> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

Set up a secure, temporary-access IAM role in your AWS account so Resolve can read required metrics, logs, and events for troubleshooting—without storing long-lived credentials. This role is global and can be used across multiple AWS regions you choose to allow.

<Info>
  **Private VPC / Self-Hosted?** If your CloudWatch logs are in a private VPC that Resolve cannot reach directly, you can use the [Resolve Satellite](/resolve-satellite) to securely proxy queries. See the [Satellite Setup](#connect-via-satellite) section below.
</Info>

### In Resolve, Create an AWS Integration

1. Log in to [ResolveAI](https://app0.resolve.ai/)
2. Open the [AWS Integration](https://app0.resolve.ai/integrations/aws/connect)
3. Click **Add Connection**
4. Click **View Instructions** to see a short guide with custom instructions for your account

### In AWS, Create a new IAM Role

1. In your AWS account, create a new IAM role `resolve-access-role`
2. Set the Trust Relationship:
   * Target Account: (from Resolve UI)
   * External ID: Specify an ID of your choosing
3. Attach Required Policies:
   * [`SecurityAudit`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SecurityAudit.html)
   * [`CloudWatchReadOnlyAccess`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchReadOnlyAccess.html)
   * [`AmazonRDSReadOnlyAccess`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRDSReadOnlyAccess.html)
   * [`IAMReadOnlyAccess`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/IAMReadOnlyAccess.html)
4. Copy the **Role ARN** from the IAM console on the role's detail page and **External ID** set in the trust relationship, and paste them into the Resolve UI.

<Info>
  **(Optional)** To enable Athena SQL queries on S3 data, see [AWS Athena Setup](/aws-athena).
</Info>

### In Resolve, Configure the Integration

1. **Name** the connection, ex. "Production AWS"
2. Specify one or more target **Region(s)**
3. Enter the **External ID**
4. The **Role ARN** was set in the step above
5. The **External ID** used to securely assume the IAM role
6. **CloudWatch Log Group Allow List** lets you define a restricted list of CloudWatch Log Group names that Resolve can query

## CloudWatch alarms as an alert source

Once the AWS integration is connected, Resolve ingests CloudWatch alarm state transitions as alerts, alongside alerts from any other connected source. You can then filter these alerts and auto-investigate them.

To set up auto-investigation for CloudWatch alarms:

1. Open **Investigations → Alerts** and confirm your CloudWatch alarms appear in the list.
2. In the relevant team's **Alerts** configuration, create a filter that matches the alarms you care about (for example, by severity, alarm name, or service).
3. Open the saved filter, enable **auto-investigate**, and pick a mode (Triage, Adaptive, or Investigation).
4. To get automatic replies in Slack or MS Teams, add the channel the alarms land in and set its channel type to **Alert**.

For the full alert filter and mode setup, see [Auto Investigations](/auto-investigations) and [Alert Investigation Modes](/alert-investigation-modes).

#### Sample Trust Policy

```javascript theme={null}
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::590183716134:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<id>"
                }
            }
        }
    ]
}
```

***

## Connect Via Satellite

If your AWS resources are in a private VPC that Resolve cannot reach directly, use the [Resolve Satellite](/resolve-satellite) to securely proxy CloudWatch queries.

<Info>
  **Prerequisite**: The Resolve Satellite should already be installed in your environment. See [Resolve Satellite](/resolve-satellite) for installation instructions.
</Info>

### 1. Create Kubernetes Secret

Create a Kubernetes secret containing your AWS credentials with CloudWatch read access.

```yaml secret creation theme={null}
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: cloudwatch-resolve-credentials
stringData:
  accessKeyId: "<your AWS access key ID>"
  secretAccessKey: "<your AWS secret access key>"
```

Apply the secret:

```shell apply secret theme={null}
kubectl apply -f cloudwatch-resolve-credentials.yml
```

### 2. Update Values File

Add the CloudWatch integration to your `resolve-values.yaml`:

```yaml resolve-values.yaml theme={null}
integrations:
  cloudwatchOnPrem:
    type: cloudwatch
    create: true
    secretName: "cloudwatch-resolve-credentials"
    connection:
      region: us-east-1  # Your AWS region
      logGroupName: "/aws/lambda/my-function"  # Optional: specific log group
```

### 3. Apply Changes

Update the satellite with the new configuration:

```shell theme={null}
helm upgrade --install resolve-satellite \
  oci://registry-1.docker.io/resolveaihq/satellite-chart \
  --values resolve-values.yaml
```

### 4. Verify Integration

Open the [AWS Integration](https://app0.resolve.ai/integrations/aws) page in Resolve to verify the connection.