deploying intoacme-production••••4021eu-west-3

Settings

Cloud accounts, data residency and project lifecycle foracme-platform.

Audit log

AWS accounts

Kapten assumes a cross-account role. It never stores credentials and never holds your data.

2 connected

acme-production

••••••••4021 · eu-west-3

Connected

Assumed role

arn:aws:iam::918273644021:role/KaptenControlPlane

Spend this month$1,284on your bill

acme-staging

••••••••4022 · eu-west-3

Connected

Assumed role

arn:aws:iam::918273644022:role/KaptenControlPlane

Spend this month$216on your bill

Launch the CloudFormation stack
Creates an IAM role Kapten can assume, scoped to the services you enable. No long-lived access keys are ever issued.
2
Or apply the Terraform module
Prefer infrastructure as code? The module produces an identical role and outputs the ARN to paste back here.
main.tf
```
module "kapten" {
  source      = "kapten-io/control-plane/aws"
  version     = "~> 1.4"

  external_id = "kptn-ext-7f3ab19c42d0"
  regions     = ["eu-west-3"]
}
```
ExternalIdkptn-ext-7f3ab19c42d0
Verify and pick a region
Kapten performs a read-only sts:AssumeRole + ec2:DescribeVpcs probe to confirm the trust policy before provisioning anything.

Region & residency

Where Kapten provisions resources for this project's production environment.

Data never leaves the selected region. Databases, object storage, queues and log groups are created in eu-west-3 only; Kapten's control plane holds metadata (service names, commit SHAs, deploy status) and nothing else.

Danger zone

Detaching Kapten leaves every AWS resource running — it's plain Terraform in your account.

Transfer projectIrreversible

Move acme-platform to another team. The AWS account connection travels with it.

Delete projectDestructive

Removes Kapten's metadata and revokes the assumed role. Resources in918273644021 are left untouched.