> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enkryptify.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Amplify

<AccordionGroup>
  <Accordion title="Prerequisites" icon="list-check">
    * An Enkryptify workspace with admin access
    * An AWS account with permissions to create IAM roles and policies
    * An AWS Amplify app
  </Accordion>

  <Accordion title="Permissions" icon="scroll-text">
    Enkryptify connects to your AWS account by assuming an IAM Role that you create. We use temporary credentials from `sts:AssumeRole` to manage secrets in AWS Secrets Manager.

    * Trust relationship:
      * Trusted entity: AWS Account `676206939822` (Enkryptify)
      * External ID: not required (will be added in a future update)
    * Required permissions on the assumed role (inline policy example below):
      * `amplify:UpdateApp`
      * `amplify:UpdateBranch`
      * `amplify:GetApp`
      * `amplify:GetBranch`
      * `amplify:ListApps`
      * `amplify:ListBranches`

    > You may scope the `Resource` to specific secret ARNs. The example uses `*` for simplicity.
  </Accordion>
</AccordionGroup>

## Steps to complete

<Steps>
  <Step title="Create a new sync">
    * Go to the `Syncs` tab of your project and click on `AWS Amplify`.
  </Step>

  <Step title="Start IAM role creation (trust setup)">
    * In AWS IAM → `Roles` → `Create role`.
    * Trusted entity type: `AWS Account` → `Another AWS Account`.
    * Enter Account ID `676206939822`.
    * External ID: not required (will be added in a future update).

          <img src="https://mintcdn.com/enkryptify-39ddac35/Pp9xbv0du_vx2mUv/images/sync/aws/aws-create-iam-role.png?fit=max&auto=format&n=Pp9xbv0du_vx2mUv&q=85&s=31a85aa21677e9a1a8b3a3ef3b9c0333" alt="Start IAM role creation (trust setup)" width="2846" height="1682" data-path="images/sync/aws/aws-create-iam-role.png" />
  </Step>

  <Step title="Finish role creation">
    * Skip the 'Add permissions' step.
    * Provide a role name and finish creation.
  </Step>

  <Step title="Attach Amplify permissions">
    * On the role page, go to `Permissions` → `Add permissions` → `Create inline policy` → `JSON`, then paste:

    ```json theme={"dark"}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowAmplifyAccess",
          "Effect": "Allow",
          "Action": [
            "amplify:UpdateApp",
            "amplify:UpdateBranch",
            "amplify:GetApp",
            "amplify:GetBranch",
            "amplify:ListApps",
            "amplify:ListBranches"
          ],
          "Resource": "*"
        }
      ]
    }
    ```

    <img src="https://mintcdn.com/enkryptify-39ddac35/Pp9xbv0du_vx2mUv/images/sync/aws/aws-create-inline-policy.png?fit=max&auto=format&n=Pp9xbv0du_vx2mUv&q=85&s=c0bafdadaa33bb010b326225b3df1ea7" alt="Attach Secrets Manager permissions" width="2868" height="1684" data-path="images/sync/aws/aws-create-inline-policy.png" />

    <img src="https://mintcdn.com/enkryptify-39ddac35/d9Mrbdqmlzio_IR-/images/sync/aws/aws-amplify-policy-editor.png?fit=max&auto=format&n=d9Mrbdqmlzio_IR-&q=85&s=64ccec1672b87536747ab5cbe73a961e" alt="Policy editor" width="3024" height="1524" data-path="images/sync/aws/aws-amplify-policy-editor.png" />
  </Step>

  <Step title="Copy the Role ARN">
    * From the role's `Summary`, copy the `Role ARN`.

          <img src="https://mintcdn.com/enkryptify-39ddac35/Pp9xbv0du_vx2mUv/images/sync/aws/aws-copy-arn.png?fit=max&auto=format&n=Pp9xbv0du_vx2mUv&q=85&s=f39c33598316292368e2d9f51bbb423b" alt="Copy the Role ARN" width="2868" height="1684" data-path="images/sync/aws/aws-copy-arn.png" />
  </Step>

  <Step title="Authenticate in Enkryptify">
    * Paste the Role ARN into Enkryptify to complete authentication.
    * Select the AWS region you want to sync secrets to.
  </Step>

  <Step title="Connect to an Amplify app">
    * Select the Amplify app you want to sync.
  </Step>

  <Step title="Map Enkryptify environment to Amplify branch">
    * Example: `main` → `production` or `develop` → `staging`.
    * Or choose 'All branches' for app-level variables.
  </Step>
</Steps>