AWS Manual Setup Guide

Docs > Integrations > Integration Guides > AWS Manual Setup Guide

Overview

Use this guide to manually set up the Datadog AWS Integration.

To set up the AWS integration manually, create an IAM policy and IAM role in your AWS account, and configure the role with an AWS External ID generated in your Datadog account. This allows Datadog’s AWS account to query AWS APIs on your behalf, and pull data into your Datadog account. The sections below detail the steps for creating each of these components, and then completing the setup in your Datadog account.

Setup

Generate an external ID

In the AWS integration configuration page, click Add AWS Account(s), and then select Manually.
Choose which AWS partition your AWS account is scoped to. The partition is either aws for commercial regions, aws-cn for China*, or aws-us-gov for GovCloud. See Partitions in the AWS documentation for more information.

Copy the AWS External ID. For more information about the external ID, read the IAM User Guide. Note: The External ID remains available and is not regenerated for 48 hours, unless explicitly changed by a user or another AWS account is added to Datadog during this period. You can return to the Add AWS Account(s) page within that time period to complete the process of adding an account without the External ID changing.

Create a Datadog integration IAM role

Datadog assumes this role to collect data on your behalf.

Go to the AWS IAM Console and click Create role.
Select AWS account for the trusted entity type, and Another AWS account.

Select Require external ID and enter the external ID copied in the previous section. Leave Require MFA disabled. For more details, see the How to use an external ID when granting access to your AWS resources to a third party AWS documentation.
Click Next.
To enable resource collection, attach the AWS SecurityAudit Policy to the role.
Click Next.
Give the role a name such as DatadogIntegrationRole. Optionally, provide a description and add tags to the role.
Click Create Role.

Create an inline IAM policy for the Datadog integration role

This policy defines the permissions necessary for the Datadog integration role to collect data for every AWS integration offered by Datadog. These permissions may change as new AWS services are added to this integration.

Select the Datadog integration role on the IAM roles page.
Click Add permissions, and select Create inline policy.
Select the JSON tab.
Paste the permission policies in the textbox.
Note: Optionally, you can add Condition elements to the IAM policy. For example, conditions can be used to restrict monitoring to certain regions.
Click Next.
Give the policy a name such a DatadogIntegrationPolicy.
Click Create policy.

Complete the setup in Datadog

Return to the manual setup section of the AWS integration configuration page.
Click the I confirm that the Datadog IAM Role has been added to the AWS Account checkbox.
In the Account ID section, enter your account ID without dashes; for example, 123456789012. You can find the account ID in the ARN of the Datadog integration role, which follows the format arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>.
In the AWS Role Name section, enter the name of the Datadog integration role previously created. Note: The role name is case sensitive and must exactly match the role name in AWS.
Click Save.
Wait up to 10 minutes for data to start being collected, and then view the out-of-the-box AWS Overview Dashboard to see metrics sent by your AWS services and infrastructure.

If there is a Datadog is not authorized to perform sts:AssumeRole error, follow the troubleshooting steps recommended in the UI, or read the troubleshooting guide.

* All use of Datadog Services in (or in connection with environments within) mainland China is subject to the disclaimer published in the Restricted Service Locations section on our website.

Setup

AWS

In your AWS console, create an IAM user to be used by the Datadog integration with the necessary permissions.
Generate an access key and secret key for the Datadog integration IAM user.

Datadog

In the AWS integration tile, click Add AWS Account, and then select Manually.
Select the Access Keys tab.
Choose which AWS partition your AWS account is scoped to. The partition is either aws for commercial regions, aws-cn for China*, or aws-us-gov for GovCloud. See [Partitions][9] in the AWS documentation for more information.
Click the I confirm that the IAM User for the Datadog Integration has been added to the AWS Account checkbox.
Enter your Account ID, AWS Access Key and AWS Secret Key.
Click Save.
Wait up to 10 minutes for data to start being collected, and then view the out-of-the-box AWS Overview Dashboard to see metrics sent by your AWS services and infrastructure.

* All use of Datadog Services in (or in connection with environments within) mainland China is subject to the disclaimer published in the Restricted Service Locations section on our website.

AWS IAM permissions

AWS IAM permissions enable Datadog to collect metrics, tags, EventBridge events, and other data necessary to monitor your AWS environment.

To correctly set up the AWS Integration, you must attach the relevant IAM policies to the Datadog AWS Integration IAM Role in your AWS account.

AWS integration IAM policy

The set of permissions necessary to use all the integrations for individual AWS services.

The following permissions included in the policy document use wild cards such as List* and Get*. If you require strict policies, use the complete action names as listed and reference the Amazon API documentation for your respective services.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "apigateway:GET",
                "aoss:BatchGetCollection",
                "aoss:ListCollections",
                "autoscaling:Describe*",
                "backup:List*",
                "bcm-data-exports:GetExport",
                "bcm-data-exports:ListExports",
                "bedrock:GetAgent",
                "bedrock:GetAgentAlias",
                "bedrock:GetFlow",
                "bedrock:GetFlowAlias",
                "bedrock:GetGuardrail",
                "bedrock:GetImportedModel",
                "bedrock:GetInferenceProfile",
                "bedrock:GetMarketplaceModelEndpoint",
                "bedrock:ListAgentAliases",
                "bedrock:ListAgents",
                "bedrock:ListFlowAliases",
                "bedrock:ListFlows",
                "bedrock:ListGuardrails",
                "bedrock:ListImportedModels",
                "bedrock:ListInferenceProfiles",
                "bedrock:ListMarketplaceModelEndpoints",
                "bedrock:ListPromptRouters",
                "bedrock:ListProvisionedModelThroughputs",
                "budgets:ViewBudget",
                "cassandra:Select",
                "cloudfront:GetDistributionConfig",
                "cloudfront:ListDistributions",
                "cloudtrail:DescribeTrails",
                "cloudtrail:GetTrailStatus",
                "cloudtrail:LookupEvents",
                "cloudwatch:Describe*",
                "cloudwatch:Get*",
                "cloudwatch:List*",
                "codeartifact:DescribeDomain",
                "codeartifact:DescribePackageGroup",
                "codeartifact:DescribeRepository",
                "codeartifact:ListDomains",
                "codeartifact:ListPackageGroups",
                "codeartifact:ListPackages",
                "codedeploy:BatchGet*",
                "codedeploy:List*",
                "codepipeline:ListWebhooks",
                "cur:DescribeReportDefinitions",
                "directconnect:Describe*",
                "dynamodb:Describe*",
                "dynamodb:List*",
                "ec2:Describe*",
                "ec2:GetAllowedImagesSettings",
                "ec2:GetEbsDefaultKmsKeyId",
                "ec2:GetInstanceMetadataDefaults",
                "ec2:GetSerialConsoleAccessStatus",
                "ec2:GetSnapshotBlockPublicAccessState",
                "ec2:GetTransitGatewayPrefixListReferences",
                "ec2:SearchTransitGatewayRoutes",
                "ecs:Describe*",
                "ecs:List*",
                "elasticache:Describe*",
                "elasticache:List*",
                "elasticfilesystem:DescribeAccessPoints",
                "elasticfilesystem:DescribeFileSystems",
                "elasticfilesystem:DescribeTags",
                "elasticloadbalancing:Describe*",
                "elasticmapreduce:Describe*",
                "elasticmapreduce:List*",
                "emr-containers:ListManagedEndpoints",
                "emr-containers:ListSecurityConfigurations",
                "emr-containers:ListVirtualClusters",
                "es:DescribeElasticsearchDomains",
                "es:ListDomainNames",
                "es:ListTags",
                "events:CreateEventBus",
                "fsx:DescribeFileSystems",
                "fsx:ListTagsForResource",
                "glacier:GetVaultNotifications",
                "glue:ListRegistries",
                "grafana:DescribeWorkspace",
                "greengrass:GetComponent",
                "greengrass:GetConnectivityInfo",
                "greengrass:GetCoreDevice",
                "greengrass:GetDeployment",
                "health:DescribeAffectedEntities",
                "health:DescribeEventDetails",
                "health:DescribeEvents",
                "kinesis:Describe*",
                "kinesis:List*",
                "lambda:GetPolicy",
                "lambda:List*",
                "lightsail:GetInstancePortStates",
                "logs:DeleteSubscriptionFilter",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:DescribeSubscriptionFilters",
                "logs:FilterLogEvents",
                "logs:PutSubscriptionFilter",
                "logs:TestMetricFilter",
                "macie2:GetAllowList",
                "macie2:GetCustomDataIdentifier",
                "macie2:ListAllowLists",
                "macie2:ListCustomDataIdentifiers",
                "macie2:ListMembers",
                "macie2:GetMacieSession",
                "managedblockchain:GetAccessor",
                "managedblockchain:GetMember",
                "managedblockchain:GetNetwork",
                "managedblockchain:GetNode",
                "managedblockchain:GetProposal",
                "managedblockchain:ListAccessors",
                "managedblockchain:ListInvitations",
                "managedblockchain:ListMembers",
                "managedblockchain:ListNodes",
                "managedblockchain:ListProposals",
                "memorydb:DescribeAcls",
                "memorydb:DescribeMultiRegionClusters",
                "memorydb:DescribeParameterGroups",
                "memorydb:DescribeReservedNodes",
                "memorydb:DescribeSnapshots",
                "memorydb:DescribeSubnetGroups",
                "memorydb:DescribeUsers",
                "oam:ListAttachedLinks",
                "oam:ListSinks",
                "organizations:Describe*",
                "organizations:List*",
                "osis:GetPipeline",
                "osis:GetPipelineBlueprint",
                "osis:ListPipelineBlueprints",
                "osis:ListPipelines",
                "proton:GetComponent",
                "proton:GetDeployment",
                "proton:GetEnvironment",
                "proton:GetEnvironmentAccountConnection",
                "proton:GetEnvironmentTemplate",
                "proton:GetEnvironmentTemplateVersion",
                "proton:GetRepository",
                "proton:GetService",
                "proton:GetServiceInstance",
                "proton:GetServiceTemplate",
                "proton:GetServiceTemplateVersion",
                "proton:ListComponents",
                "proton:ListDeployments",
                "proton:ListEnvironmentAccountConnections",
                "proton:ListEnvironmentTemplateVersions",
                "proton:ListEnvironmentTemplates",
                "proton:ListEnvironments",
                "proton:ListRepositories",
                "proton:ListServiceInstances",
                "proton:ListServiceTemplateVersions",
                "proton:ListServiceTemplates",
                "proton:ListServices",
                "qldb:ListJournalKinesisStreamsForLedger",
                "rds:Describe*",
                "rds:List*",
                "redshift:DescribeClusters",
                "redshift:DescribeLoggingStatus",
                "redshift-serverless:ListEndpointAccess",
                "redshift-serverless:ListManagedWorkgroups",
                "redshift-serverless:ListNamespaces",
                "redshift-serverless:ListRecoveryPoints",
                "redshift-serverless:ListSnapshots",
                "route53:List*",
                "s3:GetBucketLocation",
                "s3:GetBucketLogging",
                "s3:GetBucketNotification",
                "s3:GetBucketTagging",
                "s3:ListAccessGrants",
                "s3:ListAllMyBuckets",
                "s3:PutBucketNotification",
                "s3express:GetBucketPolicy",
                "s3express:GetEncryptionConfiguration",
                "s3express:ListAllMyDirectoryBuckets",
                "s3tables:GetTableBucketMaintenanceConfiguration",
                "s3tables:ListTableBuckets",
                "s3tables:ListTables",
                "savingsplans:DescribeSavingsPlanRates",
                "savingsplans:DescribeSavingsPlans",
                "secretsmanager:GetResourcePolicy",
                "ses:Get*",
                "ses:ListAddonInstances",
                "ses:ListAddonSubscriptions",
                "ses:ListAddressLists",
                "ses:ListArchives",
                "ses:ListContactLists",
                "ses:ListCustomVerificationEmailTemplates",
                "ses:ListMultiRegionEndpoints",
                "ses:ListIngressPoints",
                "ses:ListRelays",
                "ses:ListRuleSets",
                "ses:ListTemplates",
                "ses:ListTrafficPolicies",
                "sns:GetSubscriptionAttributes",
                "sns:List*",
                "sns:Publish",
                "sqs:ListQueues",
                "states:DescribeStateMachine",
                "states:ListStateMachines",
                "support:DescribeTrustedAdvisor*",
                "support:RefreshTrustedAdvisorCheck",
                "tag:GetResources",
                "tag:GetTagKeys",
                "tag:GetTagValues",
                "timestream:DescribeEndpoints",
                "timestream:ListTables",
                "waf-regional:GetRule",
                "waf-regional:GetRuleGroup",
                "waf-regional:ListRuleGroups",
                "waf-regional:ListRules",
                "waf:GetRule",
                "waf:GetRuleGroup",
                "waf:ListRuleGroups",
                "waf:ListRules",
                "wafv2:GetIPSet",
                "wafv2:GetLoggingConfiguration",
                "wafv2:GetRegexPatternSet",
                "wafv2:GetRuleGroup",
                "wafv2:ListLoggingConfigurations",
                "workmail:DescribeOrganization",
                "workmail:ListOrganizations",
                "xray:BatchGetTraces",
                "xray:GetTraceSummaries"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

AWS resource collection IAM policy

To use resource collection, you must attach AWS’s managed SecurityAudit Policy to your Datadog IAM role.

Notes:

Warning messages appear on the AWS integration tile in Datadog if you enable resource collection, but do not have the AWS Security Audit Policy attached to your Datadog IAM role.
To enable Datadog to collect account management resources from account.GetAlternateContact and account.GetContactInformation, you need to enable trusted access for AWS account management.
AWS Govcloud and AWS China accounts are not currently supported.

Additional helpful documentation, links, and articles:

AWS IntegrationDOCUMENTATION