Skip to content
stack
Get started
Provider · Cloud

AWS — Ashlr Stack Provider

AWS: S3, Lambda, RDS. IAM access keys stored in Phantom. Wire it into your project with one command via Ashlr Stack.

Cloud · API key KEY-ONLY · v0.2 adds provisioning
AWS — S3, Lambda, RDS. IAM access keys stored in Phantom.
Dashboard ↗

One command

Add AWS to any Ashlr Stack project with a single command. Stack runs the auth flow, verifies the credential, and writes every secret slot into Phantom. 

stack add aws

Or describe what you're building and let Claude pick it up via stack recommend: 

stack recommend "raw cloud infrastructure for scale"

Auth flow

Paste a long-lived API key once. Stack verifies it against the provider's API before writing to Phantom.

How-to: Create an IAM access key pair in the AWS console and paste both halves.

Secret slots

stack add aws writes these 3 secret slots into your Phantom vault:

  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • AWS_REGION

The values never leave Phantom in plaintext. Your .env file references slot names, and stack exec -- <cmd> swaps them in at process-spawn time via Phantom's local proxy.

  • GCP — Google Cloud Platform. Service-account JSON + project ID stored in Phantom.
  • DigitalOcean — Droplets, Kubernetes, managed databases. Personal access token verified via /v2/account.
  • Hetzner — Affordable European cloud servers. API token verified via /v1/locations.

v1 notes

v1 stores the keys only — no resource provisioning. Scope the IAM policy narrowly.

FAQ

Do I need a AWS account to use it with Stack?

Yes — Stack provisions AWS on your behalf, but it authenticates as you. Paste a long-lived API key once. Stack verifies it against the provider's API before writing to Phantom. If you don't have a credential yet, create one at https://console.aws.amazon.com and paste it once.

Where does Stack store my AWS credentials?

In Phantom Secrets, an E2E-encrypted local vault. Stack writes the secret slot names (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION) into .stack.toml — the actual values live only in Phantom and never touch disk in plaintext.

Can I rotate or revoke this integration later?

Yes. Run `stack remove aws` to pull the AWS service back out (Phantom secrets deleted, MCP entry removed, .stack.toml cleaned up). Rotate the underlying AWS credentials in their dashboard — https://console.aws.amazon.com — and Stack's next `doctor --fix` will pick up the new values.

Outbound