aws-integration

Generate an external ID first, then create an IAM role in AWS with a trust policy using that external ID, and finally create the integration with your account ID, role name, and regions. The process uses role-based authentication, which is required for the V2 API.

Deploy the Datadog Lambda Forwarder in your AWS account, register its ARN with the log integration, then enable the specific services such as s3, elb, and cloudfront. You can verify the configuration asynchronously using the status check commands.

The required permissions depend on collection type: standard metrics, resource collection, or the complete set. You can retrieve the exact permission list formatted as policy statements using the IAM permissions helper command.

V2 uses role-based authentication exclusively and provides a unified configuration structure, while V1 supports legacy access key authentication and separate tag filter endpoints. Migrating to V2 is recommended for better security and future feature support.

Use namespace filters to collect metrics only from services you monitor, and add tag filters to limit collection to tagged resources such as env:production. You can also disable custom metric collection and restrict enabled regions.

This error means the IAM role trust relationship is misconfigured. Verify the role exists, its trust policy includes Datadog's AWS account with the correct external ID, and the required permissions policy is attached.