> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fjall.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Deployment Credentials

> Configure AWS deployment credentials for Fjall using OIDC or IAM Identity Center SSO, with no long-lived access keys.

Fjall authenticates with your AWS accounts using OpenID Connect (OIDC) or AWS IAM Identity Center (SSO). No long-lived access keys are stored, and you never author profiles by hand. Fjall derives them automatically from your organisation config.

## Prerequisites

* Fjall CLI installed and logged in (`fjall login`).
* At least one AWS account connected, or an organisation deployed.

## How credentials are derived

Profiles are derived at runtime from your organisation config, which the CLI fetches from the Fjall API. There is no `fjall profile` command and no manual profile file to edit. Two modes exist:

| Mode              | How the account connects                           | Authentication                                     |
| ----------------- | -------------------------------------------------- | -------------------------------------------------- |
| Account mode      | A standalone account carrying its own OIDC role    | OIDC role assumption                               |
| Organisation mode | A member account under a root (management) account | SSO through the root account's IAM Identity Center |

OIDC is preferred whenever an account has its own OIDC role. Otherwise member accounts authenticate via SSO using the root account's Identity Center.

## Set up OIDC

OIDC is the default method and requires no manual steps.

* **Organisation mode.** Run `fjall create organisation`. The CLI opens your browser to deploy a CloudFormation stack that creates the OIDC connection for the root account.
* **Account mode, or adding another account.** Run `fjall connect`. This deploys an OIDC CloudFormation stack for that account.

```bash theme={null}
fjall connect
```

The CLI polls for stack completion, then records the connection. The derived OIDC profile is available immediately.

### Connect options

| Option                | Description                                                                         |
| --------------------- | ----------------------------------------------------------------------------------- |
| `--region <region>`   | AWS region (default: `us-east-2`)                                                   |
| `--environment <env>` | Environment label: `production`, `staging`, `development`, `platform`, `compliance` |
| `--name <name>`       | Human-readable account name (for example, `Production`)                             |
| `--force`             | Reissue the CloudFormation stack to recover from trust drift                        |
| `-v, --verbose`       | Enable verbose logging                                                              |
| `--non-interactive`   | Force plain CLI output                                                              |

## Set up SSO

If your organisation uses AWS IAM Identity Center, member-account profiles are derived as SSO profiles automatically when you run `fjall create organisation`. Fjall generates one SSO session per organisation (`sso-<rootname>`) and an `AdministratorAccess` profile per member account and region. You do not configure SSO start URLs, account IDs, or role names by hand.

See [Understanding Profiles](/deployment/understanding-profiles) for the full derivation model.

## Verify your setup

In organisation mode, deployments land in the active deployment target. Read the active target:

```bash theme={null}
fjall target get
```

List every derived target (the active one is marked with `▸`):

```bash theme={null}
fjall target list
```

Switch the active target before deploying:

```bash theme={null}
fjall target set production-us-use1
```

A deployment target is an account and region pair, named `<accountname>-<regionabbrev>`. In account mode with a single connected account, Fjall selects the target for you.

## Next Steps

<CardGroup cols={2}>
  <Card title="Understanding Profiles" icon="key" href="/deployment/understanding-profiles">
    How Fjall derives OIDC and SSO profiles
  </Card>

  <Card title="Deploy Organisation" icon="city" href="/deployment/deploy-organisation">
    Create and deploy your AWS organisation
  </Card>

  <Card title="Connect an AWS Account" icon="plug" href="/cli/connect">
    Add or recover an AWS account connection
  </Card>

  <Card title="Deploy an Application" icon="rocket" href="/deployment/deploy-application">
    Ship your first application to AWS
  </Card>
</CardGroup>