Skip to content

AWS Cloud Integration Role Authorization Configuration

Through role authorization, you can connect your AWS cloud account to Guance without providing long-term Access Key and Secret Key credentials.

After completing the AWS-side configuration as described in this article, return to Guance, enter the Account ID and role name, then test and save the cloud account.

Before You Begin

  • Prepare the AWS account to connect and confirm whether it belongs to the China Region or the International Region.
  • Make sure you have permission to create IAM roles and attach inline policies to roles in that AWS account. If you do not have the required permissions, contact your AWS administrator for assistance.
  • Make sure you can add a new cloud account in Guance.

This article applies to the role authorization mode, which does not require entering an Access Key or Secret Key.

Step 1. Obtain Authorization Information

  1. In Guance, go to Integrations > Cloud Account Management and create a new AWS cloud account.
  2. In Select Authentication Method, select Role Authorization.
  3. Based on the AWS account to connect, select China Region or International Region.
  4. Copy the Guance Account ID (AWS) and External ID displayed on the page. Keep this page open, as you will need these values for the following configuration.

The Account ID copied here is provided by the Guance platform, not your own AWS Account ID. The External ID is automatically generated by the Guance platform. Do not enter any other value.

Step 2. Select a Trusted Entity in AWS

  1. Sign in to the AWS account to connect. In the IAM console, go to Roles > Create role.
  2. On the Select trusted entity page, set Trusted entity type to AWS account. In the China region console, this is displayed as Amazon Web Services account.
  3. Select Another AWS account. In the China region console, this is displayed as Another Amazon Web Services account.
  4. In Account ID, enter the Guance Account ID (AWS) copied in Step 1, which is the 12-digit Account ID provided by the Guance platform.
  5. Select Require external ID, and in External ID, paste the value copied from the current cloud account configuration page in Step 1.
  6. Verify the Account ID and External ID, then click Next to proceed to the Add permissions page.

The Account ID here is the AWS Account ID provided by the Guance platform. When you return to the Guance platform to enter cloud account information, you should enter the AWS Account ID of the account where you created the role.

Step 3. Add an Inline Policy and Create the Role

  1. On the Add permissions page, select Create inline policy.

  2. Expand the content below, copy the complete JSON, and replace the default content in the policy editor.

    Expand the collection permission policy JSON 
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "account:GetAccountInformation",
        "acm:ListCertificates",
        "airflow:GetEnvironment",
        "airflow:ListEnvironments",
        "aoss:ListCollections",
        "apigateway:GET",
        "appsync:ListGraphqlApis",
        "appsync:ListTagsForResource",
        "autoscaling:Describe*",
        "aws-portal:ViewBilling",
        "backup:DescribeBackupVault",
        "backup:List*",
        "batch:DescribeJobDefinitions",
        "batch:DescribeJobQueues",
        "batch:DescribeJobs",
        "batch:ListJobs",
        "bcm-data-exports:GetExport",
        "bcm-data-exports:ListExports",
        "budgets:ViewBudget",
        "ce:GetCostAndUsageWithResources",
        "ce:GetDimensionValues",
        "cloudfront:GetDistributionConfig",
        "cloudfront:ListDistributions",
        "cloudfront:ListTagsForResource",
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrail",
        "cloudtrail:GetTrailStatus",
        "cloudtrail:ListTrails",
        "cloudtrail:LookupEvents",
        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "codebuild:BatchGetProjects",
        "codebuild:ListProjects",
        "codedeploy:BatchGet*",
        "codedeploy:List*",
        "cognito-idp:DescribeUserPool",
        "cognito-idp:ListUserPools",
        "cost-optimization-hub:GetRecommendation",
        "cost-optimization-hub:ListRecommendations",
        "cur:DescribeReportDefinitions",
        "dax:DescribeClusters",
        "directconnect:Describe*",
        "dms:DescribeReplicationInstances",
        "dms:DescribeReplicationTasks",
        "dms:ListTagsForResource",
        "dsql:GetCluster",
        "dsql:ListClusters",
        "dsql:ListTagsForResource",
        "dynamodb:Describe*",
        "dynamodb:List*",
        "ec2:Describe*",
        "ecr:DescribeRepositories",
        "ecs:Describe*",
        "ecs:List*",
        "eks:DescribeCluster",
        "eks:ListClusters",
        "elasticache:Describe*",
        "elasticache:List*",
        "elasticbeanstalk:DescribeEnvironments",
        "elasticfilesystem:DescribeAccessPoints",
        "elasticfilesystem:DescribeFileSystems",
        "elasticfilesystem:DescribeTags",
        "elasticloadbalancing:Describe*",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:List*",
        "es:DescribeDomains",
        "es:DescribeElasticsearchDomains",
        "es:ListDomainNames",
        "es:ListTags",
        "events:CreateEventBus",
        "events:ListRules",
        "firehose:DescribeDeliveryStream",
        "firehose:ListDeliveryStreams",
        "fsx:DescribeFileSystems",
        "fsx:ListTagsForResource",
        "globalaccelerator:ListAccelerators",
        "glue:BatchGetJobs",
        "glue:GetJob",
        "glue:GetJobRuns",
        "glue:GetJobs",
        "glue:ListJobs",
        "health:DescribeAffectedEntities",
        "health:DescribeEventDetails",
        "health:DescribeEvents",
        "healthlake:DescribeFHIRDatastore",
        "healthlake:ListFHIRDatastores",
        "healthlake:ListTagsForResource",
        "iam:GetAccountAuthorizationDetails",
        "iam:GetLoginProfile",
        "iam:GetPolicyVersion",
        "iam:GetRole",
        "iam:ListAccountAliases",
        "iam:ListAttachedRolePolicies",
        "iam:ListAttachedUserPolicies",
        "iam:ListGroupsForUser",
        "iam:ListMFADevices",
        "iam:ListPolicies",
        "iam:ListPolicyTags",
        "iam:ListRoleTags",
        "iam:ListSSHPublicKeys",
        "iam:ListUserTags",
        "iam:ListUsers",
        "iam:ListVirtualMFADevices",
        "iot:GetV2LoggingOptions",
        "kafka:ListClustersV2",
        "kafkaconnect:DescribeConnector",
        "kafkaconnect:ListConnectors",
        "kinesis:Describe*",
        "kinesis:List*",
        "kinesisanalytics:ListApplications",
        "kms:DescribeKey",
        "kms:ListKeys",
        "lambda:GetFunctionConfiguration",
        "lambda:GetMicrovmImageVersion",
        "lambda:List*",
        "logs:DeleteSubscriptionFilter",
        "logs:DescribeDeliveries",
        "logs:DescribeDeliverySources",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:DescribeSubscriptionFilters",
        "logs:FilterLogEvents",
        "logs:GetDeliveryDestination",
        "logs:ListTagsForResource",
        "logs:PutSubscriptionFilter",
        "logs:TestMetricFilter",
        "memorydb:DescribeClusters",
        "memorydb:ListTags",
        "mq:ListBrokers",
        "network-firewall:DescribeFirewall",
        "network-firewall:DescribeLoggingConfiguration",
        "network-firewall:ListFirewalls",
        "oam:ListAttachedLinks",
        "oam:ListSinks",
        "organizations:Describe*",
        "organizations:List*",
        "pcs:ListClusters",
        "pcs:ListComputeNodeGroups",
        "pcs:ListQueues",
        "rds:Describe*",
        "rds:List*",
        "redshift-serverless:ListNamespaces",
        "redshift-serverless:ListTagsForResource",
        "redshift-serverless:ListWorkgroups",
        "redshift:DescribeClusters",
        "redshift:DescribeLoggingStatus",
        "route53:List*",
        "route53resolver:ListResolverQueryLogConfigs",
        "s3:GetBucketAcl",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetBucketNotification",
        "s3:GetBucketPolicy",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetEncryptionConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetObject",
        "s3:GetReplicationConfiguration",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:PutBucketNotification",
        "sagemaker:DescribeEndpoint",
        "sagemaker:ListEndpoints",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecrets",
        "ses:Get*",
        "ses:List*",
        "sns:GetSubscriptionAttributes",
        "sns:GetTopicAttributes",
        "sns:List*",
        "sns:Publish",
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl",
        "sqs:ListQueueTags",
        "sqs:ListQueues",
        "ssm:GetServiceSetting",
        "ssm:ListCommands",
        "states:DescribeStateMachine",
        "states:ListStateMachines",
        "states:ListTagsForResource",
        "storagegateway:DescribeGatewayInformation",
        "storagegateway:DescribeNFSFileShares",
        "storagegateway:DescribeSMBFileShares",
        "storagegateway:ListFileShares",
        "storagegateway:ListGateways",
        "support:DescribeTrustedAdvisor*",
        "support:RefreshTrustedAdvisorCheck",
        "tag:GetResources",
        "tag:GetTagKeys",
        "tag:GetTagValues",
        "timestream:DescribeEndpoints",
        "trustedadvisor:ListRecommendationResources",
        "trustedadvisor:ListRecommendations",
        "wafv2:GetWebACL",
        "wafv2:ListLoggingConfigurations",
        "wafv2:ListWebACLs",
        "xray:BatchGetTraces",
        "xray:GetTraceSummaries"
      ],
      "Resource": "*"
    }
  ]
}

    The above is the complete permission list required for basic collection. Copy it in full.

  3. Review the permission scope as prompted on the AWS page. Resolve any errors or security warnings, then click Next. If you are unsure whether it meets your organization's requirements, contact your AWS administrator for review.

  4. On the Name, review, and create page, enter a role name as prompted by the page, for example CloudIntegrationRole. Review the configuration and click Create role.
  5. Note the created role name and the AWS Account ID of the account it belongs to. You will enter them in the next step.

Step 4. Return to the Guance Platform and Enter Account Information

Return to the cloud account configuration page kept in Step 1 and fill in the following information:

Configuration Item Description
Account ID Enter your own AWS Account ID, which is the account where you created the role in Step 3. Do not enter the Guance platform Account ID shown at the top of the page.
Role Name Enter the role name created in Step 3, for example CloudIntegrationRole. You do not need to enter the full role ARN.
Account Alias Enter a name that makes this cloud account easy to identify. Collected data will also carry this alias.
Account Tags Add tag names and values as needed, for example, name env and value production, then click Add. You can leave this blank if not needed. For naming rules, see Account Tags.

Step 5. Test and Save

  1. Click Test to check the current authorization configuration.
  2. After the test passes, click Save.
  3. Follow the instructions in Configure Integrations to install the required AWS integrations and check whether data is being reported.

After saving the cloud account, you still need to install the corresponding integrations before data collection can begin.

FAQ

What should I do if the test fails?

First check the following information, correct any issues, and test again:

  • Whether the correct region is selected.
  • Whether the Account ID is the AWS Account ID of the account where you created the role.
  • Whether the role name matches the one in AWS.
  • Whether the Account ID in the role's trust relationship is the Guance platform AWS Account ID for the selected region.
  • Whether Require external ID is selected and whether the External ID entered exactly matches the one on the current cloud account configuration page.

If it still fails, provide the specific error message to your AWS administrator or Guance support staff for troubleshooting.

Why is no data collected after the test passes?

Make sure the corresponding AWS integration is installed and enabled, the correct collection region is selected, and you have attached the complete collection permission inline policy to the role in Step 3. If collection reports an insufficient permissions error, contact your AWS administrator to investigate based on the specific error.

What should I do after regenerating the External ID?

The External ID in the AWS role trust policy also needs to be updated accordingly. If the two sides do not match, subsequent authorization may fail and affect collection. For accounts already collecting data, contact Guance support staff first to confirm the update steps.

Feedback

Is this page helpful?