---
schema_version: "1"
id: d922c066b18e27c3f97ffcd8ab7b639a427c56eff1ff9d98d74f093d877d535b
title: Create or Edit an AWS Signature v4 External Credential
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_create_edit_awssig4_ext_cred.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_awssig4_ext_cred.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a8e585b878a880f8589051a177846db4a18b7e420487030b93fa9275321a866a
description: To authenticate callouts to resources in Amazon Web Services over HTTP, create an external credential that uses the AWS Signature v4 protocol.
products:
  - Security
release: "264"
---
# Create or Edit an AWS Signature v4 External Credential

To authenticate callouts to resources in Amazon Web Services over HTTP, create an external credential that uses the AWS Signature v4 protocol.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d89416e45">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e45 ">To view external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e45 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e45 ">To create, edit, or delete external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e45 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

Named credentials support two variants of the AWS Signature v4 authentication protocol: IAM User Identified by Access Key and Roles Anywhere.

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New**. To edit an existing external credential, click its link in the list of external credentials and then click **Edit**.
4. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:25%">
                <col style="width:75%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d89416e111">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d89416e113">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e111 "><strong class="uicontrol">Label</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e113 ">A user-friendly name for the external credential that’s shown in the Salesforce user
                    interface, such as in list views.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e111 "><strong class="uicontrol">Name</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e113 ">
                    <p>A unique identifier that’s used to refer to this external credential from callout
                      definitions and through the API.</p>
                    <p style="margin-bottom:0;">The name can contain only underscores and alphanumeric
                      characters. It must be unique, begin with a letter, not include spaces, not end with an
                      underscore, and not contain two consecutive underscores.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e111 "><strong class="uicontrol">Authentication Protocol</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e113 ">Select <strong class="uicontrol">AWS Signature 4</strong>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e111 "><strong class="uicontrol">Service</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e113 ">The name of an AWS service, such as DynamoDB or Athena.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e111 "><strong class="uicontrol">Region</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e113 ">An AWS geographic region, such as <kbd>us-west-1</kbd> (United States
                    West).</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e111 "><strong class="uicontrol">AWS Account ID</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e113 ">Optional. The 12-digit number that uniquely identifies your AWS account.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" id="nc_create_edit_awssig4_ext_cred__sts_options" style="vertical-align:top;" headers="d89416e111 "><strong class="uicontrol">Obtain Temporary IAM Credentials via
                      STS</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e113 ">
                    <p>Optional. If you want to use STS, select this checkbox. Then, select one of these
                      credential types.</p>
                    <ul>
                      <li><strong class="uicontrol">IAM User Identified by Access Key</strong></li>
                      <li><strong class="uicontrol">Roles Anywhere (Assume an IAM Role via Certificate)</strong></li>
                    </ul>
                    <p>See <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&amp;release=264.0.0&amp;type=5" title="Your connections between Salesforce and external systems use an authentication protocol to confirm secure communication between the two systems. Choose the authentication protocol that matches the configuration of the external system that you connect to. When you do, keep the strengths and considerations of each authentication protocol in mind.">Authentication Protocols for Named Credentials</a> for information on these variants.</p>
                    <p style="margin-bottom:0;">If you’re using
                      Amazon API Gateway, configure the gateway response for expired tokens so that it returns
                      a 400 or 401 HTTP code. Then Salesforce can refresh the token when it expires. A 403 code
                      doesn’t cause a token refresh, because it’s reserved for scenarios where the token is
                      valid but the caller doesn’t have access to the resource.</p>
                  </td>
                </tr>
              </tbody>
            </table>
5. If you selected the **Obtain Temporary IAM Credentials via STS** checkbox, the fields vary based on the credential type that you choose.
    
    For the IAM User Identified by Access Key credential type, complete these fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:50%">
                <col style="width:50%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d89416e199">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d89416e201">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e199 "><strong class="uicontrol">STS Access Key</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e201 ">The access key ID for the AWS access key.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e199 "><strong class="uicontrol">STS Access Secret</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e201 ">The access secret for the AWS access key.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e199 "><strong class="uicontrol">STS External ID</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e201 ">
                    <p>The AWS <code>ExternalId</code> value that can be used when
                      delegating account access to a third party. This value helps ensure that only a specified
                      third party can access the role.</p>
                    <p>Using an external ID ensures that the server side can
                      identify Salesforce as the client assuming the IAM Role. Use the
                      format:</p>
                    <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>salesforceIntegration-<var>unique_phrase</var></code></pre>
                    <p>For
                      example:</p>
                    <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>salesforceIntegration-abc123</code></pre>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e199 "><strong class="uicontrol">STS Duration</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e201 ">Optional. Numeric value in seconds, for example, <code>3600</code>. Maximum value: 43200 (12 hours).</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e199 "><strong class="uicontrol">Additional Status Codes for Token Refresh</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e201 ">
                    <p>Specify HTTP status codes that trigger Salesforce to refresh expired or invalid access
                      tokens, in addition to the standard <code>401</code>
                      response. </p>
                    <p style="margin-bottom:0;">The system makes only one refresh retry per
                      callout for the status codes defined in this field.
                      Different AWS services can return different status codes
                      when a token refresh is needed. For example, some
                      services return <code>401</code>, some return both
                      <code>401</code> and <code>403</code>, and
                      others return different <code>4xx</code> errors.
                      Verify the specific status codes that your AWS service
                      returns and add them to this field as
                      needed.
                    </p>
                  </td>
                </tr>
              </tbody>
            </table>
    
    For the Roles Anywhere credential type, complete these fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:50%">
                <col style="width:50%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d89416e276">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d89416e278">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e276 "><strong class="uicontrol">Trust Anchor ARN</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e278 ">The Amazon Resource Name for the trust anchor. A trust anchor is either a reference
                    to AWS Private Certificate Authority (AWS Private CA) or another CA certificate.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e276 "><strong class="uicontrol">Profile ARN</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e278 ">The Amazon Resource Name for the Amazon profile. Profiles are predefined sets of
                    permissions that are applied after successfully authenticating with Roles Anywhere.
                    Profiles map to one or more IAM roles.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e276 "><strong class="uicontrol">Signing Certificate</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e278 ">A certificate from AWS, via a CA (certificate authority), and uploaded to Salesforce
                    through Certificate and Key Management.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e276 "><strong class="uicontrol">STS Duration</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e278 ">Optional. Numeric value in seconds, for example, 3600. Maximum value: 43200 (12
                    hours).</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e276 "><strong class="uicontrol">Additional Status Codes for Token Refresh</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d89416e278 ">
                    <p>Specify HTTP status codes that trigger Salesforce to refresh expired or invalid access
                      tokens, in addition to the standard <code>401</code>
                      response. </p>
                    <p style="margin-bottom:0;">The system makes only one refresh retry per
                      callout for the status codes defined in this field.
                      Different AWS services can return different status codes
                      when a token refresh is needed. For example, some
                      services return <code>401</code>, some return both
                      <code>401</code> and <code>403</code>, and
                      others return different <code>4xx</code> errors.
                      Verify the specific status codes that your AWS service
                      returns and add them to this field as
                      needed.
                    </p>
                  </td>
                </tr>
              </tbody>
            </table>
6. Save the external credential.
    
    You’re taken to the Named Credentials screen.

## Create Principals for AWS Signature v4

After you’ve created an external credential that uses AWS Signature v4 authentication, create principals for it. These principals get mapped to permission sets and profiles.

1. On the Named Credentials page, click **External Credential**.
2. Select the external credential you created.
3. Scroll to Principals.
4. Click **New** to create a principal for this external credential, or choose **Edit** from the Actions menu of an existing principal.
    
    When editing an existing principal, not all the fields listed here are modifiable.
5. Complete the following fields. If you’re using STS, the Access Key and Secret fields are disabled and display the temporary credentials, if any.
    
     
    | Field | Description |
    | --- | --- |
    | **Parameter Name** | Enter a name for the principal, such as Admin or Marketing Group. |
    | **Sequence Number** | Assign a sequence number. A sequence number specifies the order of principals to apply when a user participates in more than one principal. For example, a user could be part of multiple permission sets that are applicable for a credential provider. Priority is from lower to higher numbers. |
    | **Access Key** | Optional. The access key ID for the AWS access key. |
    | **Access Secret** | Optional. The access secret for the AWS access key. |
    | **IAM Role ARN** | Optional. The Amazon Resource Name (ARN) of the role that the credential assumes. |
6. Save the principal.
    
    You can’t modify the Principal Name and Identity Type of an existing principal. To change these parameters, delete the principal and recreate it.

Now that you created the external credential and its principal, it’s time to create the connected name credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential."). For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.")