Use one of the following methods to integrate your AWS accounts into Datadog for metric, event, tag, and log collection.
AWS IAM permissions enable Datadog to collect metrics, tags, EventBridge events, and other data necessary to monitor your AWS environment.
To correctly set up the AWS Integration, you must attach the relevant IAM policies to the Datadog AWS Integration IAM Role in your AWS account.
The set of permissions necessary to use all the integrations for individual AWS services.
The following permissions included in the policy document use wild cards such as List*
and Get*
. If you require strict policies, use the complete action names as listed and reference the Amazon API documentation for your respective services.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"apigateway:GET",
"aoss:BatchGetCollection",
"aoss:ListCollections",
"autoscaling:Describe*",
"backup:List*",
"bcm-data-exports:GetExport",
"bcm-data-exports:ListExports",
"bedrock:GetAgent",
"bedrock:GetAgentAlias",
"bedrock:GetFlow",
"bedrock:GetFlowAlias",
"bedrock:GetGuardrail",
"bedrock:GetImportedModel",
"bedrock:GetInferenceProfile",
"bedrock:GetMarketplaceModelEndpoint",
"bedrock:ListAgentAliases",
"bedrock:ListAgents",
"bedrock:ListFlowAliases",
"bedrock:ListFlows",
"bedrock:ListGuardrails",
"bedrock:ListImportedModels",
"bedrock:ListInferenceProfiles",
"bedrock:ListMarketplaceModelEndpoints",
"bedrock:ListPromptRouters",
"bedrock:ListProvisionedModelThroughputs",
"budgets:ViewBudget",
"cassandra:Select",
"cloudfront:GetDistributionConfig",
"cloudfront:ListDistributions",
"cloudtrail:DescribeTrails",
"cloudtrail:GetTrailStatus",
"cloudtrail:LookupEvents",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*",
"codeartifact:DescribeDomain",
"codeartifact:DescribePackageGroup",
"codeartifact:DescribeRepository",
"codeartifact:ListDomains",
"codeartifact:ListPackageGroups",
"codeartifact:ListPackages",
"codedeploy:BatchGet*",
"codedeploy:List*",
"codepipeline:ListWebhooks",
"cur:DescribeReportDefinitions",
"directconnect:Describe*",
"dynamodb:Describe*",
"dynamodb:List*",
"ec2:Describe*",
"ec2:GetAllowedImagesSettings",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:GetInstanceMetadataDefaults",
"ec2:GetSerialConsoleAccessStatus",
"ec2:GetSnapshotBlockPublicAccessState",
"ec2:GetTransitGatewayPrefixListReferences",
"ec2:SearchTransitGatewayRoutes",
"ecs:Describe*",
"ecs:List*",
"elasticache:Describe*",
"elasticache:List*",
"elasticfilesystem:DescribeAccessPoints",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeTags",
"elasticloadbalancing:Describe*",
"elasticmapreduce:Describe*",
"elasticmapreduce:List*",
"emr-containers:ListManagedEndpoints",
"emr-containers:ListSecurityConfigurations",
"emr-containers:ListVirtualClusters",
"es:DescribeElasticsearchDomains",
"es:ListDomainNames",
"es:ListTags",
"events:CreateEventBus",
"fsx:DescribeFileSystems",
"fsx:ListTagsForResource",
"glacier:GetVaultNotifications",
"glue:ListRegistries",
"grafana:DescribeWorkspace",
"greengrass:GetComponent",
"greengrass:GetConnectivityInfo",
"greengrass:GetCoreDevice",
"greengrass:GetDeployment",
"health:DescribeAffectedEntities",
"health:DescribeEventDetails",
"health:DescribeEvents",
"kinesis:Describe*",
"kinesis:List*",
"lambda:GetPolicy",
"lambda:List*",
"lightsail:GetInstancePortStates",
"logs:DeleteSubscriptionFilter",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:DescribeSubscriptionFilters",
"logs:FilterLogEvents",
"logs:PutSubscriptionFilter",
"logs:TestMetricFilter",
"macie2:GetAllowList",
"macie2:GetCustomDataIdentifier",
"macie2:ListAllowLists",
"macie2:ListCustomDataIdentifiers",
"macie2:ListMembers",
"macie2:GetMacieSession",
"managedblockchain:GetAccessor",
"managedblockchain:GetMember",
"managedblockchain:GetNetwork",
"managedblockchain:GetNode",
"managedblockchain:GetProposal",
"managedblockchain:ListAccessors",
"managedblockchain:ListInvitations",
"managedblockchain:ListMembers",
"managedblockchain:ListNodes",
"managedblockchain:ListProposals",
"memorydb:DescribeAcls",
"memorydb:DescribeMultiRegionClusters",
"memorydb:DescribeParameterGroups",
"memorydb:DescribeReservedNodes",
"memorydb:DescribeSnapshots",
"memorydb:DescribeSubnetGroups",
"memorydb:DescribeUsers",
"oam:ListAttachedLinks",
"oam:ListSinks",
"organizations:Describe*",
"organizations:List*",
"osis:GetPipeline",
"osis:GetPipelineBlueprint",
"osis:ListPipelineBlueprints",
"osis:ListPipelines",
"proton:GetComponent",
"proton:GetDeployment",
"proton:GetEnvironment",
"proton:GetEnvironmentAccountConnection",
"proton:GetEnvironmentTemplate",
"proton:GetEnvironmentTemplateVersion",
"proton:GetRepository",
"proton:GetService",
"proton:GetServiceInstance",
"proton:GetServiceTemplate",
"proton:GetServiceTemplateVersion",
"proton:ListComponents",
"proton:ListDeployments",
"proton:ListEnvironmentAccountConnections",
"proton:ListEnvironmentTemplateVersions",
"proton:ListEnvironmentTemplates",
"proton:ListEnvironments",
"proton:ListRepositories",
"proton:ListServiceInstances",
"proton:ListServiceTemplateVersions",
"proton:ListServiceTemplates",
"proton:ListServices",
"qldb:ListJournalKinesisStreamsForLedger",
"rds:Describe*",
"rds:List*",
"redshift:DescribeClusters",
"redshift:DescribeLoggingStatus",
"redshift-serverless:ListEndpointAccess",
"redshift-serverless:ListManagedWorkgroups",
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListRecoveryPoints",
"redshift-serverless:ListSnapshots",
"route53:List*",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketNotification",
"s3:GetBucketTagging",
"s3:ListAccessGrants",
"s3:ListAllMyBuckets",
"s3:PutBucketNotification",
"s3express:GetBucketPolicy",
"s3express:GetEncryptionConfiguration",
"s3express:ListAllMyDirectoryBuckets",
"savingsplans:DescribeSavingsPlanRates",
"savingsplans:DescribeSavingsPlans",
"secretsmanager:GetResourcePolicy",
"ses:Get*",
"ses:ListAddonInstances",
"ses:ListAddonSubscriptions",
"ses:ListAddressLists",
"ses:ListArchives",
"ses:ListContactLists",
"ses:ListCustomVerificationEmailTemplates",
"ses:ListMultiRegionEndpoints",
"ses:ListIngressPoints",
"ses:ListRelays",
"ses:ListRuleSets",
"ses:ListTemplates",
"ses:ListTrafficPolicies",
"sns:GetSubscriptionAttributes",
"sns:List*",
"sns:Publish",
"sqs:ListQueues",
"states:DescribeStateMachine",
"states:ListStateMachines",
"support:DescribeTrustedAdvisor*",
"support:RefreshTrustedAdvisorCheck",
"tag:GetResources",
"tag:GetTagKeys",
"tag:GetTagValues",
"timestream:DescribeEndpoints",
"timestream:ListTables",
"waf-regional:GetRule",
"waf-regional:GetRuleGroup",
"waf-regional:ListRuleGroups",
"waf-regional:ListRules",
"waf:GetRule",
"waf:GetRuleGroup",
"waf:ListRuleGroups",
"waf:ListRules",
"wafv2:GetIPSet",
"wafv2:GetLoggingConfiguration",
"wafv2:GetRegexPatternSet",
"wafv2:GetRuleGroup",
"wafv2:ListLoggingConfigurations",
"workmail:DescribeOrganization",
"workmail:ListOrganizations",
"xray:BatchGetTraces",
"xray:GetTraceSummaries"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
Some Datadog products leverage information about how your AWS resources (such as S3 buckets, RDS snapshots, and CloudFront distributions) are configured. Datadog collects this information by making read-only API calls to your AWS account.
If you do not have the AWS integration set up for your AWS account, complete the set up process above. Ensure that you enable Cloud Security Management when mentioned.
To add Cloud Security Management to an existing AWS integration, follow the steps below to enable resource collection.
The following tags are collected with the AWS integration. Note: Some tags only display on specific metrics.