# Amazon Web Services \(AWS\)

Torq enables quick and easy integration with AWS, so you can automate anything and everything within moments. Torq's public AWS Steps include:

- AWS CLI command

- Describe an instance

- Search DynamoDB

- Get IP addresses for EC2 instances

- +12 more...

The following guide focuses on AWS Step integrations. To learn how to set up AWS Trigger integrations, see the [Amazon SNS](https://kb.torq.io/en/articles/9138323-amazon-sns) and [Amazon GuardDuty](https://kb.torq.io/en/articles/11027603-amazon-guardduty) guides.

# **Use** AWS **Steps in Torq**

## **Step One: Get IDs in Torq**

AWS integrations use an AWS IAM role that you define in your AWS IAM configuration.

To create an IAM role in AWS, you need the Torq Workspace ID and the AWS External ID that are located in Torq. At this point, you are only copying them—the integration is created in AWS rather than Torq.

1. **Locate the IDs in Torq:** Navigate to **Build > Integrations > Steps > AWS** and click **Add Instance.**

2. **Copy the Torq Workspace ID and AWS External ID:** Click **Copy** to save the IDs for later. You will need them to create the IAM role in AWS.

![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1449024010/effe1d82bdeed3ff36157cc051af/Screenshot+2025-03-30+at+16_11_40+copy.png?expires=1793573100&signature=e23ba53d1ca83bfa9cc95d188931a4ea3ebd6f4920b78a1b2bb40e1f12eaecd9&req=dSQjH8l8mYFeWfMW1HO4zV9jXbd00YGZam47IwYCT96GdbtN16IW2JgnNqFH%0AoLaK75P8gY3tdzo%2FMkw%3D%0A)

## **Step Two: Create an IAM Role in AWS**

There are two ways to create an IAM role in AWS: [manually](#h_5b5d4bc646) or using a [CloudFormation Template (CFT)](#h_9bcb523581).

### **Manually Create an IAM Role in AWS**

1. **Open AWS IAM:** Sign in to the AWS Management Console and go to [IAM](https://console.aws.amazon.com/iam).

2. **Create a role:** Select **Roles > Create role**.

3. **Define the new role:**

  1. Click **AWS account**.

  2. Click **Another AWS account**.

  3. In the Account ID field, enter the Torq Workspace ID you copied [earlier](#h_7596645059).

  4. Select the checkbox **Require external ID**.

  5. In the External ID field, enter the AWS External ID you copied [earlier](#h_7596645059).

  6. Click **Next**.

![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1448964489/8d27698d685c06a8f83d2ae2d286/Screenshot+2025-03-30+at+15_27_26+copy.png?expires=1793573100&signature=4e1aee880b2845169ec42472b7747fc5e3341c843c338d1b4f6bd692abfb3121&req=dSQjHsB4mYVXUPMW1HO4zYOWusGhsLRHz0SKgHjRnUlefQZkbAo1ZuRV%2Ff6C%0AfZVn%0A)

4. **Add permissions:**

  1. Select at least one policy to assign to the user, group, or role that can use AWS services in Torq Steps. If you don't assign sufficient permissions to run a specific Step, you'll get an error.

  2. (Optional) Set a permissions boundary to control the maximum permissions that can be assigned to the role.

  3. Click **Next**.

5. **Finalize:**

  1. Enter a meaningful name.

  2. Add a short description of the role.

  3. Review the trust policies and assigned permissions.

  4. (Optional) Add relevant tags.

  5. Click **Create role**.

6. **Copy the role ARN:** After you're redirected to the **IAM > Roles** console, enter the name of the role you created and then select it. Copy the ARN as you'll need it to create the AWS integration in Torq.

![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1451945909/c9b567e13c6f99209ccb367919b6/Screenshot+2025-04-01+at+10_51_33+copy+%281%29.png?expires=1793573100&signature=5cfa40ddf340050f4d511a24e2fd81bcb4485181985d344225d387f9ae1df81e&req=dSQiF8B6mIhfUPMW1HO4zb73TO0rsxUrqIynxzIRs%2B2XfBxRfH40DSdTN%2BOz%0ACi%2FOaOJ%2FIBbySnRcHlA%3D%0A)

### **Create an IAM Role in AWS Using a CFT**

CloudFormation Templates contain all the necessary configurations to create an IAM role in AWS.

1. **Open AWS CloudFormation:** Sign in to the AWS Management Console and go to [CloudFormation](http://console.aws.amazon.com/cloudformation).

2. **Create a stack:** Navigate to **CloudFormation > Stacks** and click **Create stack**.

  1. Select **Choose an existing template.**

  2. Select **Upload a template file**.

  3. Click **Choose file** and select a CFT from your device. CFTs are attached at the bottom of this guide.

  4. Click **Next**.

![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1452195527/097c88a7df74497bd4b18a1b5641/Screenshot+2025-04-01+at+13_48_29+copy.png?expires=1793573100&signature=3fd22b74052d0fff55da1e17bc2b91b0cd898f6d87955bb6328c0ac34e2d85d5&req=dSQiFMh3mIRdXvMW1HO4zQhi727a9Mxn7jYip1ZJYun16%2FqMDZqV4eTQuy8y%0AQBpi%0A)

3. **Configure the stack:**

  1. Enter a meaningful name.

  2. In the AWSExternalID field, enter the AWS External ID you copied [earlier](#h_7596645059).

  3. Select **EC2** for the permission type.

  4. In the TorqWorkspaceID field, enter the Torq Workspace ID you copied [earlier](#h_7596645059).

  5. Click **Next**.

  6. (Optional) Add tags and permissions.

  7. **Acknowledge** that CloudFormation might create IAM resources with custom names.

  8. Click **Next**.

  9. Review the stack and click **Submit**.

4. **Copy the role ARN:** When the stack's status changes from CREATE_IN_PROGRESS to CREATE_COMPLETE, go to the stack's **Outputs** tab and copy the RoleArn's value.

![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1452376743/d0d63161c2c90851a0c2fea612a7/Screenshot+2025-04-01+at+15_40_55+copy.png?expires=1793573100&signature=00ccb12678d98aabd2ed22238cd2fca7dc1ebee34983c458203a33280946572b&req=dSQiFMp5m4ZbWvMW1HO4zUEOgtT0l%2BDfSBHdoxVkvvN%2F0Z1pbgj56zu56ray%0AN2kG81ZswPv8MWT0QgY%3D%0A)

## **Step Three: Create an AWS Steps Integration in Torq**

AWS integrations are used for AWS, AWS S3, and AWS Redshift Steps in Torq Workflows.

1. **Navigate to the integration:** Go to **Build > Integrations > Steps > AWS** and click **Add Instance.**

2. **Configure the integration:**

  1. Give the integration a unique and meaningful name.

  2. Enter the AWS Role ARN that you copied [earlier](#h_ecd6f9cc39).

3. **Finalize:** Click **Add**.

![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1634311280/11340e086a2697bf9fbc0ddbc2cb/Screenshot+2025-03-30+at+16_11_40+copy+%281%29.png?expires=1793573100&signature=1f142141f5c9a3e8128d12bb00bc232a15fa52f79bd700297b4f6f09cf7f552e&req=dSYkEsp%2FnINXWfMW1HO4zVWztOBAxmFeO6TeTCniO3LklR3IOcTe%2F1sSNCGz%0AqewqmKTsPHG6MQGfuJc%3D%0A)

To assume different roles in Workflows, see the [guide](https://kb.torq.io/en/articles/9024670-assume-different-roles-via-the-sts-assume-role-command-in-aws-cli-steps) on using the `sts assume-role` command in AWS CLI Steps.

---

# **FAQs**

***Which CFT should I use?***

Use the CFT attached at the bottom of this article.

***Can I write a file to a folder or path in an S3 bucket?***

Yes. In the AWS S3 **Write File** step, enter the folder path at the start of **File name**. For example, enter `reports/audit-logs.json` to write `audit-logs.json` to the `reports` folder. You don't need to create the folder - it is created in the bucket when the step writes the file.

***How do I write files to folders named with the current date?***

1. Add a **Get Date** step before the **Write File** step.

2. In **Date format layout**, select **2006-01-02**.

3. In the **Write File** step, enter the **Get Date** output at the start of **File name**. For example: `{{ $.get_date.result }}/audit-logs.json`

To nest folders by year, month, and day, select **Custom** in **Date format layout**. Enter `%Y/%m/%d` in **Custom date format**.

**Get Date** uses UTC by default. To use your local date, add the **Time zone** parameter and select your time zone.

---

# **Templates**

Now that you've added your integrations, check out these specially crafted templates by Torq's security experts. Visit Torq's template library for [more](https://app.torq.io/templates?).

- [AWS Bedrock Usage Examples](https://app.torq.io/templates?id=4c018c52-0b46-43c9-9c53-0c50d9f6c060)

- [Retrieve Daily Unencrypted Bucket Summary (AWS Macie)](https://app.torq.io/templates?id=f137ba25-8837-405b-8731-bec398c9fc89)

---