← All integrations
AWS

AWS integration. Read CloudWatch, investigate alarms and fix issues across your AWS account.

Praxen Inc. maps your AWS account, reads CloudWatch metrics, logs and X-Ray traces to spot issues, investigates your alarms as they fire, and writes the fix.

Why Praxen Inc. for AWS

Get started for free

How to set up AWS

The console describes stack deployment as taking a few minutes and displays a troubleshooting message after ten minutes without confirmation. That timeout is not a setup SLA.

  1. Choose AWS in Settings → Cloud accounts. Enter the 12-digit account ID and the region for the connection stack.
  2. Open Deploy stack on AWS, review the generated CloudFormation template and acknowledge its IAM resources before creating the stack.
  3. Return to Praxen Inc. while the stack reports back. The console waits for confirmation and opens the connected account when registration succeeds.

Permissions and access

The shipped role is not strictly read-only: it attaches ReadOnlyAccess and AWSLambdaBasicExecutionRole plus an inline policy. It explicitly denies application S3 object reads outside the Praxen Inc. bucket and DynamoDB/DAX data reads. Additional grants manage praxen-prefixed Lambda functions and SNS topics, the connection CloudTrail and S3 bucket, the connection stack, tagging, CloudWatch alarms and dashboards, EventBridge rules, metric publishing and a constrained EKS access entry with AmazonEKSAdminViewPolicy. Cross-account sts:AssumeRole uses an ExternalId. This flow has no separate read-only/full-access switch; review the exact generated policy before deploying.

Discovery, refresh and the connected view

The initial scan maps the connected account’s supported services, networking and dependencies. Later scans are triggered by AWS change events rather than a fixed scheduled full scan. Resource pages expose configuration and history; investigation tools read CloudWatch logs, metrics, alarms and X-Ray traces.

Disconnect and revoke access

Disconnect in Praxen Inc. The API attempts deletion of the owned connection stack; if cleanup fails, delete it in CloudFormation. The role and inline policy have Retain deletion policies, so inspect and remove retained IAM resources to revoke access completely.

Provider credentials and Praxen Inc.’s access mode are separate. Where write-capable tools exist, the connected account’s Settings page offers a Read-only switch. Turning it off permits writes subject to review and confirmation, but cannot add permissions to the provider credential. Agent-connected Kubernetes clusters stay read-only.

Exact additional IAM Allow actions

These inline actions supplement the two managed policies. The resource boundaries described above still apply; review the generated template for every ARN and condition.

  • lambda:CreateFunction
  • lambda:AddPermission
  • lambda:DeleteFunction
  • lambda:UpdateFunctionConfiguration
  • lambda:UpdateFunctionCode
  • cloudformation:DeleteStack
  • tag:GetResources
  • tag:GetTagKeys
  • tag:GetTagValues
  • tag:TagResources
  • tag:UntagResources
  • cloudtrail:*
  • s3:*
  • sns:*
  • lambda:InvokeFunction
  • ce:GetCostAndUsageWithResources
  • ce:GetCostAndUsage
  • iam:PassRole
  • events:PutEvents
  • cloudwatch:DescribeAlarms
  • cloudwatch:DescribeAlarmHistory
  • cloudwatch:ListDashboards
  • cloudwatch:GetDashboard
  • cloudwatch:ListMetrics
  • cloudwatch:GetMetricData
  • cloudwatch:PutMetricAlarm
  • cloudwatch:DeleteAlarms
  • cloudwatch:DisableAlarmActions
  • cloudwatch:EnableAlarmActions
  • cloudwatch:PutDashboard
  • cloudwatch:DeleteDashboards
  • cloudwatch:PutMetricData
  • events:PutRule
  • events:PutTargets
  • events:DeleteRule
  • events:RemoveTargets
  • eks:CreateAccessEntry
  • eks:AssociateAccessPolicy
  • eks:DeleteAccessEntry
  • eks:AccessKubernetesApi
  • eks:DescribeAccessEntry
  • eks:ListAccessEntries
  • eks:ListAssociatedAccessPolicies

In the graph.

Every AWS resource Praxen Inc. picks up sits in the graph with its connections, config and history.

Lambda Function
Lambda Layer
EC2 Instance
VPC
Subnet
Security Group
Internet Gateway
NAT Gateway
Route Table
Network ACL
EBS Volume
Elastic IP
S3 Bucket
DynamoDB Table
RDS Instance
CloudFront Distribution
API Gateway REST API
API Gateway v2 API
API Gateway Custom Domain
SQS Queue
SNS Topic
ECS Cluster
ECS Service
ECS Task Definition
ElastiCache Cluster
App Runner Service
App Runner Connection
IAM Role
KMS Key
Kinesis Stream
ElastiCache Replication Group
RDS Cluster
RDS Proxy
Service Discovery Service
Secrets Manager Secret
EventBridge Rule
EventBridge Bus
Step Functions State Machine
Redshift Cluster
Kinesis Firehose
Neptune Cluster
Cognito User Pool
Cognito Identity Pool
Athena Workgroup
Glue Database
Glue Crawler
Glue Job
Batch Job Queue
Batch Compute Environment
Amazon MQ Broker
MSK Cluster
DocumentDB Cluster
MemoryDB Cluster
CloudTrail Trail
GuardDuty Detector
WAF Web ACL
ACM Certificate
EKS Cluster
EKS Node Group
EKS Fargate Profile
EKS Addon
EKS Access Entry
EKS Identity Provider
EKS OIDC Provider
Elasticsearch Domain
OpenSearch Domain
EventBridge Pipe
Amplify App
Application Load Balancer
Network Load Balancer
Gateway Load Balancer
Target Group
Load Balancer Listener
Listener Rule
Glue Table

AWS tools.

The calls Praxen Inc. can make to AWS when it looks into an issue.

AWS
  • awsApi Read any AWS API via a SigV4-signed request (read-only escape hatch)
  • awsCloudWatchAlarms Read or manage CloudWatch alarms (list, get, getHistory, create, acknowledge, enableActions)
  • awsCloudWatchDashboards Read or manage CloudWatch dashboards (list, get, create)
  • awsCloudWatchLogs Read CloudWatch logs (listGroups, describeStreams, getEvents, filter, query)
  • awsGetCloudWatchQueryResults Get results of a CloudWatch Insights query
  • awsCloudWatchMetrics Read CloudWatch metrics (list available metrics, get data points)
  • awsXRayTraces Read X-Ray traces (list summaries, get full trace)
  • awsXRayInsights Read X-Ray insights (list, get, getEvents)
  • awsXRayServices Read X-Ray service topology and time-series statistics (graph, timeseries)
  • awsGetXRayGroups List X-Ray groups
  • awsEksKubectl Read and operate on Kubernetes resources on an EKS cluster (get/list/describe/logs/events/top/rollout, plus scale, restart, patch, delete, apply)

AWS setup and troubleshooting

All guides for AWS

Common questions.

How does Praxen Inc. connect to my AWS account?

Choose AWS in Settings → Cloud accounts. Enter the 12-digit account ID and the region for the connection stack. Open Deploy stack on AWS, review the generated CloudFormation template and acknowledge its IAM resources before creating the stack. Return to Praxen Inc. while the stack reports back. The console waits for confirmation and opens the connected account when registration succeeds.

What AWS resources does Praxen Inc. sync?

The initial scan maps the connected account’s supported services, networking and dependencies. Later scans are triggered by AWS change events rather than a fixed scheduled full scan. Resource pages expose configuration and history; investigation tools read CloudWatch logs, metrics, alarms and X-Ray traces.

Connect it once. Then get back to shipping.

Get started for free