AWS

HealOps uses AWS to map your environment: Lambda functions, EKS clusters, S3 buckets, and more. It reads infrastructure state to build investigation context when cloud-related alerts fire.

Prerequisites

AWS account with IAM permissions
Either a role ARN (recommended) or static access keys

Setup

Option 1: Interactive CLI

healops integrations setup

Select AWS when prompted and provide your credentials.

Option 2: Environment variables (IAM role)

AWS_ROLE_ARN=arn:aws:iam::123456789012:role/HealOpsReadOnly
AWS_EXTERNAL_ID=your-external-id     # optional
AWS_REGION=us-east-1

Option 3: Environment variables (static keys)

AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
AWS_SESSION_TOKEN=...                # optional, for temporary credentials
AWS_REGION=us-east-1

Variable	Default	Description
`AWS_ROLE_ARN`	—	IAM role to assume (recommended)
`AWS_EXTERNAL_ID`	—	External ID for role assumption
`AWS_REGION`	`us-east-1`	AWS region
`AWS_ACCESS_KEY_ID`	—	Static access key (if not using role)
`AWS_SECRET_ACCESS_KEY`	—	Static secret key
`AWS_SESSION_TOKEN`	—	Session token for temporary credentials

Either AWS_ROLE_ARN or AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY is required.

IAM permissions

HealOps requires read-only access. Attach the following managed policies to the IAM role or user:

ReadOnlyAccess (AWS managed) — or a custom policy scoped to the services you want HealOps to inspect

For least-privilege, the minimum services used are:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "ec2:Describe*",
        "ecs:Describe*",
        "ecs:List*",
        "eks:Describe*",
        "eks:List*",
        "lambda:List*",
        "lambda:Get*",
        "s3:ListBucket",
        "s3:GetObject",
        "logs:FilterLogEvents",
        "logs:GetLogEvents",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics"
      ],
      "Resource": "*"
    }
  ]
}

Verify

healops integrations verify aws

Expected output:

Service: aws
Status: passed
Detail: Authenticated via assume-role in us-east-1 as arn:aws:iam::123456789012:role/HealOpsReadOnly (account 123456789012)

Troubleshooting

Symptom	Fix
AccessDenied on STS	Ensure the caller has `sts:AssumeRole` permission on the target role
InvalidClientTokenId	Check that `AWS_ACCESS_KEY_ID` is correct and the key is active
Could not connect to endpoint	Check `AWS_REGION` and network connectivity
ExpiredTokenException	Refresh your session token or rotate the access key

Security best practices

Use IAM roles instead of static keys wherever possible.
Scope IAM permissions to only the AWS services HealOps needs to inspect.
Rotate static access keys regularly.
Enable CloudTrail so all HealOps API calls are auditable.

Overview

LLM providers

Observability and incidents

Cloud, code, and collaboration

Messaging

Data and workflow systems

Prerequisites

Setup

Option 1: Interactive CLI

Option 2: Environment variables (IAM role)

Option 3: Environment variables (static keys)

IAM permissions

Verify

Troubleshooting

Security best practices

​Prerequisites

​Setup

​Option 1: Interactive CLI

​Option 2: Environment variables (IAM role)

​Option 3: Environment variables (static keys)

​IAM permissions

​Verify

​Troubleshooting

​Security best practices

Prerequisites

Setup

Option 1: Interactive CLI

Option 2: Environment variables (IAM role)

Option 3: Environment variables (static keys)

IAM permissions

Verify

Troubleshooting

Security best practices