AWS Integration
Connect OpsCompanion to your AWS accounts using read-only IAM roles.
Connect your AWS accounts to OpsCompanion using IAM role assumption with read-only permissions.
Terraform
Deploy read-only IAM role with Terraform module
CloudFormation
Deploy read-only IAM role with CloudFormation stack
What OpsCompanion Monitors in AWS
Compute
- EC2 instances, AMIs, volumes, snapshots
- ECS clusters, services, tasks
- EKS clusters, node groups
- Lambda functions, layers, aliases
Storage and Databases
- S3 buckets and policies
- RDS instances and snapshots
- DynamoDB tables and indexes
- EFS file systems
Networking
- VPCs, subnets, route tables
- Security groups and rules
- Load balancers (ALB, NLB, CLB)
- Route53 zones and records
Security and Identity
- IAM users, roles, policies
- Secrets Manager (metadata only)
- KMS keys and aliases
- CloudTrail audit logs
- GuardDuty findings
Operations
- CloudWatch metrics and alarms
- CloudFormation stacks
- Systems Manager parameters
- Config compliance
How AWS Integration Works
- You create an IAM role with read-only permissions
- The role trusts OpsCompanion's AWS account
- OpsCompanion assumes the role to access your resources
- No access keys are stored
What OpsCompanion Can Access
- Resource metadata and configuration
- CloudWatch metrics and logs
- CloudTrail audit logs
- Cost and usage data
- IAM policy documents
What OpsCompanion Cannot Access
- Secret values or credentials
- Encrypted data contents
- Write or modify permissions
- Billing settings or payment methods
Constraints
- Read-only IAM permissions only
- External ID required for role assumption
- No access keys stored
- Cannot create, update, or delete resources
Setup
AWS Setup Guide - Create the IAM role using CloudFormation or Terraform.