AWS - Resolve AI

Set up a secure, temporary-access IAM role in your AWS account so Resolve can read required metrics, logs, and events for troubleshooting—without storing long-lived credentials. This role is global and can be used across multiple AWS regions you choose to allow.

Private VPC / Self-Hosted? If your CloudWatch logs are in a private VPC that Resolve cannot reach directly, you can use the Resolve Satellite to securely proxy queries. See the Satellite Setup section below.

In Resolve, Create an AWS Integration

Log in to Resolve AI
Open the AWS Integration
Click Add Connection
Click View Instructions to see a short guide with custom instructions for your account

In AWS, Create a new IAM Role

In your AWS account, create a new IAM role resolve-access-role
Set the Trust Relationship:
- Target Account: (from Resolve UI)
- External ID: Specify an ID of your choosing
Attach Required Policies:
Copy the Role ARN from the IAM console on the role’s detail page and External ID set in the trust relationship, and paste them into the Resolve UI.

(Optional) To enable Athena SQL queries on S3 data, see AWS Athena Setup.

In Resolve, Configure the Integration

Name the connection, ex. “Production AWS”
Specify one or more target Region(s)
Enter the External ID
The Role ARN was set in the step above
The External ID used to securely assume the IAM role
CloudWatch Log Group Allow List lets you define a restricted list of CloudWatch Log Group names that Resolve can query

Sample Trust Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::590183716134:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<id>"
                }
            }
        }
    ]
}

Connect Via Satellite

If your AWS resources are in a private VPC that Resolve cannot reach directly, use the Resolve Satellite to securely proxy CloudWatch queries.

Prerequisite: The Resolve Satellite should already be installed in your environment. See Resolve Satellite for installation instructions.

1. Create Kubernetes Secret

Create a Kubernetes secret containing your AWS credentials with CloudWatch read access.

secret creation

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: cloudwatch-resolve-credentials
stringData:
  accessKeyId: "<your AWS access key ID>"
  secretAccessKey: "<your AWS secret access key>"

Apply the secret:

apply secret

kubectl apply -f cloudwatch-resolve-credentials.yml

2. Update Values File

Add the CloudWatch integration to your resolve-values.yaml:

resolve-values.yaml

integrations:
  cloudwatchOnPrem:
    type: cloudwatch
    create: true
    secretName: "cloudwatch-resolve-credentials"
    connection:
      region: us-east-1  # Your AWS region
      logGroupName: "/aws/lambda/my-function"  # Optional: specific log group

3. Apply Changes

Update the satellite with the new configuration:

helm upgrade --install resolve-satellite \
  oci://registry-1.docker.io/resolveaihq/satellite-chart \
  --values resolve-values.yaml

4. Verify Integration

Open the AWS Integration page in Resolve to verify the connection.

​In Resolve, Create an AWS Integration

​In AWS, Create a new IAM Role

​In Resolve, Configure the Integration

​Sample Trust Policy

​Connect Via Satellite

​1. Create Kubernetes Secret

​2. Update Values File

​3. Apply Changes

​4. Verify Integration

In Resolve, Create an AWS Integration

In AWS, Create a new IAM Role

In Resolve, Configure the Integration

Sample Trust Policy

Connect Via Satellite

1. Create Kubernetes Secret

2. Update Values File

3. Apply Changes

4. Verify Integration