Connect an AWS account

An environment is a deployment target for a project: an AWS account that StratoNext and its agents can discover and operate against. After you create an environment, a wizard guides you through connecting your account with a CloudFormation template and then discovers your AWS resources automatically.

Note

An environment is optional. The platform is useful without one, but most features remain disabled until you connect it. Only AWS environments are supported today; connectors for Azure, GCP, Vercel, and others are coming.

Prerequisites

The AWS account you connect must have Amazon Bedrock model access granted for the models StratoNext agents use:

Model	Model ID
Anthropic Claude Sonnet 4.6	us.anthropic.claude-sonnet-4-6
Anthropic Claude Haiku 4.5	global.anthropic.claude-haiku-4-5-20251001-v1:0
NVIDIA Nemotron Super 3 120B	nvidia.nemotron-super-3-120b

To enable them, follow the AWS guide on getting access to Bedrock foundation models. For now, the simplest way is to open each model in the Bedrock console playground, which prompts you to request access if you do not have it yet.

How the connection works

StratoNext never asks for access keys. Instead, you deploy a CloudFormation stack in your account that creates a set of IAM roles trusted by the StratoNext platform account. The platform assumes those roles with short-lived STS sessions. Nothing long-lived is exchanged, and you can revoke access at any time by deleting the stack.

Agents never receive these roles directly either: the StratoNext credential broker assumes the role on the agent’s behalf and hands the agent short-lived credentials scoped to its current task. See IAM roles reference for what each role does.

Deploy the template

1. In the StratoNext app, open your workspace and create a new Environment, choosing AWS.

2. The wizard gives you the CloudFormation template, pre-filled with the StratoNext platform account ID. Launch it in the AWS account you want to connect.

3. Choose the template parameters:

   Parameter	Default	Purpose
   ExternalId	empty	Optional external ID embedded in the operations roles’ trust policies to prevent confused-deputy attacks. Recommended.
   EnableAgentAccess	false	Create the operations roles so agents can interact with your AWS resources.
   EnableAgentDeployment	false	Create the deployment and runtime roles so StratoNext can run agents inside your own AWS account.
   *RoleName	StratoNext defaults	Override role names if your account has naming conventions.

4. When the stack completes, copy the ARNs from the stack Outputs and paste them into the StratoNext wizard:

   Output	Paste as
   ConnectionRoleArn	Connection Role ARN
   OperationsRoleArn	Agent Operations Role ARN
   OperationsMaxRoleArn	Agent Operations Max Role ARN
   RuntimeRoleArn	Agent Runtime Role ARN
   DeploymentRoleArn	Agent Deployment Role ARN

5. StratoNext validates the connection and starts discovering your AWS resources automatically.

Agent permissions

Background agents operate with the permissions of the Operations Role. The standard template grants basic read-only permissions; you can customize the role in your AWS account at any time to give agents more power.

If you connect an external customer’s account, the customer can grant additional permissions to your agents by editing the roles on their side.