# Adding AWS Integration with a Backend on Another Cloud Provider

If your groundcover backend is installed on a cloud provider other than AWS, you can still add AWS integration by allocating an AWS cluster and configuring the sensor to run the AWS integration.

### Prerequisite

The below steps assume you have an AWS Kubernetes cluster with groundcover sensor installed on it.

### Step 1: Create an IAM role and policy

1. Go to[ Amazon IAM](https://console.aws.amazon.com/iam/)
2. Click on **Roles** in the side bar
3. Click on **Create Role**
   1. Select **Custom trust policy**
   2. Paste the following policy:<br>

      ```json
      {   
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "Federated": "<EKS cluster OIDC ARN>"
                  },
                  "Action": "sts:AssumeRoleWithWebIdentity",
                  "Condition": {
                      "StringLike": {
                          "<EKS cluster OIDC>:sub": "system:serviceaccount:<groundcover sensor namespace>:integrations-agent"
                      }
                  }
              }
          ]
      }
      ```
   3. Click on **Next** twice (we'll attach permissions later)
   4. Provide a name for the role
   5. Click on **Create Role**
4. Go to your newly created role
   1. In the **Permissions** section, click on **Add permissions** and then **Create inline policy**
   2. Click on **JSON** and paste the following:\ <br>

      <pre class="language-json"><code class="lang-json"><strong>{
      </strong><strong>    "Version": "2012-10-17",
      </strong>    "Id": "groundcover-integrations-agent",
          "Statement": [
              {
                  "Action": [
                      "tag:GetResources",
                      "storagegateway:ListTagsForResource",
                      "storagegateway:ListGateways",
                      "shield:ListProtections",
                      "iam:ListAccountAliases",
                      "ec2:DescribeTransitGatewayAttachments",
                      "ec2:DescribeSpotFleetRequests",
                      "dms:DescribeReplicationTasks",
                      "dms:DescribeReplicationInstances",
                      "cloudwatch:ListMetrics",
                      "cloudwatch:GetMetricStatistics",
                      "cloudwatch:GetMetricData",
                      "autoscaling:DescribeAutoScalingGroups",
                      "aps:ListWorkspaces",
                      "apigateway:GET",
                      "s3:ListAllMyBuckets",
                      "s3:GetBucketLocation",
                      "s3:GetBucketTagging",
                      "sqs:ListQueues",
                      "sqs:GetQueueAttributes",
                      "rds:DescribeDBInstances",
                      "rds:DescribeDBClusters",
                      "lambda:ListFunctions",
                      "elasticache:DescribeCacheClusters",
                      "elasticache:DescribeServerlessCaches",
                      "elasticloadbalancing:DescribeLoadBalancers",
                      "dynamodb:ListTables",
                      "dynamodb:ListTagsOfResource",
                      "dynamodb:DescribeTable",
                      "airflow:GetEnvironment",
                      "airflow:ListEnvironments",
                      "ecs:ListClusters",
                      "ecs:DescribeClusters",
                      "ecs:ListServices",
                      "ecs:DescribeServices",
                      "ecs:ListTasks",
                      "ecs:DescribeTasks",
                      "es:ListDomainNames",
                      "cloudfront:ListDistributions"
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
              }
          ]
      }
      </code></pre>
   3. Click on **Next**
   4. Give the policy a name
   5. Click on **Create Policy**

### Step 2: Configure AWS Integration

Add the following values to sensor helm values:

```yaml
global:
  integrations:
    agent:
      enabled: true
integrationsAgent:
  serviceAccount:
    annotations:
      "eks.amazonaws.com/role-arn": <role ARN created in step 1>
  targets:
    cloudwatch:
      - name: <give a meaningful name for your integration>
        stsRegion: <AWS STS region>
        interval: 5m
        regions:
          - <list of AWS regions>
        namespaces:
          - <list of AWS namespaces from https://docs.groundcover.com/integrations/data-sources/aws/ingest-cloudwatch-metrics#supported-aws-services>
        roleArn: <role created in step 1>
        extraLabels:
          environment: "prod" # optional
    awsInventory: # add this to add auto discovery of AWS resources 
      - name: "aws-inventory"
        enabled: true
        stsRegion: <AWS STS region>
        roleArns:
          - <list ofrole ARNs>
        regions:
          - <list of AWS regions>
        interval: 5m
        namespaces:
          - <list of AWS namespaces from https://docs.groundcover.com/integrations/data-sources/aws/ingest-cloudwatch-metrics#supported-aws-services:~:text=List%2Dbased%20discovery>  

```

### Verification

After 5 minutes, data collection should happen at least once and you could monitor your integration:

1. Navigate to the [Data Explorer page](https://app.groundcover.com/explore/data-explorer), search for the following metric `groundcover_data_sources_collected_entries_total.` The number of returned results should match the expected number of results.
2. Navigate to the [Traces page](https://app.groundcover.com/traces) and apply the following filter `source:groundcover-platform integration.name:<your integration name>`. The page will show the latest results of running the integration. In case of errors, open the trace to see more details.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.groundcover.com/integrations/data-sources/aws/adding-aws-integration-with-a-backend-on-another-cloud-provider.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.