AWS

Connecting NeuBird to your AWS environment enables collection of resource configurations, CloudTrail change events, CloudWatch metrics, logs, and alarms. The scope of data NeuBird can access depends on the permissions assigned to the AWS role.

NeuBird follows AWS best practices by using an assumed role with an external ID for secure, read-only access.

Step 1: Create an IAM Role

You can create the role using the AWS CLI (recommended for automation) or the AWS Console (recommended for most users).

Option A: AWS CLI

Open CloudShell from the terminal icon at the top of the AWS Console and run:

aws iam create-role \
  --role-name NeuBird \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::905418326654:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "YOUR_EXTERNAL_ID" }
      }
    }]
  }' \
  --description "NeuBird read-only access"

aws iam attach-role-policy \
  --role-name NeuBird \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

aws iam get-role --role-name NeuBird --query 'Role.Arn' --output text

Replace YOUR_EXTERNAL_ID with the External ID shown in the NeuBird connection dialog.

What this does:

1. Creates an IAM role called NeuBird that allows AWS account 905418326654 (NeuBird) to assume it, verified by an external ID
2. Attaches the AWS-managed ReadOnlyAccess policy — NeuBird can view but not modify your resources
3. Outputs the Role ARN you’ll need for the connection

Option B: AWS Console

1. Access IAM: Navigate to the IAM service in the AWS Console.

   

2. Create a new role: In the navigation pane, choose Roles > Create role.

   

3. Choose trusted entity: Select Another AWS account as the type of trusted entity.

   

4. Enter credentials:

   • Account ID: Enter 905418326654 (NeuBird’s AWS account)
   • External ID: Copy the External ID from the NeuBird connection dialog and paste it here

   

   

   Click Next to continue.

5. Assign permissions: Filter by AWS managed - job function and select ReadOnlyAccess.

   

   Click Next to continue.

6. Review and create: Enter a name (e.g. NeuBird) and description, review the configuration, then click Create role.

   

   

7. Copy the Role ARN: Open the newly created role and copy the Role ARN.

   

Step 2: Add Kubernetes (EKS) Access

Skip this step if you don’t use EKS.

For each EKS cluster you want NeuBird to monitor:

1. Go to Amazon EKS > select your cluster > Access tab. In IAM access entries, click Manage.

   

2. Create access entry: Enter the NeuBird role ARN as the IAM principal, type Standard, click Next.

   

3. Add access policy: Select AmazonEKSViewPolicy (minimum required) with Cluster scope.

   

4. Review and create.

   

Network Access

If your EKS cluster endpoint has CIDR restrictions (not 0.0.0.0/0), add NeuBird’s IP:

Add the following CIDR block:

54.236.215.157/32

Or via CLI:

aws eks update-cluster-config --resources-vpc-config endpointPublicAccess=true,publicAccessCidrs=<your-existing-cidrs>,54.236.215.157/32

Step 3: Enable Configuration Change Telemetry

Skip this step if you already have CloudTrail delivering to a CloudWatch Log Group.

NeuBird uses CloudTrail to monitor configuration changes across your AWS resources.

Create a CloudWatch Log Group

1. Navigate to CloudWatch in the AWS Console.

   

2. Go to Logs > Log groups > Create log group.

   

3. Enter a log group name and click Create.

   

Create a CloudTrail Trail

1. Navigate to CloudTrail and click Create trail.

   

   

2. Enter a trail name and create a new S3 bucket for storage.

   

3. Enable CloudWatch Logs and select the log group you created.

   

4. For IAM Role, choose New or select an existing role. Click Next.

   

5. Select all event types and proceed.

   

   

6. Review and click Create trail.

   

   

Configure Permissions

In IAM, find the role attached to your CloudTrail and attach these policies:

• AWSCloudTrail_FullAccess
• CloudWatchLogsFullAccess

Verify Log Delivery

Check your CloudWatch log group to confirm logs from CloudTrail are being delivered.

CloudWatch Alarms (Optional)

In CloudWatch, go to Alarms > Create alarm and choose metrics related to CloudTrail logs.

Connection Fields

NeuBird supports three authentication methods:

Role ARN (recommended)

Field	Required	Description
Name	Yes	A descriptive name for this connection
Description	No	Optional note about what this connection is for
Role ARN	Yes	The ARN of the IAM role created in Step 1
Regions	Yes	AWS regions to collect telemetry from

Access Key

Field	Required	Description
Name	Yes	A descriptive name for this connection
Description	No	Optional note about what this connection is for
Access Key ID	Yes	IAM user access key ID
Access Key Secret	Yes	IAM user secret access key
Regions	Yes	AWS regions to collect telemetry from

AWS OIDC

Field	Required	Description
Name	Yes	A descriptive name for this connection
Description	No	Optional note about what this connection is for
Regions	Yes	AWS regions to collect telemetry from

The OIDC method redirects you to authenticate directly with your AWS account.

---

For general instructions on creating and managing connections, see the Connections Overview.