Set up AWS IAM user

Create the IAM user

1. Sign in to the AWS IAM Console
2. Navigate to Users > Create user and enter a username: workflow-automation-user (or your preferred name)
3. Click Next
4. On the Set permissions page, choose Attach policies directly
5. Search for and select policies based on your workflows:
   • For SQS: Select AmazonSQSFullAccess
   • For EC2: Select AmazonEC2ReadOnlyAccess
   • Or create a custom policy with limited permissions (recommended)
6. Click Next, then Create user

Generate access keys

1. In the users list, select your newly created user

2. Click the Security credentials tab

3. In the Access keys section, choose Create access key

4. Select Application running outside AWS and click Next

5. (Optional) Add a description tag: New Relic workflow automation

6. Choose Create access key

7. Copy both credentials immediately:

   • Access key ID (starts with AKIA...)
   • Secret access key (shown only once)

   Important

   AWS displays the secret access key only once during creation. If you don't save it, you'll need to generate a new key pair.

Store credentials securely

Never hardcode AWS credentials in workflows. Store them in New Relic's secrets manager instead.

1. Open the NerdGraph GraphiQL explorer
2. Run this mutation to store your Access Key ID (replace the placeholder values):

mutation {
    secretsManagementCreateSecret(
      scope: {type: ACCOUNT id: "YOUR_NR_ACCOUNT_ID"}
      namespace: "aws"
      key: "awsAccessKeyId"
      description: "AWS Access Key ID for workflow automation"
      value: "YOUR_AWS_ACCESS_KEY_ID"
    ) {
      key
    }
  }

3. Run another mutation for your Secret Access Key:

mutation {
    secretsManagementCreateSecret(
      scope: {type: ACCOUNT id: "YOUR_NR_ACCOUNT_ID"}
      namespace: "aws"
      key: "awsSecretAccessKey"
      description: "AWS Secret Access Key for workflow automation"
      value: "YOUR_AWS_SECRET_ACCESS_KEY"
    ) {
      key
    }
  }

Reference these secrets in workflows using the syntax: ${{ :secrets:awsAccessKeyId }}