> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fjall.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Profiles

> Understand how Fjall derives AWS profiles automatically from your organisation config, with no manual profile command.

<Info>
  There is no `fjall profile` command. Fjall derives AWS profiles automatically. Nothing to add, set, or get.
</Info>

## How profiles work

Fjall derives one AWS profile per account and region from your organisation config. The CLI fetches that config from the API, then computes profiles at runtime. No profile is authored or stored on disk.

Derived profiles appear in `~/.aws/config` with the canonical name `<org>-<account>-<region>`, for example:

```
[profile acme-production-use1]
```

| Mode              | How it authenticates                                     | Profile name               |
| ----------------- | -------------------------------------------------------- | -------------------------- |
| Account mode      | OIDC role assumption (account has its own `oidcRoleArn`) | `<account>-<region>`       |
| Organisation mode | SSO through the root account's IAM Identity Centre       | `<org>-<account>-<region>` |

OIDC is preferred whenever an account carries its own `oidcRoleArn`. See [Understanding Profiles](/deployment/understanding-profiles) for the full derivation rules.

## Connect an AWS account

Connecting an account is what produces the profiles. Run:

```bash theme={null}
fjall connect
```

This records the connection in your organisation config. Fjall derives the profiles from there.

## Select which account a deploy lands in

In organisation mode, the active deployment target chooses the account and region for a deploy. Use the `fjall target` subcommands:

```bash theme={null}
fjall target list          # show all derived targets (active marked with ▸)
fjall target get           # show the active target's account and region
fjall target set production-us-use1
```

Target names follow the form `<account>-<region>`, for example `production-us-use1`. `fjall target set` persists the choice as `activeTarget` in `fjall-config.json`. At deploy time, a per-deploy `--target <name>` flag overrides the active target.

<Note>
  The `-e, --environment` flag on `fjall deploy` does not select an account or region. It is an optional free-form label for CI/CD that passes through to CDK synthesis. Use `fjall target set` to choose the deploy account.
</Note>

## Next Steps

<CardGroup cols={2}>
  <Card title="Understanding Profiles" icon="key" href="/deployment/understanding-profiles">
    See the full account-mode and organisation-mode derivation rules.
  </Card>

  <Card title="fjall connect" icon="plug" href="/cli/connect">
    Connect an AWS account via OIDC.
  </Card>

  <Card title="fjall deploy" icon="rocket" href="/cli/deploy">
    Deploy an application to the selected target.
  </Card>

  <Card title="Deployment Targets" icon="bullseye" href="/cli/deploy">
    Choose which account a deploy lands in with fjall target.
  </Card>
</CardGroup>