--- title: "Onboarding an AWS Application" slug: "onboarding-an-aws-application" updated: 2026-07-24T09:45:04Z published: 2026-07-27T11:28:27Z canonical: "docs.britive.com/onboarding-an-aws-application" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.britive.com/llms.txt > Use this file to discover all available pages before exploring further. # Onboarding an AWS Application As mentioned earlier in the [Introduction](/v1/docs/britive-aws-integration-guide) and [Terminology](/v1/docs/terminology-aws-onboarding) of this guide, you can choose to onboard an AWS application when your AWS organization has both management accounts and member accounts. If you selected to onboard the AWS application, follow the steps outlined in this section to complete the onboarding process. ### Steps for Onboarding an AWS Application Perform the following steps for adding an AWS tenant application to Britive: Note: Before onboarding the application, ensure that you have completed the onboarding prerequisites mentioned in the [Prerequisites for Onboarding and Profile Access](/v1/docs/prerequisites-aws-onboarding). 1. Log in to the Britive application with administrator privileges. 2. Click **System admin > Tenant Applications**. 3. From the **Tenant Applications** page, click **Create Application**. 4. On the **Add Application** page, click the **Add** (**+**) sign next to the AWS application. The **Create Application** (AWS) page is displayed. On this page, you can see two tabs: **Application** and **Settings**. 5. In the **Application** tab, enter the following values: 1. Enter the **Application Name**. 2. Enter the **Application Description** (optional step). 3. Check **Show AWS Account Numbers** if you want the AWS account numbers to be displayed in the tenant application. 4. Under **Account Mapping**, you can choose the username or email mapping to map the username or user email with the AWS account, respectively. You can also choose the default setting "**No mapping"** as per the requirement. 6. Click **Next**. The **Settings** tab is displayed. 7. In the **Settings** tab, enter the following values: - In the **Console Access** section, select the following values: - Check the **Display programmatic access keys** to allow the user to copy the credentials to the clipboard after they check out programmatic access profiles. Users can only access the keys through CLI or scripts if the option is not selected. - Check the **Allow copy link for console URL** to allow the user to copy the console URL link after checking out the profile. - In the **Connection Properties** section, enter the following values: - **Management Account ID** corresponds to the Account ID of the Management AWS Account of the user. - **Identity Provider Name** corresponds to the **Provider name** added while adding the identity provider to the AWS account. For more information, see [Configuring an Identity Provider in AWS](/v1/docs/configuring-identity-provider). - **Integration Role Name** corresponds to the name of the IAM role within the AWS account of the user. If the role is created with AWS Resource Path, you need to prefix the resource path without a leading slash symbol. For example: If the ARN of the role is *arn:aws:iam::0000000000:role/Security/IAM/Britive_Integration_Role2*, you need to enter *Security/IAM/Britive_Integration_Role2* in the role name. - **Duration of the backend AWS connection (in hours)** corresponds to the **Maximum Session Duration** in an IAM role within the AWS account of the user. For more information, see [Configuring IAM Roles](/v1/docs/configuring-iam-roles). - **The region** corresponds to the AWS region to be used for STS to generate temporary AWS access keys. - In the **Advanced Settings** section, enter the following values: - **Source Identity Attribute** corresponds to the attribute value for setting Source Identity in CloudTrail logs. Under **Advanced Settings**, select an attribute from the dropdown list to be set in CloudTrail logs. Select **None** to not set any Source Identity. Note that all Britive-managed roles used in profiles need to have the **sts:SetSourceIdentity** action in the Trust relationship. Roles that do not have this action will fail to check out. Trust Relationship configuration in AWS for defining Source Identity: - **Enable AWS Session Invalidation for all Environments** to support invalidation for all environments for the management account. Make sure you have completed the configuration on the AWS side. For more information, see [Configuring for Session Invalidation](/v1/docs/configuring-for-session-invalidation). - **Manage Profiles using AWS tags**: Select this option to scan all AWS tags for AWS organization units and accounts. The AWS tags can be used in profiles under Associations to grant access to AWS accounts via AWS tags. - **Scan AI Identities**: Select this option if Britive should scan the Amazon Bedrock agents in the account. When enabled, Britive discovers each Bedrock agent along with its execution (agent resource) IAM role and foundation model and surfaces them as AI identities. - **Profile Settings**: Configure the maximum session duration for profiles. You can select the duration between 15 minutes and 12 hours. This allows setting an expiration duration for each profile while creating/updating the profile up to this configured value. 8. Click **Save and Test**. If the AWS application is configured with the correct values, then the success message is displayed. Clicking the **Save and Test** button, after adding incorrect configuration value(s) in the **Settings** tab, while configuring an AWS application, displays the relevant error message. --- Next, you can view the details of the newly created (onboarded) AWS application and use the scan functionality to scan organizations or environments in the AWS account. - For viewing the details of the onboarded AWS application, see [Detailed View of the Onboarded Application](/v1/docs/viewing-the-onboarded-application). - For using the scan organizations/environments functionality for an onboarded AWS application, see [Scanning Organizations and Environments](/v1/docs/scanning-organizations-and-environments).