AWS integration: connect Lambda, EC2, S3 and CloudWatch to Polylane

Connect AWS resources, CloudWatch logs and alarms to Polylane. Trace incidents across services with an infrastructure graph and deployment history.

Why Polylane for AWS

Get started for free

How to set up AWS

The console describes stack deployment as taking a few minutes and displays a troubleshooting message after ten minutes without confirmation. That timeout is not a setup SLA.

Choose AWS in Settings → Cloud accounts. Enter the 12-digit account ID and the region for the connection stack.
Open Deploy stack on AWS, review the generated CloudFormation template and acknowledge its IAM resources before creating the stack.
Return to Polylane while the stack reports back. The console waits for confirmation and opens the connected account when registration succeeds.

Permissions and access

The shipped role is not strictly read-only: it attaches ReadOnlyAccess and AWSLambdaBasicExecutionRole plus an inline policy. It explicitly denies application S3 object reads outside the Polylane bucket and DynamoDB/DAX data reads. Additional grants manage polylane-prefixed Lambda functions and SNS topics, the connection CloudTrail and S3 bucket, the connection stack, tagging, CloudWatch alarms and dashboards, EventBridge rules, metric publishing and a constrained EKS access entry with AmazonEKSAdminViewPolicy. Cross-account sts:AssumeRole uses an ExternalId. This flow has no separate read-only/full-access switch; review the exact generated policy before deploying.

Discovery, refresh and the connected view

The initial scan maps the connected account’s supported services, networking and dependencies. Later scans are triggered by AWS change events rather than a fixed scheduled full scan. Resource pages expose configuration and history; investigation tools read CloudWatch logs, metrics, alarms and X-Ray traces.

Disconnect and revoke access

Disconnect in Polylane. The API attempts deletion of the owned connection stack; if cleanup fails, delete it in CloudFormation. The role and inline policy have Retain deletion policies, so inspect and remove retained IAM resources to revoke access completely.

Provider credentials and Polylane’s access mode are separate. Where write-capable tools exist, the connected account’s Settings page offers a Read-only switch. Turning it off permits writes subject to review and confirmation, but cannot add permissions to the provider credential. Agent-connected Kubernetes clusters stay read-only.

Exact additional IAM Allow actions

These inline actions supplement the two managed policies. The resource boundaries described above still apply; review the generated template for every ARN and condition.

lambda:CreateFunction
lambda:AddPermission
lambda:DeleteFunction
lambda:UpdateFunctionConfiguration
lambda:UpdateFunctionCode
cloudformation:DeleteStack
tag:GetResources
tag:GetTagKeys
tag:GetTagValues
tag:TagResources
tag:UntagResources
cloudtrail:*
s3:*
sns:*
lambda:InvokeFunction
ce:GetCostAndUsageWithResources
ce:GetCostAndUsage
iam:PassRole
events:PutEvents
cloudwatch:DescribeAlarms
cloudwatch:DescribeAlarmHistory
cloudwatch:ListDashboards
cloudwatch:GetDashboard
cloudwatch:ListMetrics
cloudwatch:GetMetricData
cloudwatch:PutMetricAlarm
cloudwatch:DeleteAlarms
cloudwatch:DisableAlarmActions
cloudwatch:EnableAlarmActions
cloudwatch:PutDashboard
cloudwatch:DeleteDashboards
cloudwatch:PutMetricData
events:PutRule
events:PutTargets
events:DeleteRule
events:RemoveTargets
eks:CreateAccessEntry
eks:AssociateAccessPolicy
eks:DeleteAccessEntry
eks:AccessKubernetesApi
eks:DescribeAccessEntry
eks:ListAccessEntries
eks:ListAssociatedAccessPolicies

In the graph.

Every AWS resource Polylane picks up sits in the graph with its connections, config and history.

Lambda Function

Lambda Layer

EC2 Instance

VPC

Subnet

Security Group

Internet Gateway

NAT Gateway

Route Table

Network ACL

EBS Volume

Elastic IP

S3 Bucket

DynamoDB Table

RDS Instance

CloudFront Distribution

API Gateway REST API

API Gateway v2 API

API Gateway Custom Domain

SQS Queue

SNS Topic

ECS Cluster

ECS Service

ECS Task Definition

ElastiCache Cluster

App Runner Service

App Runner Connection

IAM Role

KMS Key

Kinesis Stream

ElastiCache Replication Group

RDS Cluster

RDS Proxy

Service Discovery Service

Secrets Manager Secret

EventBridge Rule

EventBridge Bus

Step Functions State Machine

Redshift Cluster

Kinesis Firehose

Neptune Cluster

Cognito User Pool

Cognito Identity Pool

Athena Workgroup

Glue Database

Glue Crawler

Glue Job

Batch Job Queue

Batch Compute Environment

Amazon MQ Broker

MSK Cluster

DocumentDB Cluster

MemoryDB Cluster

CloudTrail Trail

GuardDuty Detector

WAF Web ACL

ACM Certificate

EKS Cluster

EKS Node Group

EKS Fargate Profile

EKS Addon

EKS Access Entry

EKS Identity Provider

EKS OIDC Provider

Elasticsearch Domain

OpenSearch Domain

EventBridge Pipe

Amplify App

Application Load Balancer

Network Load Balancer

Gateway Load Balancer

Target Group

Load Balancer Listener

Listener Rule

Glue Table

Tools for the investigation.

What Polylane can do with AWS while it investigates. Every call is recorded in the transcript.

AWS Polylane MCP

awsApi Read any AWS API via a SigV4-signed request (read-only escape hatch)
awsCloudWatchAlarms Read or manage CloudWatch alarms (list, get, getHistory, create, acknowledge, enableActions)
awsCloudWatchDashboards Read or manage CloudWatch dashboards (list, get, create)
awsCloudWatchLogs Read CloudWatch logs (listGroups, describeStreams, getEvents, filter, query)
awsGetCloudWatchQueryResults Get results of a CloudWatch Insights query
awsCloudWatchMetrics Read CloudWatch metrics (list available metrics, get data points)
awsXRayTraces Read X-Ray traces (list summaries, get full trace)
awsXRayInsights Read X-Ray insights (list, get, getEvents)
awsXRayServices Read X-Ray service topology and time-series statistics (graph, timeseries)
awsGetXRayGroups List X-Ray groups
awsEksKubectl Read and operate on Kubernetes resources on an EKS cluster (get/list/describe/logs/events/top/rollout, plus scale, restart, patch, delete, apply)

AWS setup and troubleshooting

All guides for AWS

Docker context deadline exceeded

Common questions.

How does Polylane connect to my AWS account?

Choose AWS in Settings → Cloud accounts. Enter the 12-digit account ID and the region for the connection stack. Open Deploy stack on AWS, review the generated CloudFormation template and acknowledge its IAM resources before creating the stack. Return to Polylane while the stack reports back. The console waits for confirmation and opens the connected account when registration succeeds.

What AWS resources does Polylane sync?

Connect it once. Then get back to shipping.

Get started for free