Connect an Account

An environment is a deployment target for a project: an AWS account that StratoNext and its agents can discover and operate against. After you create an environment, a wizard guides you through connecting your account with a CloudFormation template and then discovers your AWS resources automatically.

Note

An environment is optional. The platform is useful without one, but most features remain disabled until you connect it. Only AWS environments are supported today; connectors for Azure, GCP, Vercel, and others are coming.

Prerequisites

This only applies if you plan to host StratoNext agents inside your own AWS account (EnableAgentDeployment, see below). If you leave that disabled, other external agents can still connect and work against your account without it, but StratoNext’s own agents will fail to run.

The AWS account you connect must have Amazon Bedrock model access granted for the models StratoNext agents use:

Model	Model ID
Anthropic Claude Sonnet 4.6	us.anthropic.claude-sonnet-4-6
Anthropic Claude Haiku 4.5	global.anthropic.claude-haiku-4-5-20251001-v1:0

To enable them, follow the AWS guide on getting access to Bedrock foundation models. For now, the simplest way is to open each model in the Bedrock console playground, which prompts you to request access if you do not have it yet.

How the connection works

StratoNext never asks for access keys. Instead, you deploy a CloudFormation stack in your account that creates a set of IAM roles trusted only by StratoNext’s dedicated credential-broker role: a single, least-privilege StratoNext role whose only ability is to assume the roles you create. The platform assumes those roles with short-lived STS sessions. Nothing long-lived is exchanged, and you can revoke access at any time by deleting the stack.

Agents never receive these roles directly either: the StratoNext credential broker assumes the role on the agent’s behalf and hands the agent short-lived credentials scoped to its current task. See IAM roles reference for what each role does.

Onboard with an agent (recommended)

The fastest way to connect an account is to let a local agent drive the flow for you. Once the CLI is installed and the StratoNext skill is added to your agent, ask:

Onboard a new account for workspace XYZ

The agent deploys the CloudFormation template, reads back the stack outputs, and registers the environment for you. Follow its instructions and approve the steps it proposes. To do it by hand instead, use the manual flow below.

Deploy the template

1. In the StratoNext app, open your workspace and create a new Environment, choosing AWS.

2. The wizard gives you the CloudFormation template, pre-filled with StratoNext’s credential-broker role. Launch it in the AWS account you want to connect.

3. Choose the template parameters:

   Parameter	Default	Purpose
   ExternalId	None	A unique external ID embedded in every role’s trust policy to prevent confused-deputy attacks. Use a strong random value, and enter the same value in the StratoNext wizard when connecting.
   EnableAgentAccess	false	Create the operations roles so agents can interact with your AWS resources.
   EnableAgentDeployment	false	Create the deployment and runtime roles so StratoNext can run agents inside your own AWS account.
   *RoleName	random-suffix	Override role names if your account has naming conventions.

4. When the stack completes, copy the ARNs from the stack Outputs and paste them into the StratoNext wizard:

   Output	Paste as
   ConnectionRoleArn	Connection Role ARN
   OperationsRoleArn	Agent Operations Role ARN
   OperationsMaxRoleArn	Agent Operations Max Role ARN
   RuntimeRoleArn	Agent Runtime Role ARN
   DeploymentRoleArn	Agent Deployment Role ARN

5. Enter the same ExternalId you chose into the StratoNext wizard. It is required to connect, because StratoNext uses it on every role it assumes.

6. StratoNext validates the connection and starts discovering your AWS resources automatically.

Agent permissions

Background agents operate with the permissions of the Operations Role. The standard template grants basic read-only permissions; you can customize the role in your AWS account at any time to give agents more power.

If you connect an account that belongs to one of your own customers, they can grant your agents additional permissions by editing the roles on their side.