> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opsbeacon.co/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Integration

> How OpsBeacon connects to AWS and what it reads from each service.

## Connection method

OpsBeacon connects to your AWS account via a **cross-account IAM role** with read-only permissions. There are no access keys or long-lived credentials. See [Connect Your AWS Account](https://docs.opsbeacon.co/getting-started/connect-aws.md) for setup instructions.

## AWS services used

### AWS Cost Explorer

Used for all cost analysis, anomaly detection, and forecasting. Requires `ce:*` read permissions.

**Data OpsBeacon reads:**

* Daily and monthly spend by service, region, account, and usage type
* Cost forecasts
* Reserved Instance and Savings Plan utilization and coverage

### AWS Trusted Advisor

Used for savings recommendations and cost optimization findings.

**Requirements:** Business, Enterprise On-Ramp, or Enterprise support plan. Trusted Advisor check results are not available on Developer or Basic support plans.

**Data OpsBeacon reads:**

* Cost optimization checks (idle resources, underutilized instances, etc.)
* Security checks (exposed access keys, unrestricted ports, etc.)

### AWS GuardDuty

Used for the Security Economics Report threat detection findings.

**Requirements:** GuardDuty must be enabled in the regions you want analyzed. If GuardDuty is not enabled, OpsBeacon will flag this as a finding.

**Data OpsBeacon reads:**

* Active findings with severity, type, and resource details

### AWS Security Hub

Used for aggregated security findings across your environment.

**Requirements:** Security Hub must be enabled. If Security Hub is not enabled, OpsBeacon will flag this as a finding.

**Data OpsBeacon reads:**

* Active findings from all connected Security Hub integrations

## Multi-account setups

For organizations using AWS Organizations or multiple accounts, contact support for guidance on connecting multiple accounts. Each account requires its own IAM role.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.