> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Discover Bedrock Agents and Bedrock AgentCore resources in your AWS accounts

Connect each AWS account with one CloudFormation stack. The stack creates a read-only IAM role that only Runlayer can assume, and Runlayer discovers agents in every Region enabled in the account.

## What Runlayer reads

The role created by the stack (named `RunlayerDiscovery-…`) can:

* list and read Bedrock Agents;
* list and read Bedrock AgentCore Runtimes, Harnesses, and Gateways with their targets;
* read `SKILL.md` files from S3 buckets in the same account, for skills that Harnesses load from S3, so they can be scanned for risk;
* list the account's enabled Regions and read its account name.

It has no write permissions. It trusts only Runlayer's service role, and only with an external ID unique to your connection.

## Connect an account

**1. Start in Runlayer**

In **AI Inventory**, click **Sources**. Under **AWS**, click **Connect account** and enter the 12-digit AWS account ID.

**2. Create the stack**

Click **Open AWS console**. Sign in to that account with permission to create IAM roles through CloudFormation. AWS opens a prefilled Quick Create page: check the box acknowledging that the stack creates IAM resources, then click **Create stack**.

The link expires. If it does, click **Connect** again in Runlayer for a new one.

**3. Wait for the first sync**

Runlayer shows **Waiting for the CloudFormation stack** until the role is ready, then starts the first sync on its own.

The stack must be created in the account you entered. A stack created in a different account fails, and Runlayer refuses a role from the wrong account.

## Common errors

| What you see | What it means |
| - | - |
| **Not authorized** | Runlayer can't assume the discovery role. Usually the stack was deleted. Click **Reconnect** to create it again |
| A service shows a denied read | A service control policy or permission boundary blocks the role. Allow the read actions listed above for `RunlayerDiscovery-*` roles |
| **Not available in this account's Regions.** | That AWS service isn't offered in any Region enabled in the account |

## Remove the discovery role

Disconnecting in Runlayer deletes the stored role details and stops the sync, but the role stays in your account. To remove it, delete the CloudFormation stack named after the role (`RunlayerDiscovery-…`) in the AWS console.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.