[DOCS-13133] Add IAM troubleshooting to AWS manual setup guide#35353
[DOCS-13133] Add IAM troubleshooting to AWS manual setup guide#35353
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8efb9303de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [6]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html | ||
| [7]: https://aws.amazon.com/blogs/security/easier-way-to-control-access-to-aws-regions-using-iam-policies/ | ||
| [8]: /getting_started/site/ | ||
| [9]: /integrations/guide/error-datadog-not-authorized-sts-assume-role/ |
There was a problem hiding this comment.
This change assigns [9] to the AssumeRole troubleshooting page, but the Access Keys setup section already uses [Partitions][9], so that existing link now points to the wrong document instead of AWS partition guidance. Readers following Access Keys setup will be sent to unrelated IAM troubleshooting content, which breaks the instructions flow.
Useful? React with 👍 / 👎.
| Run the following command from a machine with AWS CLI access to confirm that the role can be assumed: | ||
| ```shell | ||
| aws sts assume-role \ | ||
| --role-arn "arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/DatadogIntegrationRole" \ |
There was a problem hiding this comment.
The new assume-role example hardcodes arn:aws:iam::..., but this same guide supports non-commercial partitions (for example GovCloud in the Role Delegation flow), where the ARN prefix is not arn:aws. Users in those partitions who copy this command will get a failed validation for the wrong reason, which undermines the troubleshooting step.
Useful? React with 👍 / 👎.
Preview links (active after the
|
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Re: partition-agnostic ARN — Applied, replaced hardcoded |
|
Re: link collision — Applied, added missing |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f633aa279b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Run the following command from a machine with AWS CLI access to confirm that the role can be assumed: | ||
| ```shell | ||
| aws sts assume-role \ | ||
| --role-arn "arn:<YOUR_PARTITION>:iam::<YOUR_AWS_ACCOUNT_ID>:role/DatadogIntegrationRole" \ |
There was a problem hiding this comment.
This troubleshooting step tells customers to run aws sts assume-role from their own CLI session and concludes that any failure means the role config is wrong, but in this setup the role trust policy is intentionally limited to Datadog’s AWS account principal (see content/en/integrations/guide/error-datadog-not-authorized-sts-assume-role.md lines 19-31), so customer credentials are typically not allowed to assume the role at all. In that common case the command will fail even when the integration is configured correctly, leading to a false negative and incorrect remediation.
Useful? React with 👍 / 👎.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Re: customer-side AssumeRole validation — Applied, replaced the |
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 participant
What does this PR do? What is the motivation?
Adds a "Troubleshoot IAM role issues" section to the AWS Manual Setup Guide, addressing common IAM-related support ticket themes from DOCS-13133. Covers:
Merge instructions
Merge readiness: