AWS

The AWS integration connects one instance per AWS account. Resources are discovered into the estate and joined onto what other integrations already know; CloudWatch alarms and AWS Health events arrive as alert signals exactly as AWS raised them; evidence is fetched on demand; and a deliberately small write catalogue covers instance lifecycle and tagging — never IAM.

Capabilities

Discovery. EC2 instances, RDS databases, EKS clusters, load balancers, and S3 buckets are enumerated per configured region into the estate, with AWS tags flowing into the unified tag pool. Cross-source identity joins EC2 instances onto DataDog hosts (by instance id) and EKS clusters onto Kubernetes cluster entities, so one machine is one entity regardless of who reported it.

Alerts. CloudWatch alarms and AWS Health events are forwarded as alert signals with AWS’s own severity mapped onto the canonical ladder — ISE defers to the source’s detection layer and adds nothing of its own. Alarm recovery in AWS recovers the signal in ISE.

Evidence. On demand during an investigation: describe_resource, list_resources, cloudwatch_metric_statistics, logs_filter_events, and cloudtrail_lookup_events. Nothing is polled that an investigation didn’t ask for.

Actions. The governed catalogue, each through the tiered approval pipeline:

Action	Tier	Notes
reboot_instance	T1	EC2 reboot; the instance comes back on its own.
start_instance	T1	Start a stopped EC2 instance.
set_resource_tag	T1	Tag write at the source (fix-at-source tagging).
stop_instance	T2	Takes capacity away; requires approval.
reboot_db_instance	T2	RDS reboot — brief outage; requires approval.

There are no IAM actions by design: identity and permissions changes are outside this connector’s remit entirely.

Setup

1. Create a read IAM identity (user with an access key) whose policy covers discovery and evidence: sts:GetCallerIdentity, ec2:Describe*, rds:Describe*, eks:Describe*/List*, elasticloadbalancing:Describe*, S3 listing, CloudWatch and Health read, CloudWatch Logs and CloudTrail lookup.
2. In ISE, add an AWS integration (Settings → Integrations) with the access key ID, secret access key, and a default region (e.g. eu-west-2). Credentials are encrypted at rest and redacted from logs. One integration per account — native keys are account-scoped, so multiple accounts sit side by side in the estate.
3. The health check verifies the identity immediately; the System card shows the account, connection status, and last sync.
4. To enable actions, create a second, write-capable IAM identity and grant it via the integration’s Grant write flow. Reads and writes never share a credential — you can run read-only indefinitely.

Examples

An alarm lands on a known host. A CloudWatch alarm fires for high CPU on i-0abc123. The signal is attributed to the EC2 entity — the same entity DataDog reports on — so the incident opens with both worlds’ context: AWS tags, DataDog monitors, and any Kubernetes workloads running there.

Governed remediation. Diagnosis points at a wedged instance. reboot_instance (T1) is proposed and executed after its tier’s approval; had the fix been stop_instance, the T2 tier would demand explicit approval before anything ran. Either way the proposed change, approval, execution, and outcome are on the audit trail.

Evidence pull. During the same investigation, CloudTrail is searched on demand for recent API calls touching the instance — surfacing the deploy that caused the problem — and the result is recorded on the incident.