AWS IAM permissions enable Datadog to collect metrics, tags, EventBridge events, and other data necessary to monitor your AWS environment.
To correctly set up the AWS Integration, you must attach the relevant IAM policies to the Datadog AWS Integration IAM Role in your AWS account.
The set of permissions necessary to use all the integrations for individual AWS services.
The following permissions included in the policy document use wild cards such as List* and Get*. If you require strict policies, use the complete action names as listed and reference the Amazon API documentation for your respective services.
{
"Version" : "2012-10-17" ,
"Statement" : [
{
"Action" : [
"apigateway:GET" ,
"aoss:BatchGetCollection" ,
"aoss:ListCollections" ,
"autoscaling:Describe*" ,
"backup:List*" ,
"bcm-data-exports:GetExport" ,
"bcm-data-exports:ListExports" ,
"bedrock:GetAgent" ,
"bedrock:GetAgentAlias" ,
"bedrock:GetFlow" ,
"bedrock:GetFlowAlias" ,
"bedrock:GetGuardrail" ,
"bedrock:GetImportedModel" ,
"bedrock:GetInferenceProfile" ,
"bedrock:GetMarketplaceModelEndpoint" ,
"bedrock:ListAgentAliases" ,
"bedrock:ListAgents" ,
"bedrock:ListFlowAliases" ,
"bedrock:ListFlows" ,
"bedrock:ListGuardrails" ,
"bedrock:ListImportedModels" ,
"bedrock:ListInferenceProfiles" ,
"bedrock:ListMarketplaceModelEndpoints" ,
"bedrock:ListPromptRouters" ,
"bedrock:ListProvisionedModelThroughputs" ,
"budgets:ViewBudget" ,
"cassandra:Select" ,
"cloudfront:GetDistributionConfig" ,
"cloudfront:ListDistributions" ,
"cloudtrail:DescribeTrails" ,
"cloudtrail:GetTrailStatus" ,
"cloudtrail:LookupEvents" ,
"cloudwatch:Describe*" ,
"cloudwatch:Get*" ,
"cloudwatch:List*" ,
"codeartifact:DescribeDomain" ,
"codeartifact:DescribePackageGroup" ,
"codeartifact:DescribeRepository" ,
"codeartifact:ListDomains" ,
"codeartifact:ListPackageGroups" ,
"codeartifact:ListPackages" ,
"codedeploy:BatchGet*" ,
"codedeploy:List*" ,
"codepipeline:ListWebhooks" ,
"cur:DescribeReportDefinitions" ,
"directconnect:Describe*" ,
"dynamodb:Describe*" ,
"dynamodb:List*" ,
"ec2:Describe*" ,
"ec2:GetAllowedImagesSettings" ,
"ec2:GetEbsDefaultKmsKeyId" ,
"ec2:GetInstanceMetadataDefaults" ,
"ec2:GetSerialConsoleAccessStatus" ,
"ec2:GetSnapshotBlockPublicAccessState" ,
"ec2:GetTransitGatewayPrefixListReferences" ,
"ec2:SearchTransitGatewayRoutes" ,
"ecs:Describe*" ,
"ecs:List*" ,
"elasticache:Describe*" ,
"elasticache:List*" ,
"elasticfilesystem:DescribeAccessPoints" ,
"elasticfilesystem:DescribeFileSystems" ,
"elasticfilesystem:DescribeTags" ,
"elasticloadbalancing:Describe*" ,
"elasticmapreduce:Describe*" ,
"elasticmapreduce:List*" ,
"emr-containers:ListManagedEndpoints" ,
"emr-containers:ListSecurityConfigurations" ,
"emr-containers:ListVirtualClusters" ,
"es:DescribeElasticsearchDomains" ,
"es:ListDomainNames" ,
"es:ListTags" ,
"events:CreateEventBus" ,
"fsx:DescribeFileSystems" ,
"fsx:ListTagsForResource" ,
"glacier:GetVaultNotifications" ,
"glue:ListRegistries" ,
"grafana:DescribeWorkspace" ,
"greengrass:GetComponent" ,
"greengrass:GetConnectivityInfo" ,
"greengrass:GetCoreDevice" ,
"greengrass:GetDeployment" ,
"health:DescribeAffectedEntities" ,
"health:DescribeEventDetails" ,
"health:DescribeEvents" ,
"kinesis:Describe*" ,
"kinesis:List*" ,
"lambda:GetPolicy" ,
"lambda:List*" ,
"lightsail:GetInstancePortStates" ,
"logs:DeleteSubscriptionFilter" ,
"logs:DescribeLogGroups" ,
"logs:DescribeLogStreams" ,
"logs:DescribeSubscriptionFilters" ,
"logs:FilterLogEvents" ,
"logs:PutSubscriptionFilter" ,
"logs:TestMetricFilter" ,
"macie2:GetAllowList" ,
"macie2:GetCustomDataIdentifier" ,
"macie2:ListAllowLists" ,
"macie2:ListCustomDataIdentifiers" ,
"macie2:ListMembers" ,
"macie2:GetMacieSession" ,
"managedblockchain:GetAccessor" ,
"managedblockchain:GetMember" ,
"managedblockchain:GetNetwork" ,
"managedblockchain:GetNode" ,
"managedblockchain:GetProposal" ,
"managedblockchain:ListAccessors" ,
"managedblockchain:ListInvitations" ,
"managedblockchain:ListMembers" ,
"managedblockchain:ListNodes" ,
"managedblockchain:ListProposals" ,
"memorydb:DescribeAcls" ,
"memorydb:DescribeMultiRegionClusters" ,
"memorydb:DescribeParameterGroups" ,
"memorydb:DescribeReservedNodes" ,
"memorydb:DescribeSnapshots" ,
"memorydb:DescribeSubnetGroups" ,
"memorydb:DescribeUsers" ,
"oam:ListAttachedLinks" ,
"oam:ListSinks" ,
"organizations:Describe*" ,
"organizations:List*" ,
"osis:GetPipeline" ,
"osis:GetPipelineBlueprint" ,
"osis:ListPipelineBlueprints" ,
"osis:ListPipelines" ,
"proton:GetComponent" ,
"proton:GetDeployment" ,
"proton:GetEnvironment" ,
"proton:GetEnvironmentAccountConnection" ,
"proton:GetEnvironmentTemplate" ,
"proton:GetEnvironmentTemplateVersion" ,
"proton:GetRepository" ,
"proton:GetService" ,
"proton:GetServiceInstance" ,
"proton:GetServiceTemplate" ,
"proton:GetServiceTemplateVersion" ,
"proton:ListComponents" ,
"proton:ListDeployments" ,
"proton:ListEnvironmentAccountConnections" ,
"proton:ListEnvironmentTemplateVersions" ,
"proton:ListEnvironmentTemplates" ,
"proton:ListEnvironments" ,
"proton:ListRepositories" ,
"proton:ListServiceInstances" ,
"proton:ListServiceTemplateVersions" ,
"proton:ListServiceTemplates" ,
"proton:ListServices" ,
"qldb:ListJournalKinesisStreamsForLedger" ,
"rds:Describe*" ,
"rds:List*" ,
"redshift:DescribeClusters" ,
"redshift:DescribeLoggingStatus" ,
"redshift-serverless:ListEndpointAccess" ,
"redshift-serverless:ListManagedWorkgroups" ,
"redshift-serverless:ListNamespaces" ,
"redshift-serverless:ListRecoveryPoints" ,
"redshift-serverless:ListSnapshots" ,
"route53:List*" ,
"s3:GetBucketLocation" ,
"s3:GetBucketLogging" ,
"s3:GetBucketNotification" ,
"s3:GetBucketTagging" ,
"s3:ListAccessGrants" ,
"s3:ListAllMyBuckets" ,
"s3:PutBucketNotification" ,
"s3express:GetBucketPolicy" ,
"s3express:GetEncryptionConfiguration" ,
"s3express:ListAllMyDirectoryBuckets" ,
"s3tables:GetTableBucketMaintenanceConfiguration" ,
"s3tables:ListTableBuckets" ,
"s3tables:ListTables" ,
"savingsplans:DescribeSavingsPlanRates" ,
"savingsplans:DescribeSavingsPlans" ,
"secretsmanager:GetResourcePolicy" ,
"ses:Get*" ,
"ses:ListAddonInstances" ,
"ses:ListAddonSubscriptions" ,
"ses:ListAddressLists" ,
"ses:ListArchives" ,
"ses:ListContactLists" ,
"ses:ListCustomVerificationEmailTemplates" ,
"ses:ListMultiRegionEndpoints" ,
"ses:ListIngressPoints" ,
"ses:ListRelays" ,
"ses:ListRuleSets" ,
"ses:ListTemplates" ,
"ses:ListTrafficPolicies" ,
"sns:GetSubscriptionAttributes" ,
"sns:List*" ,
"sns:Publish" ,
"sqs:ListQueues" ,
"states:DescribeStateMachine" ,
"states:ListStateMachines" ,
"support:DescribeTrustedAdvisor*" ,
"support:RefreshTrustedAdvisorCheck" ,
"tag:GetResources" ,
"tag:GetTagKeys" ,
"tag:GetTagValues" ,
"timestream:DescribeEndpoints" ,
"timestream:ListTables" ,
"waf-regional:GetRule" ,
"waf-regional:GetRuleGroup" ,
"waf-regional:ListRuleGroups" ,
"waf-regional:ListRules" ,
"waf:GetRule" ,
"waf:GetRuleGroup" ,
"waf:ListRuleGroups" ,
"waf:ListRules" ,
"wafv2:GetIPSet" ,
"wafv2:GetLoggingConfiguration" ,
"wafv2:GetRegexPatternSet" ,
"wafv2:GetRuleGroup" ,
"wafv2:ListLoggingConfigurations" ,
"workmail:DescribeOrganization" ,
"workmail:ListOrganizations" ,
"xray:BatchGetTraces" ,
"xray:GetTraceSummaries"
],
"Effect" : "Allow" ,
"Resource" : "*"
}
]
}
Copy
