Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Datadog Integrations Role permissions denied

0

On the 1st June Datadog changed their monitoring for AWS Integrations:

Note: Starting June 1, 2026, the Trusted Advisor integration will use the dedicated AWS Trusted Advisor APIs instead of the AWS Support APIs. Grant the IAM permissions in step 1 before that date. After the migration, support:describe* and support:refresh* permissions are no longer required. In the IAM Console, add the following permissions to your policy document: Until June 1, 2026: support:describe*, support:refresh* — see Actions, resources, and condition keys for AWS Support. Starting June 1, 2026: trustedadvisor:ListRecommendations, trustedadvisor:ListRecommendationResources — see Actions, resources, and condition keys for AWS Trusted Advisor.

We have these permissions in place but we are still getting Access Denied for both trustedadvisor:ListRecommendations and trustedadvisor:ListRecommendationResources. I have granted the Role access to everything but the alert still comes in. The role is created using AWS Cloudformation with these links https://datadog-cloudformation-template-quickstart.s3.us-east-1.amazonaws.com/aws/v4.18.1/main_workflow.yaml https://datadog-cloudformation-template-quickstart.s3.amazonaws.com/aws/v4.18.1/datadog_integration_role.yaml Has anyone else has issues like this since the changes. Any idea how it can be resolved? Thanks

Topics
Management & Governance
Tags
Amazon CloudWatchMonitoringIAM Policies
Language
English

asked a month ago71 views

1 Answer
1
Accepted Answer

If my understanding is right, than it’s sad but true according to the documentation.

The Access Denied error is NOT an IAM policy issue.

The AWS Trusted Advisor API (including trustedadvisor:ListRecommendations and trustedadvisor:ListRecommendationResources) strictly requires an AWS Business, Business Support+, Enterprise On-Ramp, or Enterprise Support plan. -> https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-api-cli.html

If your AWS account is on the Basic or Developer support plan, any call to these APIs will intentionally return an Access Denied exception, regardless of the IAM permissions assigned to the role.

To resolve this, you must either upgrade the AWS Support plan for the account or accept that the Datadog integration cannot fetch Trusted Advisor data.

EXPERT

answered a month ago

EXPERT

reviewed a month ago

  • Alex
    25 days ago

    Thank you so much Florian! That has been wrecking my head for too long! Alex

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content