> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Role Ingestion

Serval can ingest AWS IAM roles from your linked accounts so they are visible in Serval (for example, for access reviews).

Roles must be tagged for discovery, and Serval must be granted a policy that allows it to read role data.

***

## Ingestion Configuration

Perform the following setup for *each* AWS account for which Serval will ingest roles.

<Accordion title="AWS Account Ingestion Role configuration" icon="sparkles">
  1. Follow [the guide](/sections/integrations/aws) to add give Serval access to an AWS role in your account.
  2. Once the role is created, navigate to permissions and select "Create inline policy"

       <Frame caption="Create an inline policy for the ingestion role">
         <img src="https://mintcdn.com/serval/kEJkqsoMd8RKyAo5/images/integrations/aws/image(60).png?fit=max&auto=format&n=kEJkqsoMd8RKyAo5&q=85&s=e95443255f41e1b33a16821e43b09681" alt="AWS IAM permissions tab with Create inline policy button" width="2812" height="626" data-path="images/integrations/aws/image(60).png" />
       </Frame>
  3. Add the following permission policy. These permissions are required to be able to properly ingest all the data we require:

     ```javascript theme={null}
     {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Action": [
             "iam:ListRoleTags",
             "iam:ListRoles",
             "iam:ListRolePolicies",
             "iam:ListAttachedRolePolicies",
             "iam:GetRolePolicy",
             "iam:GetPolicy",
             "iam:GetPolicyVersion",
             "iam:GetRole",
             "rds:DescribeDBInstances",
             "rds:DescribeDBClusters",
             "ec2:DescribeInstances",
             "eks:DescribeCluster",
             "eks:ListClusters"
           ],
           "Resource": "*"
         }
       ]
     }
     ```
</Accordion>

## Tagging roles for ingestion

Serval only ingests roles tagged with the key `serval` (the value can be empty). Add this tag to each IAM role you want discovered during resource sync, and attach any AWS permission policies that define what the role can do.