Skip to main content
Interactive command. Opens your browser to deploy an OIDC CloudFormation stack for secure, short-lived credentials.

​
Usage

fjall connect establishes a secure OIDC connection between Fjall and an AWS account. Use it to:
  • Add another AWS account to your organisation.
  • Connect an existing standalone account.
  • Recover from AWS-side trust drift with --force (the IAM role was deleted but Fjall still tracks the connection as active).
The first account is connected automatically by fjall create org. Run fjall connect for every account you add after that.

​
Prerequisites

  • Authenticated with fjall login.
  • Permission in the target AWS account to create IAM roles and CloudFormation stacks.

​
What It Does

  1. Opens your browser to deploy a CloudFormation stack in the target AWS account.
  2. The stack creates an IAM OIDC provider and a role that Fjall assumes on demand.
  3. Polls for stack completion.
  4. Caches the connection locally and syncs it to the Fjall webapp.

​
Options

​
Examples

The interactive flow:
  1. Opens your default browser to deploy the OIDC CloudFormation stack.
  2. Shows a progress indicator while waiting for stack completion.
  3. Confirms the connection and displays account details.

​
Connect a named staging account

​
Non-interactive

​
Recover from trust drift

​
Typical workflow

​
Troubleshooting

​
Browser does not open

If the browser fails to open automatically:
  • Copy the URL from the terminal output and open it manually.
  • Sign in to the correct AWS account in your browser.

​
Stack deployment fails

If the OIDC CloudFormation stack fails:
  • Check that your AWS account has permission to create IAM roles and CloudFormation stacks.
  • Retry with fjall connect to re-open the browser flow.

​
Connection already exists

If a matching connection already exists, fjall connect short-circuits the flow. To connect a different AWS account, run fjall connect with credentials for the new account. To overwrite an existing connection or recover from trust drift, add --force.
The OIDC connection provides short-lived credentials, so no long-term secrets are stored. Fjall assumes the IAM role on demand using OpenID Connect federation.

​
Next Steps

fjall create

Provision account infrastructure or scaffold an application after connecting.

fjall deploy

Deploy an application, organisation, platform, or account.

Understanding Profiles

See how AWS profiles are derived automatically from org config.

Create Application

Scaffold a new application from a pattern.