> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Enable one runtime AWS identity for resource backups and restores.

AWS is optional. Enable it only when a resource backup policy uses AWS S3. Configure the API process and restart it:

```dotenv theme={"system"}
TOWBAR_AWS_ENABLED=true
TOWBAR_AWS_REGION=us-east-1
TOWBAR_AWS_ACCESS_KEY_ID=<access-key-id>
TOWBAR_AWS_SECRET_ACCESS_KEY=<secret-access-key>
```

Temporary AWS sessions are not supported because they are not maintainable as static installation configuration. Scope the identity to the required buckets, prefixes, object versions, and KMS keys. Towbar shows AWS only when all enabled values pass startup validation and never returns the credential in the UI or API.

<div className="towbar-doc-screenshot">
  <div className="towbar-product-light">
    <img src="https://mintcdn.com/avgeek/7IKQY5hBmeQaVMw0/assets/release-v2/aws-setup-light.jpg?fit=max&auto=format&n=7IKQY5hBmeQaVMw0&q=85&s=500ca239fa55eba5aa7ef6a19b6f4af2" alt="The AWS integration confirms that its runtime configuration is available without exposing credentials." width="1280" height="720" loading="lazy" data-path="assets/release-v2/aws-setup-light.jpg" />
  </div>

  <div className="towbar-product-dark">
    <img src="https://mintcdn.com/avgeek/7IKQY5hBmeQaVMw0/assets/release-v2/aws-setup-dark.jpg?fit=max&auto=format&n=7IKQY5hBmeQaVMw0&q=85&s=c54bcd12187a2e808fc70b9fe6c14bd6" alt="The AWS integration confirms that its runtime configuration is available without exposing credentials." width="1280" height="720" loading="lazy" data-path="assets/release-v2/aws-setup-dark.jpg" />
  </div>

  <p>
    Runtime-managed integrations expose availability and documentation without
    returning their credentials.
  </p>
</div>

Confirm permissions with a real [resource backup and restore](/docs/backups) before relying on the configuration. Rotate the key in `.env`, recreate the API container, verify a backup, and then retire the old key.