> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an AWS Account via the API

> Step-by-step API walkthrough: connect an AWS account, wait for the initial resource sync to complete, and list discovered resources using curl.

This example uses `curl` to connect an AWS account via the InfraAudit API, wait for the initial sync to complete, and list the discovered resources. It takes about five minutes for accounts with a few hundred resources.

## Prerequisites

* InfraAudit running and accessible
* A Bearer token (see [API Authentication](/api/authentication))
* An AWS IAM access key pair with the required read permissions (see [Integrations: AWS](/integrations/aws))

```bash theme={null}
export TOKEN="eyJhbGciOi..."
export BASE_URL="https://api.infraaudit.dev"
```

## Step 1: Connect the account

```bash theme={null}
curl -s -X POST "$BASE_URL/api/v1/providers/aws/connect" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production AWS",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "region": "us-east-1"
  }' | jq .
```

Response:

```json theme={null}
{
  "id": 1,
  "name": "Production AWS",
  "type": "aws",
  "status": "syncing",
  "created_at": "2024-01-15T10:00:00Z"
}
```

Save the provider ID:

```bash theme={null}
export PROVIDER_ID=1
```

## Step 2: Wait for the initial sync

Poll the provider until `status` is `synced`:

```bash theme={null}
while true; do
  STATUS=$(curl -s "$BASE_URL/api/v1/providers/$PROVIDER_ID" \
    -H "Authorization: Bearer $TOKEN" | jq -r '.status')
  echo "Status: $STATUS"
  if [ "$STATUS" = "synced" ]; then break; fi
  if [ "$STATUS" = "error" ]; then echo "Sync failed"; exit 1; fi
  sleep 5
done
```

## Step 3: List discovered resources

```bash theme={null}
curl -s "$BASE_URL/api/v1/resources?provider_id=$PROVIDER_ID" \
  -H "Authorization: Bearer $TOKEN" | jq '.meta'
```

Output:

```json theme={null}
{
  "total": 247,
  "page": 1,
  "per_page": 20
}
```

Filter to EC2 instances only:

```bash theme={null}
curl -s "$BASE_URL/api/v1/resources?provider_id=$PROVIDER_ID&type=ec2_instance" \
  -H "Authorization: Bearer $TOKEN" | jq '.data[] | {id, name, region, status}'
```

## Step 4: Verify credential security

Credentials are encrypted at rest and never returned by the API. You can confirm this by checking the provider response fields:

```bash theme={null}
curl -s "$BASE_URL/api/v1/providers/$PROVIDER_ID" \
  -H "Authorization: Bearer $TOKEN" | jq 'keys'
# ["created_at", "id", "last_synced_at", "name", "resource_count", "status", "type"]
```

No access keys appear in the response.

## Next steps

* [Run a drift scan](/api/examples/run-drift-scan) on the newly connected account
* [Connect GCP or Azure](/integrations/overview) using a similar flow