:CreateUser",
"iam:TagUser",
"iam:ListUserPolicies",
"account:GetContactInformation"
],
"Resource": "*"
}
]
}
```
If you do not need account deletion or provisioning from Admina (Read Only), use the following script instead.
To retrieve the LastActivity of roles, add `"iam:GetRole",` below `"iam:ListRoles",` in the policy script.
```json theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:GetAccessKeyLastUsed",
"iam:ListAccessKeys",
"iam:ListAttachedUserPolicies",
"iam:ListGroupsForUser",
"iam:ListMFADevices",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:GetRole",
"iam:ListUsers",
"iam:ListUserTags",
"iam:ListAttachedRolePolicies",
"iam:ListAttachedUserPolicies",
"iam:TagUser",
"iam:ListUserPolicies",
"account:GetContactInformation"
],
"Resource": "*"
}
]
}
```
3. After entering the details, click **Next**.
4. On the next screen, enter any name in the **Policy name** field and click **Create policy**. The policy is now created.
### How to Create an Integration Role
1. Go to [Identity and Access Management (IAM)](https://console.aws.amazon.com/iam), click **Roles** in the left menu, then click **Create role**.
Note: Role LastActivity cannot be retrieved.
2. Under Select trusted entity, enter the following values:
* Trusted entity type: Select **AWS account**
* AWS account: Select **Another AWS account** and enter `162001151631` as the Account ID
* Check **Require external ID (Best practice when a third party will assume this role)**
* For the External ID, enter a random alphanumeric string (at least 24 characters, no symbols recommended)
* Uncheck **Require MFA**
Click **Next** when done.
3. The Add permissions screen will appear. Select the policy created in the previous step, scroll down, then click **Next**.
4. Enter a name for the role (any name), scroll down, then click **Create role**. The role is now created.
### How to Find the Role ARN
Search for the role you created on the Roles screen and click it.
The **Role ARN** will be displayed. Copy and save it.
## Integration Setup
1. In the MoneyForward Admina integration screen, search for **AWS IAM**.
2. Enter the **Role ARN** obtained in the previous step and the **External ID** set when creating the role.
3. Select the permissions.
If you do not want to retrieve roles during integration, select **Read And Write (excluding roles)**.
4. Review the entered details and click **Connect**.
5. Once the integration with AWS is successful, the registered user information will appear in the account list.
If the integration does not complete successfully, go to the Status tab on the integration screen, click **Edit**, and try connecting again.
If the issue persists, please contact us via chat.
For an overview of the AWS integration, visit the [integration page](http://admina.moneyforward.com/en/integrations/amazon-web-service-aws).
### Supplement: Retrieving Email Addresses
AWS does not retrieve email addresses by default, so the user type will be shown as "Unknown" or "System."
To retrieve email addresses, use one of the following methods:
1. Use the [Account Merge feature](/en/it-management/saas-management/d97dy5z2l7-merge)
This allows user types to be assigned, enabling more accurate management of offboarded employees.
2. Assign email addresses directly to IAM users using tags.
By setting the tag key to `email` and the tag value to the email address, MoneyForward Admina will retrieve the email address.
