Datadog Integrations Role permissions denied

Question

On the 1st June Datadog changed their monitoring for AWS Integrations:

> Note: Starting June 1, 2026, the Trusted Advisor integration will use the dedicated AWS Trusted Advisor APIs instead of the AWS Support APIs. Grant the IAM permissions in step 1 before that date. After the migration, support:describe* and support:refresh* permissions are no longer required.
In the IAM Console, add the following permissions to your policy document:
Until June 1, 2026: support:describe*, support:refresh* — see Actions, resources, and condition keys for AWS Support.
Starting June 1, 2026: trustedadvisor:ListRecommendations, trustedadvisor:ListRecommendationResources — see Actions, resources, and condition keys for AWS Trusted Advisor.

We have these permissions in place but we are still getting Access Denied for both trustedadvisor:ListRecommendations and trustedadvisor:ListRecommendationResources. I have granted the Role access to everything but the alert still comes in. 
The role is created using AWS Cloudformation with these links https://datadog-cloudformation-template-quickstart.s3.us-east-1.amazonaws.com/aws/v4.18.1/main_workflow.yaml https://datadog-cloudformation-template-quickstart.s3.amazonaws.com/aws/v4.18.1/datadog_integration_role.yaml 
Has anyone else has issues like this since the changes. Any idea how it can be resolved?
Thanks

Florian Turnwald · Accepted Answer

**If my understanding is right, than it’s sad but true according to the documentation.**

The Access Denied error is **NOT** an IAM policy issue.

The AWS Trusted Advisor API (including `trustedadvisor:ListRecommendations` and `trustedadvisor:ListRecommendationResources`) strictly requires an AWS Business, Business Support+, Enterprise On-Ramp, or Enterprise Support plan.
-> https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-api-cli.html

If your AWS account is on the Basic or Developer support plan, any call to these APIs will intentionally return an Access Denied exception, regardless of the IAM permissions assigned to the role.

To resolve this, you must either upgrade the AWS Support plan for the account or accept that the Datadog integration cannot fetch Trusted Advisor data.

Datadog Integrations Role permissions denied

Adicione sua resposta

Conteúdo relevante