Overview

Integration connections allow Datadog Workflows and Actions to use credentials that are already configured in a Datadog integration. This eliminates the need to configure a separate connection for an action and simplifies access to the external service.

Supported use cases

Integration connections are supported for:

• ServiceNow: Use the credentials from an existing ServiceNow integration instance to run ServiceNow actions.
• AWS: Use the credentials from an existing AWS integration account to run supported read-only AWS actions. For more information about supported AWS actions and permissions, see AWS integration connections.

For other integrations or operations, create a connection.

Configuration

Before you begin, ensure that the integration is active and that you have access to edit permissions for the integration account or instance you want to use.

The following example configures a ServiceNow integration connection. You can follow the same general process for supported AWS actions, subject to the additional AWS requirements.

1. Configure integration permissions

To configure the Executor permission for a ServiceNow integration instance:

1. In Datadog, navigate to Integrations.
2. Click the ServiceNow integration.
3. Select the ServiceNow instance that you want to use to run actions.
4. Click Set Permissions.
   • If you see a Request Edit Access button instead of a Set Permissions button, ask your Datadog organization’s admin to add you as an Editor for the instance.
5. Select a user, team, or organization and click Add.
6. Under People with access, select the Executor permission.
7. Click Save.

2. Add the integration to an action

1. In Workflow Automation, click the workflow you want to edit.
2. Add a ServiceNow action.
3. In the configuration pane, click the Connection dropdown and scroll to Existing ServiceNow Integrations.
4. Select the ServiceNow instance you configured in the previous step.
5. Click Save.

AWS integration connections

Datadog Workflows and Actions can use your existing Datadog AWS integration credentials to perform read-only operations in your AWS environment. Datadog uses the same AWS credentials that power integrations such as Amazon EC2, RDS, and S3 monitoring to securely execute supported read-only actions.

There are two ways to execute AWS actions in your environment:

• Use the Datadog AWS integration to execute read-only actions allowed under the ViewOnlyAccess permissions policy.
• Use a custom AWS connection linked to a dedicated AWS IAM role with specific permissions for operations not included in the ViewOnlyAccess permissions.

Supported AWS actions

Examples include:

• Listing or describing AWS resources, such as ListECSClusters, DescribeInstances, and GetBucketPolicy
• Reading configurations or metadata from AWS services, such as GetFunctionConfiguration and ListSecrets
• Inspecting resource tags, metrics, or logs

For other AWS actions, use a dedicated connection instead.

AWS requirements

To successfully execute actions with an AWS integration connection:

• The AWS integration IAM role configured for role delegation must have the permissions required for the desired operations, such as ecs:ListClusters.
• The selected action must be read-only. Write or mutating actions, such as Put*, Delete*, and Update*, are not supported and fail when running.
• The user, team, or organization running the action must have explicit Executor permission on the AWS integration account in Datadog.

Before configuring an AWS integration connection, make sure that:

• The AWS integration is active for your target AWS account and Datadog has not detected any integration issues. If you have not set up the AWS integration, follow the AWS integration setup guide.
• The IAM role associated with the integration has the permissions for the required operations, such as ecs:ListClusters.
• You have access to edit permissions for the AWS accounts you want to use.

To configure Executor permission for an AWS integration account, follow the configuration steps, selecting the Amazon Web Services integration and the relevant AWS account instead of ServiceNow.

To add the AWS integration to an action:

1. In Workflow Automation, click the workflow you want to edit.
2. Add an AWS action, such as List ECS Clusters.
3. In the configuration pane, click the Connection dropdown and scroll to Existing AWS Integrations.
4. Select the AWS account you configured.
5. Click Save.