AWS Cloud Integration

Prerequisites

Step 1: Create Cross-Account IAM Role

Create an IAM role in each target AWS account that trusts the StackFlow account (373544523367):

# Create the cross-account trust policy
cat > trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::373544523367:role/StackFlowCloudDiscoveryRole"},
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {"sts:ExternalId": "stackflow-YOUR_TENANT_ID"}
    }
  }]
}
EOF

# Create the role
aws iam create-role   --role-name StackFlowCrossAccountRole   --assume-role-policy-document file://trust-policy.json

# Attach the read-only discovery policy
aws iam attach-role-policy   --role-name StackFlowCrossAccountRole   --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# For remediation capabilities, use a custom policy instead of ReadOnlyAccess:
aws iam put-role-policy   --role-name StackFlowCrossAccountRole   --policy-name StackFlowRemediation   --policy-document file://stackflow-remediation-policy.json

Step 2: Configure CloudWatch Alarm Routing

1. In each monitored AWS account, create an SNS topic: stackflow-alerts
2. Add an HTTPS subscription pointing to: https://your-instance.stackflow-tech.com/prod/api/webhooks/inbound/cloudwatch
3. Update your CloudWatch Alarms to notify the stackflow-alerts SNS topic

# Create SNS topic and subscription
aws sns create-topic --name stackflow-alerts
aws sns subscribe   --topic-arn arn:aws:sns:us-east-1:YOUR_ACCOUNT:stackflow-alerts   --protocol https   --notification-endpoint https://your-instance.stackflow-tech.com/prod/api/webhooks/inbound/cloudwatch

# Update a CloudWatch alarm to notify StackFlow
aws cloudwatch put-metric-alarm   --alarm-name "HighCPUUtilization"   --alarm-actions arn:aws:sns:us-east-1:YOUR_ACCOUNT:stackflow-alerts   --ok-actions arn:aws:sns:us-east-1:YOUR_ACCOUNT:stackflow-alerts

Step 3: Enable EC2/RDS/Lambda CMDB Sync

StackFlow's cloud discovery uses the cross-account IAM role to enumerate EC2 instances, RDS clusters, Lambda functions, ECS services, and other resource types and creates/updates corresponding CMDB CIs.

{
  "discovery_config": {
    "account_id": "123456789012",
    "role_arn": "arn:aws:iam::123456789012:role/StackFlowCrossAccountRole",
    "regions": ["us-east-1", "us-west-2"],
    "resource_types": ["ec2", "rds", "lambda", "ecs", "eks", "elasticache", "cloudfront"],
    "tag_filters": [{"key": "Environment", "values": ["production"]}],
    "sync_schedule": "0 */2 * * *"
  }
}

Step 4: Connect in StackFlow

1. Navigate to Admin → Integration Hub → AWS Cloud → Add Account
2. Enter the AWS Account ID and the Cross-Account Role ARN
3. Enter the External ID (shown in the setup wizard)
4. Select regions to monitor and resource types to discover
5. Configure CloudWatch alarm-to-incident rules
6. Click Save & Discover to trigger an initial discovery

CloudWatch Alarm to Incident Mapping

CMDB Auto-Discovery

Discovery runs on a configurable schedule (default every 2 hours) and syncs the following resource types to CMDB CIs:

Field Reference

Testing the Integration

1. Click Test IAM Role to verify StackFlow can assume the cross-account role
2. Click Run Discovery Now to trigger an immediate discovery and verify CIs appear in CMDB
3. Trigger a test CloudWatch alarm and verify the StackFlow incident is created

# Manually set a CloudWatch alarm to ALARM state for testing
aws cloudwatch set-alarm-state   --alarm-name "HighCPUUtilization"   --state-value ALARM   --state-reason "Manual test for StackFlow integration"   --region us-east-1

Troubleshooting