Bring your own IAM roles (AWS)

Bring your own IAM (BYOIAM) lets you create and manage the AWS IAM resources used by LangSmith BYOC data planes. You control the roles, policies, and permissions boundaries while LangChain provisions and operates the data plane using those resources. If you want LangChain to manage IAM resources, follow the standard BYOC onboarding guide.

Before you begin

Complete the BYOC prerequisites to have a LangSmith org, with BYOC enabled.

Create the IAM resources

The byoiam Terraform module creates the shared data plane roles, policies, and Karpenter instance profile. Apply it once per AWS account for all regions and data planes that use these roles. To create the IAM resources:

Configure the AWS provider for the account where you plan to deploy your data planes.
Add the module to your Terraform configuration. Set regions to the supported AWS regions where the roles need to operate.
(Optional) Set permissions_boundary_arn to the ARN of your IAM permissions boundary policy. The module applies it to all roles it creates, except service-linked roles.
Use service_linked_roles_to_create to create missing service-linked roles. None are created by default. Omit existing roles, or import them into Terraform first.
Initialize Terraform, review the plan, and apply it in your account.

The following configuration creates shared IAM resources for two regions:

module "byoiam" {
  source = "github.com/langchain-ai/terraform//modules/byoc/aws/byoiam?ref=main"

  regions = ["us-east-1", "us-west-1"]
}

Remove IAM management permissions from the provisioning role

The langsmith-byoc-role Terraform module creates the cross-account role LangChain assumes to manage your data plane. After creating the IAM resources, configure the provisioning role:

Copy the external ID using the button next to the Data Planes header in Settings > Data Planes. Pass it to the role module as external_id. The role’s trust policy must use this value in its ExternalId condition.
Set allow_iam_management_permissions = false in your langsmith-byoc-role module configuration.
Review and apply the Terraform changes. Retain the crossplane_role_arn output for data plane creation.

Setting allow_iam_management_permissions = false changes the role’s permissions:

Removed: IAM creation, modification, and deletion permissions, including service-linked role creation.
Retained: IAM read permissions, scoped iam:PassRole, and iam:SimulatePrincipalPolicy to use and validate your existing resources.

Enabling allow_delete_permissions does not restore IAM management permissions. If you also want to bring your own VPC, set allow_vpc_creation_permissions = false and supply the VPC ID in vpc_ids.

Deploy the data plane with existing roles

You must use the byoiam Terraform module to create the exact IAM roles required by LangSmith. LangSmith performs extensive validation of these IAM resources before deploying the data plane.

The Use existing IAM roles checkbox configures the data plane to use the IAM resources you created. To deploy the data plane:

Go to Settings > Data Planes and create a data plane.
Supply the name, AWS region, network configuration, and load balancer access described in BYOC onboarding. Choose a region included in the module’s regions input.
Use the provisioning role’s crossplane_role_arn output for the AWS IAM role ARN.
Select Use existing IAM roles before submitting the request.

Continue with provisioning and private connectivity in the onboarding guide.

​Before you begin

​Create the IAM resources

​Remove IAM management permissions from the provisioning role

​Deploy the data plane with existing roles

​See also

Before you begin

Create the IAM resources

Remove IAM management permissions from the provisioning role

Deploy the data plane with existing roles

See also