> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudFormation Role Stacks

> How to set up AWS roles for OpenOps using CloudFormation

OpenOps provides [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) templates to create IAM roles in your AWS account with the necessary permissions to connect to your AWS resources.

## Available Stacks

### OpenOpsApp Role Stack

Creates the `OpenOpsApp` role with permissions to run workflows from the OpenOps template catalog. The stack contains all the read permissions needed to execute all templates in our library; you can still restrict the scope to the permissions needed for the templates you are actually running. Write permissions are optional and only needed if you want to apply remediation actions directly to cloud resources.

**[Create OpenOpsApp stack](https://console.aws.amazon.com/cloudformation/home#/stacks/new?stackName=OpenOpsApp\&templateURL=https://openops.s3.us-east-2.amazonaws.com/OpenOpsAppRoleStack.yml)** | [Download template](https://openops.s3.us-east-2.amazonaws.com/OpenOpsAppRoleStack.yml)

**Parameters:** AWS account ID, permission sets (optional)

### Benchmark Role Stack

Creates a read-only `OpenOpsBenchmarkRole` specifically for running AWS cost optimization benchmarks. Includes Compute Optimizer permissions, resource read access (EC2, RDS, ELB, DynamoDB, CloudWatch, Cost Explorer, CloudTrail), and Pricing API access.

**[Create Benchmark stack](https://console.aws.amazon.com/cloudformation/home#/stacks/new?stackName=OpenOpsBenchmark\&templateURL=https://openops.s3.us-east-2.amazonaws.com/OpenOpsBenchmarkRoleStack.yml)** | [Download template](https://openops.s3.us-east-2.amazonaws.com/OpenOpsBenchmarkRoleStack.yml) | [View on GitHub](https://github.com/openops-cloud/cloudformation-examples/tree/main/aws-benchmark-permissions)

**Parameters:** TrustedAccountId (required), ExternalId (optional, recommended for security)

## Installation Steps

1. Click the **Create stack** link for your desired stack above.
2. On the **Specify stack details** page, enter the required parameters, then click **Next**.
3. On the **Configure stack options** page, click **Next**.
4. On the **Review and create** page, scroll down to the **Capabilities** section and acknowledge the creation of IAM roles:
   <img src="https://mintcdn.com/openops-ecb4f397/S00FeS-kV-AiFG0A/images/cloud-cf-roles-capabilities.png?fit=max&auto=format&n=S00FeS-kV-AiFG0A&q=85&s=8a6218ec8a993d572416943dc29643ba" alt="Capabilities" width="1463" height="639" data-path="images/cloud-cf-roles-capabilities.png" />
5. Click **Submit**. The stack will be created with the configured permissions.

**Note:** The OpenOpsApp stack **must** be created in the `us-east-1` region.

## Modification

You’re welcome to download any stack template and modify specific permissions according to your needs. Notice that some AWS components in OpenOps workflows may not function properly as a result.

## Support

Feel free to join our [Slack community](https://slack.openops.com) if you have any questions or need help with your installation.