Skip to main content
AWS is the data source WeWatch builds its topology from. Connect it first — every other integration depends on it.

​
How access works

WeWatch creates a role in your account and assumes it. That means:
  • Role-based access. No long-term credentials or access keys are stored.
  • Read-only. The policy grants describe and list actions, not writes.
  • Revocable. Delete the role and access ends immediately.
The Trust Center summarizes exactly what WeWatch can read and what it stores.

​
Connect an account

Open Integrations → AWS. With nothing connected yet, the page offers a single action:
The AWS integration page with no account connected, showing an Add Connection button
1

Start the flow

Choose Add Connection.
2

Choose what to connect

Select the capabilities you want WeWatch to read and the deployment option for your environment. WeWatch scopes the generated policies to that selection.
3

Create the role in AWS

WeWatch shows a trust policy and the managed policies to attach. Create the role in your AWS account using Custom trust policy, and paste the trust policy exactly as given — it carries an external ID unique to your organization.
4

Verify

Paste the role ARN back into WeWatch and choose Verify. WeWatch assumes the role to confirm it works, then starts the first topology sync.
The read-only access setup panel showing the trust policy to copy, the managed policies to attach, and the role ARN field
The trust policy’s sts:ExternalId condition is what stops anyone else from assuming the role, even if they learn the ARN. Don’t edit or drop it.
Once verified, the account appears in the connections table and the first sync begins — usually under five minutes.
The AWS integration page listing two connected accounts with their status and last sync time

​
Connecting more accounts

Each AWS account is a separate connection. Repeat the flow for each one, then use Spaces to scope a conversation or investigation to a subset of them.

​
Revoking access

Remove the connection from Integrations → AWS, or delete the role in AWS. Either ends access immediately.
Removing a connection also removes the topology built from it. Past investigations keep their written findings but can no longer be re-run against live data.