Docs / Cloud Integrations

Connect AWS

Connect an AWS account via cross-account IAM role assumption (recommended) or static access keys.

awsiamroleexternalidcloudwatchassume role

What you connect

You connect an AWS account so VerOps can read its CloudWatch metrics. The recommended method is IAM role assumption: you create a read-only role in your account that trusts VerOps, and VerOps assumes it on a schedule. You never share an access key.

Prerequisites

  • Permission to create an IAM role in the target AWS account.
  • The AWS regions you want collected (e.g. us-east-1, eu-west-1).
  1. In VerOps, go to Manage → Cloud Integrations and click Connect account.
  2. Choose Amazon Web Services and IAM role assumption. Give it a name and the regions to collect, then Connect.
  3. Open the saved integration and copy its ExternalId — a unique value VerOps generated for this integration.
  4. In AWS, create an IAM role for a trusted account, using VerOps's platform account id (shown in the setup panel) as the principal and the ExternalId as a condition. The trust policy looks like this:
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::<VEROPS_PLATFORM_ACCOUNT_ID>:root" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "<YOUR_EXTERNAL_ID>" } }
  }]
}
  1. Attach a read-only permissions policy to the role — CloudWatch read plus resource tags:
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "cloudwatch:ListMetrics",
      "cloudwatch:GetMetricData",
      "cloudwatch:GetMetricStatistics",
      "tag:GetResources"
    ],
    "Resource": "*"
  }]
}
  1. Paste the role's ARN back into the integration and save.
  2. Click Test connection. A green result means VerOps assumed the role and reached CloudWatch.

Static access keys (fallback)

If you can't create a role, choose Static access keys and supply a read-only IAM user's access key and secret (same permissions as above). VerOps encrypts the secret at rest. We recommend role assumption because it stores no long-lived secret and rotates automatically.

Choosing what to collect

Set the namespaces to a focused list (e.g. AWS/EC2,AWS/RDS,AWS/Lambda) rather than everything — this bounds both your CloudWatch API cost and the number of series. Leave it blank to use a curated default set. You can also restrict to specific metric names.

Tip: CloudWatch GetMetricData is billed per metric requested, on your AWS bill. Start with a small namespace list and a 5-minute interval, then widen as needed.