> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/faults/chaos-fault-categories/aws/security-configurations/aws-iam-integration.md).

# Use IAM roles for authentication

There are three methods available for HCE to authenticate itself with AWS and obtain the necessary permissions that are specific to the targeted services:

* **IAM Roles for Service Accounts (IRSA) - OIDC method**

  IRSA leverages an OpenID Connect (OIDC) provider for authentication. This method is applicable when the execution plane is installed on an Amazon EKS cluster. It provides least-privilege access and credential isolation. This method requires setting up an OIDC provider in your EKS cluster and (for cross-account access) in each target account.
* **AWS Assume Role method**

  The Assume Role method uses [chained AssumeRole operations](https://docs.aws.amazon.com/eks/latest/userguide/cross-account-access.html) to enable cross-account access. It requires IRSA/OIDC only in the source account (where your EKS cluster is installed), and **does not require OIDC providers in any target account**, only standard IAM role trust relationships. This provides a simpler setup for cross-account chaos experiments.
* **Kubernetes Secret**

  This approach involves providing the necessary credentials through Kubernetes secrets. The advantage of this method is its compatibility with any cluster and platform. It is explained in the "notes" section of the experiment documentation.

Use the selector below to choose your preferred IAM role-based authentication method and follow the complete setup instructions.

{% @harness-package-selector/package-selector platforms="%5B%7B%22label%22%3A%22IRSA%20(OIDC%20Method)%22%2C%22slug%22%3A%22irsa-oidc-method%22%2C%22path%22%3A%22chaos-engineering%2Ffaults%2Fchaos-fault-categories%2Faws%2Fsecurity-configurations%2Faws-iam-integration%2Firsa-oidc-method-aws-iam-integration%22%7D%2C%7B%22label%22%3A%22AWS%20Assume%20Role%20Method%22%2C%22slug%22%3A%22aws-assume-role-method%22%2C%22path%22%3A%22chaos-engineering%2Ffaults%2Fchaos-fault-categories%2Faws%2Fsecurity-configurations%2Faws-iam-integration%2Faws-assume-role-method-aws-iam-integration%22%7D%5D" %}