Connect an AWS account

A cloud account is the trust relationship that lets LakeSail create and manage infrastructure in an AWS account you control. LakeSail assumes a scoped IAM role when it needs to act; it does not store an AWS access key or secret key.

This guide covers the standalone connection flow. For the complete first-time path from signup through a running cluster, see the Quickstart.

Prerequisites

• A LakeSail role with permission to add cloud accounts. The standard organization Owner and Member roles include this permission.
• An AWS account where you can deploy a CloudFormation stack and create IAM roles.

Before approving the connection, your security team can review the trust model and permissions or inspect the complete AWS IAM policy reference.

Connect the account

1. In LakeSail, open Settings → Cloud Accounts and click Add Account.
2. Confirm that you are signed in to the target AWS account.
3. Click Create Stack on AWS.
4. In AWS CloudFormation, review the pre-filled stack and create it. Keep the pre-filled connection parameters unchanged; they bind the role to this LakeSail connection.
5. Wait for CloudFormation to finish creating the stack. LakeSail verifies the connection automatically. You can close the LakeSail modal while CloudFormation runs and return later.
6. When the modal reports AWS account connected, optionally enter an Account alias to make the account easier to identify.
7. Click Save & Setup Network to continue to network creation, or Save & Close to return to the account list.

The account moves Pending → Verifying → Active. Once it is Active, LakeSail can create networks and managed infrastructure in it.

No stored access keys

The CloudFormation stack creates a role with a scoped trust policy. LakeSail stores the role ARN and assumes the role on demand; AWS issues the temporary credentials. See Security & IAM for the complete boundary and audit model.

Deploy the template manually

Use the manual path when your organization requires CloudFormation changes to go through a CLI, an IaC pipeline, or a separate AWS operator.

1. Follow steps 1 through 3 above to create the Pending LakeSail connection.
2. Return to the Add AWS Account modal, expand Advanced, and click Download Template.
3. Apply the downloaded template through the AWS Console, aws cloudformation deploy, or your IaC tool. Keep its connection-specific parameters unchanged.
4. Wait for CloudFormation to finish creating the stack, then copy the role ARN from its Outputs tab.
5. Back in LakeSail, expand Advanced, paste the ARN into IAM Role ARN, and click Verify Manually.
6. After verification succeeds, set an account alias if needed and save the connection.

The downloaded template and the one-click stack create the same IAM resources. The template is the source of truth; the AWS IAM reference reproduces its policies for review.

Connection states

Status	Meaning
Pending	The connection record exists, but its CloudFormation stack has not been verified
Verifying	LakeSail is checking the role and trust relationship
Active	The role was verified and the account can be used
Failed	The last verification or connection operation failed; open Check Connection to retry
Disconnected	The CloudFormation stack or role was removed, so LakeSail cannot access the account
Deleted	The connection record was removed from the organization

For a Failed account, confirm that CloudFormation created its stack successfully, then use Check Connection from the account row. For a Disconnected account, restore the stack and use Reconnect this account. Reuse the existing connection rather than creating a second one, so its networks and clusters remain attached to the correct account record.

See Troubleshooting for verification failures and broken trust relationships.

Rotate or revoke access

• Rotate or repair: redeploy the CloudFormation stack with the same connection parameters, then check the connection again in LakeSail.
• Revoke: delete the CloudFormation stack. LakeSail can no longer assume the role, and infrastructure under that account becomes unavailable until you restore the connection.

Destroy LakeSail-managed infrastructure before permanently removing a working account. Networks, clusters, and provisioned catalogs must be removed from the leaves upward while LakeSail can still reach AWS. See Security & IAM for the trust implications.

API reference

• Cloud accounts: create, verify, describe, update, and delete connections; download and synchronize CloudFormation templates.
• Networks: the next infrastructure layer inside a connected account.