Skip to main content

​
Overview

The AWS integration connects AWS accounts to G360. Once configured, G360 securely connects to your AWS environment and collects cloud infrastructure and operational metrics for analysis and reporting. Using this integration, administrators can:
  • Connect AWS accounts with an IAM Role (preferred) or IAM User access keys
  • Collect cloud infrastructure, cost, and operational metrics
  • Organize connections by region and organization
  • Turn collection on or off per connection

​
Prerequisites

Before creating a connection, ensure you have:
  • An AWS account and access to the AWS Management Console. Use the payer or management account where consolidated billing is in use.
  • Permission to create or view IAM Roles and IAM Users
  • An IAM Role or an IAM User with the permissions G360 needs to collect AWS metrics (see Required permissions)
If your organization manages AWS centrally, contact your AWS administrator for these credentials or the permissions to create them.

​
Open AWS Connections

1

Open Integrations

Log in to G360 and click Integrations in the left navigation panel.
2

Open AWS Connections

Scroll down to Cloud Provider Metrics Integrations and click Connect on the AWS Connections card.
The page lists every configured AWS connection: Each row also has a View Data Scopes button that shows the metrics and resource scopes currently collected for that connection. Use the search bar at the top of the page to find a connection by name.

​
Prepare AWS credentials

G360 authenticates to AWS with either an IAM Role (assumed via its ARN) or an IAM User’s access keys, never both. Pick the method that matches how your organization manages AWS access. Complete either step 2 or step 3.
1

Sign in and note the Region

Open the AWS Management Console and sign in. Copy the Region that contains the resources you want G360 to monitor, shown in the upper right corner of the console, for example us-east-1.
2

Option A: create an IAM Role (preferred)

Search for IAM in the console, open Roles, and create a new role, or use one your organization already created for G360.
  • Trust G360’s account via sts:AssumeRole. G360 provides its account ID to reference in the trust policy.
  • Gate the trust with an External ID condition. Choose a long, random string, not a guessable name.
  • Open the role and copy its ARN, for example arn:aws:iam::123456789012:role/G360MonitoringRole.
3

Option B: create an IAM User access key

In IAM → Users, create or select a user and generate a new access key. AWS returns an Access Key ID and a Secret Access Key.
AWS shows the Secret Access Key only once. Copy it immediately and store it securely. If you lose it, generate a new access key.
4

Attach the permissions policy

Attach a customer-managed, read-only policy to the Role or User. See Required permissions.
5

Enable Cost Explorer and cost allocation tags

Enable these before you create the connection in G360:
  • Cost Explorer. It can take up to 24 hours to backfill.
  • Cost allocation tags used for showback. Activate them under Billing → Cost allocation tags. They can take up to 24 hours to activate.
Until Cost Explorer and the tags finish backfilling, the unallocated cost share reads high. This is expected and resolves on its own.

​
Required permissions

Grant the Role or User these permissions in a customer-managed, read-only policy:
Do not drop ec2:DescribeRegions. Every regional step fans out over it. Without it, the sync does not fail. It silently falls back to the single stored region and reports the rest of your AWS estate as empty, successfully, with no error shown anywhere.
Add support:DescribeTrustedAdvisor* only if the account is on a Business or Enterprise Support plan. On Developer or Basic, omit it so the waste view correctly reports the missing support plan instead of an unexplained zero. The Trusted Advisor API is served only from us-east-1, regardless of the connection’s configured region.

​
Create a connection

1

Open the connection dialog

In G360, go to Cloud Provider Metrics → AWS Connections and click Add Connection. The Manage Connections: AWS dialog opens.
2

Enter connection details

3

Set the Active toggle

Turn Active on to start collecting metrics as soon as you save. Disabled connections are saved but collect no metrics until you enable them.
4

Test the connection

Click Test Connection. G360 calls sts:GetCallerIdentity with your credentials, either assuming the Role ARN or authenticating with the access keys. A successful call confirms the credentials are valid. It is also a good sign the Region is reachable, although Test Connection does not check that explicitly.
5

Save the connection

Click Save Connection. The connection appears in the AWS Connections dashboard. If Active is on, metric collection begins immediately.
Test Connection does not confirm that the Role or User has the permissions G360 needs. A missing permission only surfaces once metric collection runs.
The UI does not force Test Connection before Save Connection. You can save without testing, but test first. It is the only way to catch invalid credentials before the connection goes live.
The eye icon on Secret Access Key reveals only what you are typing. After you save, the stored secret cannot be retrieved or revealed again.

​
Manage connections

Click the Edit icon under Actions, update the fields, then click Test Connection and Save Connection. Changes take effect immediately.
Click the Delete icon under Actions and confirm. This removes the integration and stops future metric collection for that account.
Active connections collect metrics on an ongoing basis. Inactive connections stay configured but collect nothing until you enable them again.

​
Synchronization and metrics

Once a connection is saved and Active, G360 collects metrics from the AWS account on an ongoing basis. Click View Data Scopes on a connection to see which metrics and resource scopes it collects. Inactive connections collect nothing.

​
Troubleshooting

Possible causes
  • Wrong Access Key ID or Secret Access Key
  • Invalid IAM Role ARN, or a Role in the wrong account
  • Both a Role ARN and access keys entered
  • Incorrect Region or External ID
  • IAM User or Role deleted or disabled
Actions
  • Recheck the Access Key ID and Secret Access Key, if you use access keys.
  • Confirm the IAM Role ARN is valid and belongs to the correct account, if you use a Role.
  • Use only one method: a Role ARN or access keys.
  • Verify the Region and, if used, the External ID.
  • Confirm the IAM User or Role still exists and is enabled.
Possible causes
  • Connection is not Active
  • Expired credentials
  • Missing IAM permissions (Test Connection does not check these)
  • Wrong Region, or no matching resources in it
Actions
  • Confirm the connection is Active.
  • Confirm the credentials have not expired.
  • Confirm the IAM Role or User has the required permissions, including ec2:DescribeRegions.
  • Confirm the Region is correct and the expected resources exist there.
Possible causes
  • Required fields (marked *) are empty
  • Both a Role ARN and access keys entered
  • The IAM Role or User no longer exists
Actions
  • Fill in all required fields.
  • Enter either a Role ARN or an Access Key ID and Secret Access Key, not both.
  • Confirm the IAM Role and IAM User still exist in AWS.

​
Best practices

  • Use a dedicated IAM Role for G360 instead of sharing administrator credentials.
  • Grant only the permissions required for metric collection, and review IAM permissions regularly.
  • Store access keys securely and rotate them periodically.
  • Use descriptive connection names that identify the AWS environment.
  • Test every connection before saving it.
  • Disable unused connections instead of deleting them if you may need them again.

​
Summary

The AWS integration connects AWS accounts to G360 to collect cloud infrastructure and operational metrics. Prepare an IAM Role (preferred) or access keys with the read-only policy, enable Cost Explorer and cost allocation tags, then create, test, and save the connection to start collecting metrics.