#Connect AWS

This guide covers what to put into the connector form for AWS.

Heplon does not use an access key. It assumes a read-only IAM role in your account via sts:AssumeRole, authenticated by your tenant's ExternalId.

#1. Copy your setup details

In Heplon, open Connectors, select Add connector, then AWS. The form shows three values:

• Your AWS ExternalId — one value for your whole tenant; every AWS connector shares it.
• Heplon principal to trust — the AWS identity Heplon assumes the role with.
• Trust policy — ready to paste.

#2. Create a read-only IAM role

In your AWS account, create a role and paste the trust policy from step 1 as its trust relationship. Attach this read-only policy:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "ec2:DescribeRegions", "Resource": "*" },
    { "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" },
    {
      "Effect": "Allow",
      "Action": ["cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms"],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["logs:StartQuery", "logs:GetQueryResults"],
      "Resource": "*"
    }
  ]
}

#3. Fill in the form

AWS is now connected to Heplon.