AWS - ResolveAI

Set up a secure, temporary-access IAM role in your AWS account so Resolve can read required metrics, logs, and events for troubleshooting—without storing long-lived credentials. This role is global and can be used across multiple AWS regions you choose to allow.

Private VPC / Self-Hosted? If your CloudWatch logs are in a private VPC that Resolve cannot reach directly, you can use the Resolve Satellite to securely proxy queries. See the Satellite Setup section below.

In Resolve, Create an AWS Integration

Log in to ResolveAI
Open the AWS Integration
Click Add Connection
Click View Instructions to see a short guide with custom instructions for your account

In AWS, Create a new IAM Role

In your AWS account, create a new IAM role resolve-access-role
Set the Trust Relationship:
- Target Account: (from Resolve UI)
- External ID: Specify an ID of your choosing
Attach Required Policies:
Copy the Role ARN from the IAM console on the role’s detail page and External ID set in the trust relationship, and paste them into the Resolve UI.

(Optional) To enable Athena SQL queries on S3 data, see AWS Athena Setup.

In Resolve, Configure the Integration

Name the connection, ex. “Production AWS”
Specify one or more target Region(s)
Enter the External ID
The Role ARN was set in the step above
The External ID used to securely assume the IAM role
CloudWatch Log Group Allow List lets you define a restricted list of CloudWatch Log Group names that Resolve can query

CloudWatch alarms as an alert source

Once the AWS integration is connected, Resolve ingests CloudWatch alarm state transitions as alerts, alongside alerts from any other connected source. You can then filter these alerts and auto-investigate them. To set up auto-investigation for CloudWatch alarms:

Open Investigations → Alerts and confirm your CloudWatch alarms appear in the list.
In the relevant team’s Alerts configuration, create a filter that matches the alarms you care about (for example, by severity, alarm name, or service).
Open the saved filter, enable auto-investigate, and pick a mode (Triage, Adaptive, or Investigation).
To get automatic replies in Slack or MS Teams, add the channel the alarms land in and set its channel type to Alert.

For the full alert filter and mode setup, see Auto Investigations and Alert Investigation Modes.

Sample Trust Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::590183716134:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<id>"
                }
            }
        }
    ]
}

Connect Via Satellite

If your AWS resources are in a private VPC that Resolve cannot reach directly, use the Resolve Satellite to securely proxy CloudWatch queries.

Prerequisite: The Resolve Satellite should already be installed in your environment. See Resolve Satellite for installation instructions.

1. Create Kubernetes Secret

Create a Kubernetes secret containing your AWS credentials with CloudWatch read access.

secret creation

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: cloudwatch-resolve-credentials
stringData:
  accessKeyId: "<your AWS access key ID>"
  secretAccessKey: "<your AWS secret access key>"

Apply the secret:

apply secret

kubectl apply -f cloudwatch-resolve-credentials.yml

2. Update Values File

Add the CloudWatch integration to your resolve-values.yaml:

resolve-values.yaml

integrations:
  cloudwatchOnPrem:
    type: cloudwatch
    create: true
    secretName: "cloudwatch-resolve-credentials"
    connection:
      region: us-east-1  # Your AWS region
      logGroupName: "/aws/lambda/my-function"  # Optional: specific log group

3. Apply Changes

Update the satellite with the new configuration:

helm upgrade --install resolve-satellite \
  oci://registry-1.docker.io/resolveaihq/satellite-chart \
  --values resolve-values.yaml

4. Verify Integration

Open the AWS Integration page in Resolve to verify the connection.

​In Resolve, Create an AWS Integration

​In AWS, Create a new IAM Role

​In Resolve, Configure the Integration

​CloudWatch alarms as an alert source

​Sample Trust Policy

​Connect Via Satellite

​1. Create Kubernetes Secret

​2. Update Values File

​3. Apply Changes

​4. Verify Integration

In Resolve, Create an AWS Integration

In AWS, Create a new IAM Role

In Resolve, Configure the Integration

CloudWatch alarms as an alert source

Sample Trust Policy

Connect Via Satellite

1. Create Kubernetes Secret

2. Update Values File

3. Apply Changes

4. Verify Integration