logo Windmill Hub
Login

AWS

Cloud Access key and secret Windmill docs

Call AWS services from any Windmill script, flow or app, with an access key pair or without long-lived credentials at all.

Set up in 2 steps

1

Create an access key

In the AWS console, open IAM, then Users, then your user, then Security credentials, and create an access key. Copy both halves — the secret is shown only once.

2

Add the resource in Windmill

Open Resources, add a resource of type aws, and fill awsAccessKeyId, awsSecretAccessKey and the region your resources live in.

Resource type

The shape of the credential every script on this page expects.

aws

View raw schema →
FieldTypeRequiredWhat it is
awsAccessKeyIdstringYes
awsSecretAccessKeystringYes
regionstringNo

Questions

Can I avoid storing a key?

Yes. An OIDC resource holds a role ARN instead, and workers exchange their own identity for short-lived credentials — nothing long-lived is stored.

What can the key do?

Exactly what its IAM user or role allows. Grant the narrowest policy the scripts need rather than reusing an administrator key.

Are my credentials stored on the hub?

Never. They live only in your own Windmill workspace, encrypted at rest.