> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.method.security/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.method.security/_mcp/server.

# Integrate with AWS using Terraform

> Deploy Terraform modules to connect individual AWS accounts or entire Organizations with Method

This guide will walk you through the process of running Terraform on either an individual AWS account or on your AWS Organization.

---

## Overview

Terraform provides a declarative way to manage infrastructure as code within your AWS accounts. If you are using AWS Organizations, Terraform also allows you to automatically deploy resources across multiple accounts within your Organization. Method supports both of these operating models, allowing you to use Terraform to seamlessly integrate individual accounts or entire Organizations with Method.

Method provides its Terraform modules in an open format to provide maximal transparency for your organization prior to applying them. You can find all of our modules in [ Github](https://github.com/method-security/aws-cloudformation-templates/tree/develop/terraform) along with instructions on how to apply the modules.

## What Gets Created

Both Terraform modules will create several resources within your AWS Account. For a detailed explanation, please refer to [ Github](https://github.com/method-security/aws-cloudformation-templates/tree/develop/terraform#architecture).

At a high level, a Lambda will be created that will leverage the provided OAuth credentials to authenticate with your Method instance and register a new IAM Role for your account. During this registration, a unique external ID will be generated that ensures your new IAM Role can only be accessed by Method. Once this Lambda completes, you will see the new IAM Role in your account.

## Required Inputs

For both of these options, you will need the following pieces of information:

* OAuth Client ID and Secret

  * These will be provided to you by your Method Mission Operations Team

    > **Note**
    >
    > Method is actively working on the ability for you to self-service create
    > and manage OAuth Applications inside the Method Platform

* Domain
  * This is the domain name of your Method instance. Do not include the `https://` or any trailing slashes

## Connecting an Individual Account

#### [Terraform Module](https://github.com/method-security/aws-cloudformation-templates/tree/develop/terraform/single-account)

View the Single Account Terraform Module on Github

### Applying the Terraform Module

#### Using the Module

Create a new Terraform configuration file (e.g., `main.tf`) with the following content:

```hcl
module "method_integration" {
  source = "github.com/method-security/aws-cloudformation-templates//terraform/single-account?ref=0.1.0"

  method_client_id     = var.method_client_id
  method_client_secret = var.method_client_secret
  method_domain        = var.method_domain
}
```

Create a `variables.tf` file:

```hcl
variable "method_client_id" {
  description = "OAuth Client ID provided by Method"
  type        = string
  sensitive   = true
}

variable "method_client_secret" {
  description = "OAuth Client Secret provided by Method"
  type        = string
  sensitive   = true
}

variable "method_domain" {
  description = "Your Method instance domain (without https://)"
  type        = string
}
```

Create a `terraform.tfvars` file with your values:

```hcl
method_client_id     = "YOUR_CLIENT_ID"
method_client_secret = "YOUR_CLIENT_SECRET"
method_domain        = "YOUR_METHOD_DOMAIN"
```

#### Initialize

Initialize your Terraform workspace:

```bash
terraform init
```

#### Plan

Review the changes that will be made:

```bash
terraform plan
```

#### Apply

Apply the configuration:

```bash
terraform apply
```

Type `yes` when prompted to confirm.

#### Direct Apply

If you want to apply the module directly without creating configuration files:

```bash
terraform init
terraform apply \
  -var="method_client_id=YOUR_CLIENT_ID" \
  -var="method_client_secret=YOUR_CLIENT_SECRET" \
  -var="method_domain=YOUR_METHOD_DOMAIN"
```

### Confirming Access

Back in the Method Platform, in the Admin -> Integrations panel, it's time to confirm our access.

#### Test Connectivity

Confirm the connection was successful by clicking the **Test Connection** button. If there is an error, please reach out to your Method Team for support.

![](/_fern-files/_img/cb061d8a64f6335532f7c0189c97ed0405cc261b991a723c93e97fbe95279e34.webp)

#### Delegate to an Environment

To provide you with granular control over which Method Environment's are able to leverage this new Cloud Connection, you need to delegate that ability to individual Environments.

From the Cloud Connection panel, search and click for any additional environments you want to delegate to. You can also deselect or clear environments that you no longer want to provide access to.

![](/_fern-files/_img/df9fea846aa96f0fc18a3e65021fbf036f638ebc676738d78b992048e92124a3.webp)

> **Warning**
>
> Existing Tasks that use this Cloud Connection will fail

---

## Connecting Multiple Accounts via AWS Organizations

Instead, if you want to provide Method with visibility to your entire AWS Organization or a subset of accounts, you can use the Method StackSet Terraform module to deploy across multiple accounts within your Organization.

#### [Terraform Module](https://github.com/method-security/aws-cloudformation-templates/tree/develop/terraform/stackset)

View the StackSet Terraform Module on Github

### Prerequisites

To use the StackSet module, you'll need:

* AWS CLI configured with appropriate credentials
* Terraform installed (version 1.0 or higher)
* Access to your AWS Organization's management account or appropriate delegated administrator permissions
* Depending on your deployment strategy:
  * For entire organization: Organization-level permissions
  * For specific OUs: The Organizational Unit IDs you want to target
  * For specific accounts: The list of AWS account IDs you want to integrate with Method

### Applying the Terraform Module

Create your `variables.tf` and `terraform.tfvars` files as shown in the single account section above, then create a new Terraform configuration file (e.g., `main.tf`):

#### Entire Organization

Deploy to all accounts in your AWS Organization:

```hcl
module "method_integration_stackset" {
  source = "github.com/method-security/aws-cloudformation-templates//terraform/stackset?ref=0.1.0"

  method_client_id     = var.method_client_id
  method_client_secret = var.method_client_secret
  method_domain        = var.method_domain

  permission_model        = "SERVICE_MANAGED"
  deploy_to_organization = true

  target_regions = ["us-east-1"]
}
```

This will automatically deploy to all accounts in your Organization, including future accounts as they are added.

#### Specific OUs

Deploy to specific Organizational Units:

```hcl
module "method_integration_stackset" {
  source = "github.com/method-security/aws-cloudformation-templates//terraform/stackset?ref=0.1.0"

  method_client_id     = var.method_client_id
  method_client_secret = var.method_client_secret
  method_domain        = var.method_domain

  permission_model               = "SERVICE_MANAGED"
  deploy_to_organizational_units = true
  organizational_unit_ids        = [
    "ou-xxxx-xxxxxxxx",
    "ou-yyyy-yyyyyyyy"
  ]

  target_regions = ["us-east-1"]
}
```

Replace the OU IDs with your specific Organizational Unit IDs. This provides granular control over which parts of your organization have Method integration.

#### Specific Accounts

Deploy to a specific list of AWS accounts:

```hcl
module "method_integration_stackset" {
  source = "github.com/method-security/aws-cloudformation-templates//terraform/stackset?ref=0.1.0"

  method_client_id     = var.method_client_id
  method_client_secret = var.method_client_secret
  method_domain        = var.method_domain

  permission_model = "SELF_MANAGED"
  target_accounts  = [
    "123456789012",
    "234567890123",
    "345678901234"
  ]

  target_regions = ["us-east-1"]
}
```

This approach is useful when you don't use AWS Organizations or need fine-grained control over exactly which accounts to integrate.

#### Initialize

Initialize your Terraform workspace: `bash terraform init `

#### Plan

Review the changes that will be made across your accounts: `bash terraform
    plan `

#### Apply

Apply the configuration to all specified accounts: `bash terraform apply
    ` Type `yes` when prompted to confirm.

#### Verify

Monitor the StackSet deployment status: `bash terraform output `

### Confirming Access

Back in the Method Platform, in the Admin -> Integrations panel, it's time to confirm our access.

#### Test Connectivity

Confirm the connection was successful by clicking the **Test Connection** button. If there is an error, please reach out to your Method Team for support.

![](/_fern-files/_img/cb061d8a64f6335532f7c0189c97ed0405cc261b991a723c93e97fbe95279e34.webp)

#### Delegate to an Environment

To provide you with granular control over which Method Environment's are able to leverage this new Cloud Connection, you need to delegate that ability to individual Environments.

From the Cloud Connection panel, search and click for any additional environments you want to delegate to. You can also deselect or clear environments that you no longer want to provide access to.

![](/_fern-files/_img/df9fea846aa96f0fc18a3e65021fbf036f638ebc676738d78b992048e92124a3.webp)

> **Warning**
>
> Existing Tasks that use this Cloud Connection will fail

## Deep Dive

For a deep dive into the Terraform modules, additional variables they provide, and more, please see our [ Github](https://github.com/method-security/aws-cloudformation-templates/tree/develop/terraform).