> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS IAM role authentication for ClickPipes

> Use AWS IAM roles to grant ClickPipes access to data sources without storing AWS access keys.

AWS IAM role authentication lets ClickPipes access supported AWS sources without storing AWS access keys. You create a role in your AWS account, allow your ClickHouse Cloud service to assume it, and grant the role permissions for the source.

<h2 id="before-you-begin">
  Before you begin
</h2>

* Your ClickHouse Cloud service must run on AWS to use IAM role authentication.
* You need permission to create and configure IAM roles in the AWS account that owns the source.
* For RDS or Aurora database authentication, you also need permission to enable IAM database authentication and configure a database user.

<h2 id="how-it-works">
  How it works
</h2>

1. Find the **Service role ID (IAM)** for your ClickHouse Cloud service under **Settings → Network security information**. This ARN identifies the role that ClickPipes uses to request access.
2. Create a role in your AWS account and trust the ClickHouse service role to assume it.
3. Grant that role the permissions required by your source, following its setup guide below.
4. Configure the ClickPipe to use the ARN of the role you created. ClickPipes assumes that role when connecting to the source.

<h2 id="configure-trust-policy">
  Configure the trust policy
</h2>

When creating the role in your AWS account, use this trust policy. Replace `{ClickHouse_IAM_ARN}` with the **Service role ID (IAM)** ARN for your ClickHouse Cloud service:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "{ClickHouse_IAM_ARN}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

For **RDS and Aurora IAM database authentication**, allow both `sts:AssumeRole` and `sts:TagSession` in the `Action` field. Follow the [database-specific IAM authentication guide](/docs/integrations/clickpipes/postgres/auth) for the complete setup, including the IAM-enabled database user.

The role's **permissions policy** and any role naming requirements depend on the source. Use the source-specific guide below to configure them.

<h2 id="choose-your-source">
  Choose your source
</h2>

| Source or integration | Setup guide |
| - | - |
| Amazon S3 | [S3 IAM role authentication](/docs/integrations/clickpipes/object-storage/amazon-s3/overview#iam-role). For continuous ingestion with SQS notifications, follow the [unordered-mode IAM role steps](/docs/integrations/clickpipes/object-storage/amazon-s3/unordered-mode#configure-iam-role). |
| Amazon Kinesis | [Kinesis role-based access](/docs/integrations/clickpipes/kinesis/auth#setup). |
| Amazon MSK | [MSK IAM permissions and trust relationship](/docs/integrations/clickpipes/kafka/best-practices#iam). |
| Amazon RDS (PostgreSQL, MySQL, MariaDB) and Aurora (PostgreSQL, MySQL) | Choose the [database-specific IAM authentication guide](/docs/integrations/clickpipes/postgres/auth). These sources also require an IAM-enabled database user and `rds-db:connect` permission. |
| AWS Glue Schema Registry | [Reuse the MSK IAM role or configure a dedicated registry role](/docs/integrations/clickpipes/kafka/schema-registries#glue-iam-setup). |

IAM role authentication controls access to the source. Configure [network connectivity](/docs/integrations/clickpipes/networking/index) separately if the source is private.