AWS

Last updated August 20, 2026Open markdown version

Introduction

Using Tines Stories to automate interaction with AWS services requires the use of an AWS credential. When a HTTP Request Action with an AWS mode credential runs, Tines Stories will authorize the request AWS using the Signature Version 4 Signing Process and include the corresponding headers in the request.

Creating an AWS credential

Role-based access

AWS recommends using roles for cross account access - e.g. to allow Tines Stories to access resources in your AWS account. To create a Role-based access AWS credential in Tines Stories, you'll also need to create and correctly configure a Role in your AWS account. The following three steps will get you up and running. For more information, see the AWS tutorial.

Role-based access is not available on self-hosted environments.

Step 1: Create your AWS Credential in Tines Stories

Create a new Credential in Tines Stories. Select "Manual creation" then select the "AWS" option.

Set the "Authentication type" to "Role-based access" and enter a name (and, optionally, a description).

You can also choose whether to use a unique generated external ID or to use a team-scoped static external ID. If a team-scoped static external ID does not already exist then one will be generated.

External IDs are a layer of protection that only allows a Tines AWS credential with your uniquely generated External ID can access the role within your AWS account.

Once you click "Save credential", you'll be presented with an Account ID and External ID:

You'll need these values in the next step.

Step 2: Create your Role in AWS

From the Identity and Access Management (IAM) section of the AWS console, navigate to "Roles" and click on "Create role":

For "Trusted entity type", select "Custom Trust Policy" and copy-paste the following trust policy, giving the two Tines Stories AWS accounts permission to assume this role, using the External ID from step 1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "857223745291"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "ExternalId"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "825838939522"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "ExternalId"
        }
      }
    }
  ]
}

Complete the "Add permissions" and "Name, review and create" steps to finish creating your Role.

If you have a dedicated stack, you can restrict access further by including your dedicated network (VPC) IDs. You'll find these through <your-stack-name>.tines.com/info:

egress_ips: Networking IPs for Tines Stories AWS account principal - 825838939522
lambda_egress_ips: Networking IPs for Tines Lambda AWS account principal for use in run script actions - 857223745291

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::857223745291:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "xxxx"
        },
        "IpAddressIfExists": {
          "aws:SourceIp": [
            "xx.xx.xxx.xxx",
            "xx.xx.xxx.xxx"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::825838939522:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "xxxxx"
        },
        "IpAddressIfExists": {
          "aws:SourceIp": [
            "xx.xx.xxx.xxx",
            "xx.xx.xxx.xxx"
          ]
        }
      }
    }
  ]
}

Step 3: Add your Role's ARN to your Tines Stories Credential

In the AWS console, open the Role you just created and copy the ARN:

Paste it into the Role ARN field of your Credential in Tines Stories and click "Save credential":

Static External IDs

By default, a new and unique external ID is generated for each AWS credential created. More information on external IDs can be found in the AWS docs. Optionally when creating a role-based access AWS credential you can opt to use a static external ID that is scoped to a team. Each credential in the team that uses this option will have the same external ID.

If you need to rotate a static external ID you can use the destroy static external ID API endpoint which will delete the current static external ID for that team. A new one can be generated by creating a new AWS credential that uses the static external ID option. Previously created credentials are not affected.

Security boundaries for AWS credentials

We use Tines-owned roles to assume role into your AWS account. The AWS accounts we own that call AWS credentials are:

Tines Stories AWS account: 825838939522
Tines Stories Lambda AWS: 857223745291

We require an External ID to be set on the IAM role permissions you set up so that only the AWS credential you create in your tenant can be used to access your AWS data.

To ensure another layer of restriction for dedicated tenants, please apply VPC egress IP rules to ensure that only requests from your dedicated Tines VPC tenant can be used to access your AWS data.

We don't share IAM role ARNs with customers because they do not provide any meaningful extra layer of security in our infrastructure boundary than External IDs and VPC restrictions, and also because they are much more likely to change.

Key-based access

Enter the following information in the AWS New Credential page:

Credential name: Your desired AWS credential name.
Access key: The access key from your AWS Security Credentials.
Access secret: The access secret from your AWS Security Credentials.

If you want to assume a role before performing the action, you can set values for the following fields.

Assumed Role ARN: The ARN of the role you wish to assume, e.g.: arn:aws:iam::123456789012:role/write-access-role

Tines Stories will request a session with the minimum duration (15 minutes).

Bedrock API key

To authenticate with AWS Bedrock using an API key, select Bedrock API key as the authentication type.

Enter the following information in the AWS New Credential page

Credential name: Your desired AWS credential name.
API key: Your Bedrock API key.

This will be used for bearer token authentication.

For more details on Bedrock API keys, see the AWS documentation

{
  "url": "https://dynamodb.eu-west-1.amazonaws.com",
  "method": "post",
  "content_type": "json",
  "payload": {
    "TableName": "TestTable",
    "AttributesToGet": ["Id"]
  },
  "headers": {
    "Authorization": "<<CREDENTIAL.aws_dynamo_db>>",
    "X-Amz-Target": "DynamoDB_20120810.Scan"
  }
}

List Cloudtrails

{
  "url": "https://cloudtrail.us-east-1.amazonaws.com",
  "method": "get",
  "content_type": "form",
  "payload": {
    "Action": "DescribeTrails",
    "Version": "2013-11-01"
  },
  "headers": {
    "Authorization": "<<CREDENTIAL.aws_cloudtrail>>"
  }
}

List IAM Users

{
  "url": "https://iam.amazonaws.com",
  "content_type": "form",
  "method": "get",
  "payload": {
    "Action": "ListUsers",
    "Version": "2010-05-08"
  },
  "headers": {
    "Authorization": "<<CREDENTIAL.aws_iam>>"
  }
}

AWS