Passer au contenu
En utilisant AWS re:Post, vous acceptez les AWS re:Post Conditions d’utilisation
AWS re:Postre:Post
À propos de re:Post

Datadog Integrations Role permissions denied

0

On the 1st June Datadog changed their monitoring for AWS Integrations:

Note: Starting June 1, 2026, the Trusted Advisor integration will use the dedicated AWS Trusted Advisor APIs instead of the AWS Support APIs. Grant the IAM permissions in step 1 before that date. After the migration, support:describe* and support:refresh* permissions are no longer required. In the IAM Console, add the following permissions to your policy document: Until June 1, 2026: support:describe*, support:refresh* — see Actions, resources, and condition keys for AWS Support. Starting June 1, 2026: trustedadvisor:ListRecommendations, trustedadvisor:ListRecommendationResources — see Actions, resources, and condition keys for AWS Trusted Advisor.

We have these permissions in place but we are still getting Access Denied for both trustedadvisor:ListRecommendations and trustedadvisor:ListRecommendationResources. I have granted the Role access to everything but the alert still comes in. The role is created using AWS Cloudformation with these links https://datadog-cloudformation-template-quickstart.s3.us-east-1.amazonaws.com/aws/v4.18.1/main_workflow.yaml https://datadog-cloudformation-template-quickstart.s3.amazonaws.com/aws/v4.18.1/datadog_integration_role.yaml Has anyone else has issues like this since the changes. Any idea how it can be resolved? Thanks

Sujets
Gestion et gouvernance
Balises
Amazon CloudWatchSurveillancePolitiques IAM
Langue
English

demandé il y a 2 mois109 vues

1 réponse
1
Réponse acceptée

If my understanding is right, than it’s sad but true according to the documentation.

The Access Denied error is NOT an IAM policy issue.

The AWS Trusted Advisor API (including trustedadvisor:ListRecommendations and trustedadvisor:ListRecommendationResources) strictly requires an AWS Business, Business Support+, Enterprise On-Ramp, or Enterprise Support plan. -> https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-api-cli.html

If your AWS account is on the Basic or Developer support plan, any call to these APIs will intentionally return an Access Denied exception, regardless of the IAM permissions assigned to the role.

To resolve this, you must either upgrade the AWS Support plan for the account or accept that the Datadog integration cannot fetch Trusted Advisor data.

EXPERT

répondu il y a 2 mois

EXPERT

vérifié il y a 2 mois

  • Alex
    il y a 2 mois

    Thank you so much Florian! That has been wrecking my head for too long! Alex

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Contenus pertinents