# AWS

This reference assumes you've already created a Chassy workspace. If you have yet to do this, it is recommended you [create-a-workspace](https://docs.chassy.io/getting-started/create-a-workspace "mention") first.

The AWS integration is one of a number of Cloud Services Chassy natively supports. By enabling the integration, Chassy is able to import artifacts from specific S3 buckets and publish logs ingested from your machines to S3, Cloudwatch on your behalf automatically.

{% embed url="<https://www.youtube.com/watch?v=b6jht03e8pU>" %}
AWS Integration video tutorial
{% endembed %}

{% hint style="info" %}
Only an Admin or Manager is allowed to manage integrations
{% endhint %}

## How to setup AWS integration

On the Chassy console, navigate to the *Integrations* panel. Here, you will see a list of Chassy's available integrations among which will be the AWS integration.

<figure><img src="https://2391222196-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbwi13HaBqeFSGqsnJ8aD%2Fuploads%2FCNrLJJw2CWYTj7MY5k1k%2Fimage.png?alt=media&#x26;token=46e456ca-e1c3-42db-9ac7-3e6620950530" alt="The Integrations panel shows cards of all the available integrations."><figcaption></figcaption></figure>

On clicking *Connect*, you will be presented with a dialog asking for a client role ARN and providing you with an external ID and account ID.

<figure><img src="https://2391222196-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbwi13HaBqeFSGqsnJ8aD%2Fuploads%2FgBdK89mY1RBeA2U4RrhP%2Fimage.png?alt=media&#x26;token=393b2a2e-ad37-40f2-980f-8b4c83d56c98" alt=""><figcaption><p>Conect AWS Integration Dialog</p></figcaption></figure>

To continue, you will need to create a new IAM role on AWS. The required permissions are specified below in either JSON or Terraform and explained in the following table:

| Service    | Permissions | Reason                                                                                       |
| ---------- | ----------- | -------------------------------------------------------------------------------------------- |
| S3         | Read        | Allows you to import artifacts from S3 into the Chassy Index                                 |
| ECR        | Read        | Allows you to import container images from ECR into the Chassy Index                         |
| Cloudwatch | Read, Write | Allows you to push telemetry data into Cloudwatch and analyze telemetry data from Cloudwatch |

{% hint style="info" %}
The `Resource` values listed need to be replaced with values that fit your needs.
{% endhint %}

{% tabs %}
{% tab title="JSON" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3ReadPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:Describe*",
        "s3:List*"
      ],
      "Resource": "arn:aws:s3:::<BUCKET_NAME>"
    },
    {
      "Sid": "ECRReadPermissions",
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGet*",
        "ecr:List*",
        "ecr:Describe*",
        "ecr:Get*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudwatchLogsReadPermissions",
      "Effect": "Allow",
      "Action": [
        "logs:Get*",
        "logs:Describe*",
        "logs:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudwatchLogsWritePermissions",
      "Effect": "Allow",
      "Action": [
        "logs:Put*",
        "logs:Create*"
      ],
      "Resource": "*"
    }
  ]
}
```

{% endtab %}

{% tab title="Terraform" %}
You will need to create a policy.

```hcl
resource "aws_iam_policy" "policy"  
  name        = "policy_name"
  path        = "/"
  description = "My Chassy permission policy"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3ReadPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:Describe*",
        "s3:List*"
      ],
      "Resource": "arn:aws:s3:::<BUCKET_NAME>"
    },
    {
      "Sid": "ECRReadPermissions",
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGet*",
        "ecr:List*",
        "ecr:Describe*",
        "ecr:Get*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudwatchLogsReadPermissions",
      "Effect": "Allow",
      "Action": [
        "logs:Get*",
        "logs:Describe*",
        "logs:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudwatchLogsWritePermissions",
      "Effect": "Allow",
      "Action": [
        "logs:Put*",
        "logs:Create*"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}
```

{% endtab %}
{% endtabs %}

After creating your role, copy the ARN of the role and paste it into the input on the Chassy console. After clicking *connect*, you should see a success message and the AWS integration should say "connected" in the *Integrations* panel.

<figure><img src="https://2391222196-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbwi13HaBqeFSGqsnJ8aD%2Fuploads%2F2yMocmW9lZ99gM1BvdAN%2Fimage.png?alt=media&#x26;token=fa6403cc-7a49-42b6-a404-e039b72cea2c" alt=""><figcaption></figcaption></figure>

## How to remove AWS integration

The AWS integration can be removed by navigating to the *Integrations* panel and clicking the *X* button next to the AWS integration.&#x20;

<figure><img src="https://2391222196-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbwi13HaBqeFSGqsnJ8aD%2Fuploads%2FRgpwF4nlsM4P9t6DNNAY%2Fimage.png?alt=media&#x26;token=96bab3f7-6960-4c7c-a0b8-7b63d956ad4b" alt=""><figcaption></figcaption></figure>

You will then be asked to confirm this choice in a dialog box as it is a destructive action.

<figure><img src="https://2391222196-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbwi13HaBqeFSGqsnJ8aD%2Fuploads%2Fl1mWqFJNTRB3C2hoUQVa%2Fimage.png?alt=media&#x26;token=12ae47bf-857c-4327-93bb-19f574338b86" alt=""><figcaption></figcaption></figure>

After clicking *Disconnect*, a success message will appear confirming that you have successfully disconnected this integration.