Connecting your AWS account

The four screens

1. Open the link. It is single-use. GovIntel stores only a hash of it, so the moment it is issued is the only moment the secret exists anywhere.
2. Read what you are agreeing to. Then press Connect AWS.
3. Enter your 12-digit AWS account ID. Nothing else. The server derives the role identifier and hands you a CloudFormation link with the stack name and every parameter already filled in.
4. Create the stack, then press Verify Connection. You tick the IAM acknowledgement AWS requires, press Create, and come back.

The IAM acknowledgement is the one step that cannot be removed. It is the authorization, and removing it would mean holding credentials in your account.

The one decision that is yours

The stack offers a checkbox: create the GitHub Actions OIDC provider. It is ticked by default.

The identity provider is an account-level singleton shared with every other GitHub Actions workflow you run. GovIntel has no access to your account until the role exists, so it cannot look to see whether you already have one.

What the stack creates

One IAM role, and the identity provider if you asked for it. Nothing else, and nothing existing is modified. See What the CloudFormation stack creates.