Usa uno de los siguientes métodos para integrar tus cuentas de AWS en Datadog con el fin de recopilar métricas, eventos, etiquetas y logs.
AWS IAM permissions enable Datadog to collect metrics, tags, EventBridge events, and other data necessary to monitor your AWS environment.
To correctly set up the AWS Integration, you must attach the relevant IAM policies to the Datadog AWS Integration IAM Role in your AWS account.
The set of permissions necessary to use all the integrations for individual AWS services.
The following permissions included in the policy document use wild cards such as List* and Get*. If you require strict policies, use the complete action names as listed and reference the Amazon API documentation for your respective services.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"apigateway:GET",
"aoss:BatchGetCollection",
"aoss:ListCollections",
"autoscaling:Describe*",
"backup:List*",
"bcm-data-exports:GetExport",
"bcm-data-exports:ListExports",
"bedrock:GetAgent",
"bedrock:GetAgentAlias",
"bedrock:GetFlow",
"bedrock:GetFlowAlias",
"bedrock:GetGuardrail",
"bedrock:GetImportedModel",
"bedrock:GetInferenceProfile",
"bedrock:GetMarketplaceModelEndpoint",
"bedrock:ListAgentAliases",
"bedrock:ListAgents",
"bedrock:ListFlowAliases",
"bedrock:ListFlows",
"bedrock:ListGuardrails",
"bedrock:ListImportedModels",
"bedrock:ListInferenceProfiles",
"bedrock:ListMarketplaceModelEndpoints",
"bedrock:ListPromptRouters",
"bedrock:ListProvisionedModelThroughputs",
"budgets:ViewBudget",
"cassandra:Select",
"cloudfront:GetDistributionConfig",
"cloudfront:ListDistributions",
"cloudtrail:DescribeTrails",
"cloudtrail:GetTrailStatus",
"cloudtrail:LookupEvents",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*",
"codeartifact:DescribeDomain",
"codeartifact:DescribePackageGroup",
"codeartifact:DescribeRepository",
"codeartifact:ListDomains",
"codeartifact:ListPackageGroups",
"codeartifact:ListPackages",
"codedeploy:BatchGet*",
"codedeploy:List*",
"codepipeline:ListWebhooks",
"cur:DescribeReportDefinitions",
"directconnect:Describe*",
"dynamodb:Describe*",
"dynamodb:List*",
"ec2:Describe*",
"ec2:GetAllowedImagesSettings",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:GetInstanceMetadataDefaults",
"ec2:GetSerialConsoleAccessStatus",
"ec2:GetSnapshotBlockPublicAccessState",
"ec2:GetTransitGatewayPrefixListReferences",
"ec2:SearchTransitGatewayRoutes",
"ecs:Describe*",
"ecs:List*",
"elasticache:Describe*",
"elasticache:List*",
"elasticfilesystem:DescribeAccessPoints",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeTags",
"elasticloadbalancing:Describe*",
"elasticmapreduce:Describe*",
"elasticmapreduce:List*",
"emr-containers:ListManagedEndpoints",
"emr-containers:ListSecurityConfigurations",
"emr-containers:ListVirtualClusters",
"es:DescribeElasticsearchDomains",
"es:ListDomainNames",
"es:ListTags",
"events:CreateEventBus",
"fsx:DescribeFileSystems",
"fsx:ListTagsForResource",
"glacier:GetVaultNotifications",
"glue:ListRegistries",
"grafana:DescribeWorkspace",
"greengrass:GetComponent",
"greengrass:GetConnectivityInfo",
"greengrass:GetCoreDevice",
"greengrass:GetDeployment",
"health:DescribeAffectedEntities",
"health:DescribeEventDetails",
"health:DescribeEvents",
"kinesis:Describe*",
"kinesis:List*",
"lambda:GetPolicy",
"lambda:List*",
"lightsail:GetInstancePortStates",
"logs:DeleteSubscriptionFilter",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:DescribeSubscriptionFilters",
"logs:FilterLogEvents",
"logs:PutSubscriptionFilter",
"logs:TestMetricFilter",
"macie2:GetAllowList",
"macie2:GetCustomDataIdentifier",
"macie2:ListAllowLists",
"macie2:ListCustomDataIdentifiers",
"macie2:ListMembers",
"macie2:GetMacieSession",
"managedblockchain:GetAccessor",
"managedblockchain:GetMember",
"managedblockchain:GetNetwork",
"managedblockchain:GetNode",
"managedblockchain:GetProposal",
"managedblockchain:ListAccessors",
"managedblockchain:ListInvitations",
"managedblockchain:ListMembers",
"managedblockchain:ListNodes",
"managedblockchain:ListProposals",
"memorydb:DescribeAcls",
"memorydb:DescribeMultiRegionClusters",
"memorydb:DescribeParameterGroups",
"memorydb:DescribeReservedNodes",
"memorydb:DescribeSnapshots",
"memorydb:DescribeSubnetGroups",
"memorydb:DescribeUsers",
"oam:ListAttachedLinks",
"oam:ListSinks",
"organizations:Describe*",
"organizations:List*",
"osis:GetPipeline",
"osis:GetPipelineBlueprint",
"osis:ListPipelineBlueprints",
"osis:ListPipelines",
"proton:GetComponent",
"proton:GetDeployment",
"proton:GetEnvironment",
"proton:GetEnvironmentAccountConnection",
"proton:GetEnvironmentTemplate",
"proton:GetEnvironmentTemplateVersion",
"proton:GetRepository",
"proton:GetService",
"proton:GetServiceInstance",
"proton:GetServiceTemplate",
"proton:GetServiceTemplateVersion",
"proton:ListComponents",
"proton:ListDeployments",
"proton:ListEnvironmentAccountConnections",
"proton:ListEnvironmentTemplateVersions",
"proton:ListEnvironmentTemplates",
"proton:ListEnvironments",
"proton:ListRepositories",
"proton:ListServiceInstances",
"proton:ListServiceTemplateVersions",
"proton:ListServiceTemplates",
"proton:ListServices",
"qldb:ListJournalKinesisStreamsForLedger",
"rds:Describe*",
"rds:List*",
"redshift:DescribeClusters",
"redshift:DescribeLoggingStatus",
"redshift-serverless:ListEndpointAccess",
"redshift-serverless:ListManagedWorkgroups",
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListRecoveryPoints",
"redshift-serverless:ListSnapshots",
"route53:List*",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketNotification",
"s3:GetBucketTagging",
"s3:ListAccessGrants",
"s3:ListAllMyBuckets",
"s3:PutBucketNotification",
"s3express:GetBucketPolicy",
"s3express:GetEncryptionConfiguration",
"s3express:ListAllMyDirectoryBuckets",
"savingsplans:DescribeSavingsPlanRates",
"savingsplans:DescribeSavingsPlans",
"secretsmanager:GetResourcePolicy",
"ses:Get*",
"ses:ListAddonInstances",
"ses:ListAddonSubscriptions",
"ses:ListAddressLists",
"ses:ListArchives",
"ses:ListContactLists",
"ses:ListCustomVerificationEmailTemplates",
"ses:ListMultiRegionEndpoints",
"ses:ListIngressPoints",
"ses:ListRelays",
"ses:ListRuleSets",
"ses:ListTemplates",
"ses:ListTrafficPolicies",
"sns:GetSubscriptionAttributes",
"sns:List*",
"sns:Publish",
"sqs:ListQueues",
"states:DescribeStateMachine",
"states:ListStateMachines",
"support:DescribeTrustedAdvisor*",
"support:RefreshTrustedAdvisorCheck",
"tag:GetResources",
"tag:GetTagKeys",
"tag:GetTagValues",
"timestream:DescribeEndpoints",
"timestream:ListTables",
"waf-regional:GetRule",
"waf-regional:GetRuleGroup",
"waf-regional:ListRuleGroups",
"waf-regional:ListRules",
"waf:GetRule",
"waf:GetRuleGroup",
"waf:ListRuleGroups",
"waf:ListRules",
"wafv2:GetIPSet",
"wafv2:GetLoggingConfiguration",
"wafv2:GetRegexPatternSet",
"wafv2:GetRuleGroup",
"wafv2:ListLoggingConfigurations",
"workmail:DescribeOrganization",
"workmail:ListOrganizations",
"xray:BatchGetTraces",
"xray:GetTraceSummaries"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
Algunos productos de Datadog aprovechan la información de configuración de tus recursos de AWS (como buckets de S3, snapshots de RDS y distribuciones de CloudFront). Datadog recopila esta información realizando llamadas de API de sólo lectura a tu cuenta AWS.
Para añadir Cloud Security Management a una integración AWS existente, sigue los pasos que se indican a continuación para habilitar la recopilación de recursos.
Hay dos maneras de enviar alarmas de CloudWatch AWS al Explorador de eventos de Datadog:
Los eventos de AWS se recopilan por cada servicio AWS. Para obtener más información sobre eventos recopilados, consulta la documentación de tu servicio AWS.
Las siguientes etiquetas se recopilan con la integración de AWS. Nota: Algunas etiquetas solo se muestran en determinadas métricas.
