AWS

AWS integrations

PulseBoard ships five GA AWS integrations: CloudWatch metrics, CloudWatch Logs, CloudTrail management events, Lambda function metrics and the Step Functions waterfall. Plus the PulseBoard Lambda extension layer.

Marketing overview & wizard walkthrough →

Auth model

STS AssumeRole with a server-minted 256-bit hex ExternalId. The role ARN is stored in pb_cloud_accounts; the ExternalId is preserved across role-ARN rotations. STS GetCallerIdentity is called immediately after AssumeRole to anti-spoof verify the returned account.

CloudWatch metrics

GetMetricData across every namespace AWS exposes. Series shape:

aws_cloudwatch_<snake>{Namespace="AWS/EC2",Stat="Average",InstanceId="i-..."}

Per-integration config: {namespaces[], statistics[], granularitySec, maxMetrics}. Default granularity 60s.

CloudWatch Logs

FilterLogEvents against log groups matching a configurable prefix. Per-event severity inferred from FATAL/ERROR/WARN/DEBUG/TRACE keywords on the first 256 chars. Stream name carried inline as [stream=<name>].

Config: {groupPrefix, filterPattern, maxGroups (1-500, default 50), maxEventsPerGroup (1-10000, default 1000)}.

CloudTrail

LookupEvents every tick. Management events only — data events (S3 GetObject, Lambda Invoke) are not in scope. Service derived from EventSource; level error when the event has an errorCode.

Config: {eventNamePrefix, eventSource, maxEvents (1-10000, default 1000)}. Opt-in (volume can surprise customers).

Lambda

Per-function Invocations, Errors, Throttles, Duration (Sum, Avg, p99) at 60-second granularity, plus our Lambda extension layer for in-process OTLP egress.

Step Functions waterfall

EventBridge rule on aws.states + Kinesis Firehose delivery stream → POST /api/aws/firehose. Translator mints OTLP spans:

Execution-status events → kind=server root span on terminal status.
Task-status events → kind=client|internal child of execution span.
FAILED / TIMED_OUT / ABORTED emit exception span events.
SHA-256-derived span IDs collapse re-deliveries.

CloudFormation template

The onboarding wizard launches an IAM role with up to 18 conditional per-integration policies. Every action is List* / Describe* / Get*. The template can be inspected at /cloudformation/pulseboard-onboarding.yaml.