> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wewatchai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Connect a read-only IAM role so WeWatch can build your topology graph.

AWS is the data source WeWatch builds its topology from. Connect it first —
every other integration depends on it.

## How access works

WeWatch creates a role in **your** account and assumes it. That means:

* **Role-based access.** No long-term credentials or access keys are stored.
* **Read-only.** The policy grants describe and list actions, not writes.
* **Revocable.** Delete the role and access ends immediately.

## Connect an account

<Steps>
  <Step title="Start the flow">
    **Integrations → AWS → Add Connection**.
  </Step>

  <Step title="Choose what to connect">
    Select the capabilities you want WeWatch to read and the deployment option
    for your environment.
  </Step>

  <Step title="Create the role">
    WeWatch generates a trust policy and a permissions policy scoped to what you
    selected. Apply them in your AWS account to create the role.
  </Step>

  <Step title="Confirm">
    Paste the role ARN back into WeWatch. The connection is verified and the
    first topology sync begins.
  </Step>
</Steps>

The first sync usually completes in under five minutes.

## Connecting more accounts

Each AWS account is a separate connection. Repeat the flow for each one, then
use **Spaces** to scope a conversation or investigation to a subset of them.

## Revoking access

Remove the connection from **Integrations → AWS**, or delete the role in AWS.
Either ends access immediately.

<Warning>
  Removing a connection also removes the topology built from it. Past
  investigations keep their written findings but can no longer be re-run
  against live data.
</Warning>