AWS

Connect your AWS account so NOFire AI can discover and monitor your AWS infrastructure automatically. NOFire AI discovers:

Category	Resource types
Compute	EC2 instances, Auto Scaling groups, Lambda functions
Containers	ECS clusters, ECS services, and running ECS tasks, including Fargate tasks
Databases	RDS instances (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server), Aurora clusters including cluster members and read replicas, ElastiCache clusters (Redis and Memcached)
Storage	S3 buckets, EBS volumes
Network	VPCs, subnets, security groups, internet gateways, NAT gateways, load balancers, target groups
Messaging	SQS queues

Discovery runs in the region set on the connection, except S3 buckets, which are account-wide. It also captures the relationships between these resources: which ECS service runs which tasks, which task runs on which EC2 instance, which services and tasks sit behind a target group, and which resources share a VPC or subnet. This metadata gives NOFire AI more context for investigations and root cause analysis.

ECS discovery reads ecs:ListClusters, ecs:ListServices, ecs:ListTasks, and the matching ecs:Describe* actions. The ReadOnlyAccess managed policy from Step 1 covers all of these actions. If you replace that policy with a narrower one that omits them, ECS is skipped and the rest of the discovery still completes.

NOFire AI follows the AWS best practice of an assumed role and external ID for secure access. The role is read-only: NOFire AI never writes to or modifies AWS resources.

Prerequisites

An AWS account, and permission to create IAM roles in it.
The AWS region you want discovered. One connection covers one region.
The external ID shown on the NOFire AI dashboard when you add an AWS connection.

Step 1: Create IAM role

Navigate to AWS IAM console

Open the AWS Management Console with an account that can create IAM roles. Then follow these steps:

Access IAM: Open the IAM service in the AWS console.
Create a new role: In the navigation pane on the left, choose Roles > Create role.
Enter credentials:
- Add NOFire AI’s Account ID: In the Account ID input box, paste the NOFire AI AWS Account ID: 593113792344. This gives NOFire AI access to the IAM role.
- Add an External ID: Under Options, enter a unique external ID (you will need this later). You can generate one or use the one provided in the NOFire AI dashboard.
Assign permissions: On the permissions console, search for and attach these AWS managed policies:
- ReadOnlyAccess - Provides read-only access across all AWS services
- CloudWatchLogsReadOnlyAccess - Provides read access to query and analyze logs
- AmazonRDSPerformanceInsightsReadOnly - Provides read access to detailed RDS performance data
AWS maintains and updates managed policies automatically. This gives you the latest permissions for new services without manual updates.
Search for “ReadOnlyAccess” in the AWS managed policies, select it, then repeat for the other two policies. Click Next when done.
Finalize and review:
- Role name: Enter a descriptive name (for example, nofireai-readonly-role)
- Description: Add an optional description (for example, “NOFire AI readonly access for infrastructure discovery”)
- Review the three attached policies and trust relationship
If everything looks correct, click Create role in the bottom-right corner.
Copy the Role ARN: After AWS creates the role, open it and copy the role ARN. You will need this to complete the connection setup on the NOFire AI dashboard.

Alternative: Create role using AWS CLI

For automation or scripting, you can create the IAM role with the AWS CLI:

# Set your variables
NOFIREAI_ACCOUNT_ID="593113792344"
EXTERNAL_ID="your-unique-external-id"
ROLE_NAME="nofireai-readonly-role"

# Create trust policy
cat > trust-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::${NOFIREAI_ACCOUNT_ID}:root"},
    "Action": "sts:AssumeRole",
    "Condition": {"StringEquals": {"sts:ExternalId": "${EXTERNAL_ID}"}}
  }]
}
EOF

# Create role and attach policies
aws iam create-role \
  --role-name ${ROLE_NAME} \
  --assume-role-policy-document file://trust-policy.json \
  --description "NOFire AI readonly access for infrastructure discovery"

# Attach managed policies
aws iam attach-role-policy \
  --role-name ${ROLE_NAME} \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

aws iam attach-role-policy \
  --role-name ${ROLE_NAME} \
  --policy-arn arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess

aws iam attach-role-policy \
  --role-name ${ROLE_NAME} \
  --policy-arn arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly

# Get Role ARN
aws iam get-role --role-name ${ROLE_NAME} --query 'Role.Arn' --output text

Alternative: Create role using Terraform

If you manage infrastructure with Terraform, copy the module below into your configuration. Set external_id to the value shown in the NOFire AI dashboard. Keep it secret and never commit it to version control.

variable "external_id" {
  type        = string
  description = "External ID provided by NOFire AI for the trust policy condition."
  sensitive   = true
}

variable "role_name" {
  type        = string
  default     = "nofireai-readonly-role"
  description = "IAM role name assumed by NOFire AI."
}

locals {
  nofireai_account_id = "593113792344"
}

data "aws_iam_policy_document" "nofireai_trust" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${local.nofireai_account_id}:root"]
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = [var.external_id]
    }
  }
}

resource "aws_iam_role" "nofireai" {
  name               = var.role_name
  assume_role_policy = data.aws_iam_policy_document.nofireai_trust.json
}

resource "aws_iam_role_policy_attachment" "readonly" {
  role       = aws_iam_role.nofireai.name
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}

resource "aws_iam_role_policy_attachment" "cloudwatch_logs" {
  role       = aws_iam_role.nofireai.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess"
}

resource "aws_iam_role_policy_attachment" "rds_performance_insights" {
  role       = aws_iam_role.nofireai.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly"
}

output "nofireai_role_arn" {
  value       = aws_iam_role.nofireai.arn
  description = "Role ARN to share with NOFire AI."
}

Apply the configuration and copy the role ARN from the nofireai_role_arn output:

terraform apply -var="external_id=<your-external-id>"
terraform output nofireai_role_arn

Step 2: Add AWS connection to NOFire AI

Navigate to the Connections Tab

Go to Connections and click Connect on Amazon Web Services.
Enter connection details:
- Name - A descriptive name for this connection (for example, “Production AWS”, “Staging Environment”)
- Region - The AWS region to discover (for example, us-east-1)
- IAM Role ARN - The IAM role ARN you copied from AWS (for example, arn:aws:iam::123456789012:role/nofireai-readonly-role)
- External ID - The unique external ID you used to create the role
  One connection covers one region. To discover another region, add another connection.
  Click Save to create the connection.
Connection initialization: Once the connection is established, NOFire AI automatically:
- Validates the IAM role and permissions
- Discovers your compute, container, database, storage, network, and messaging resources in the connection’s region
- Builds the infrastructure graph and tracks relationships
- Updates the connection status to READY when complete
You can monitor the connection status in the Connections dashboard.

Test the connection

Open the Connections dashboard and make sure that the AWS connection status is READY. A connection that stays in an error state did not authenticate.
Ask NOFire a question that needs AWS context, for example “which AWS resources back the checkout service?”. An answer that names your resources confirms the connection works end to end.

Troubleshooting

Connection test fails with an access-denied error

The external ID on the connection must match the one in the role’s trust policy exactly, and the trust policy must name the NOFire AI account ID 593113792344. Open the role in IAM, check the Trust relationships tab, and compare both values with what you entered on the connection.

Connection saves but discovers nothing

The connection’s region holds no supported resources. Add a connection for the region where your workloads actually run.

Some resource types are missing

Make sure that all three managed policies are still attached to the role: ReadOnlyAccess, CloudWatchLogsReadOnlyAccess, and AmazonRDSPerformanceInsightsReadOnly. A role created with only ReadOnlyAccess discovers resources but cannot query logs or database performance insights.

ECS resources are missing while everything else is discovered

The role can no longer read ECS. An account whose role lost ECS read access looks identical to an account that runs no ECS, so discovery continues and the ECS clusters, services, and tasks drop out of the graph. Re-attach ReadOnlyAccess to the role.

Discovery is slow

Discovery time scales with the number of resources in the region. Avoid connections for regions that hold no resources.

Multiple accounts

Add one connection per AWS account, each with its own IAM role and external ID. Use the connection name to identify the account and environment, for example production-us or staging.

Get Started

Production readiness

Change management

Incidents

Always-On Workflows

Analytics

Setup & Integrations

Security

Prerequisites

Step 1: Create IAM role

Step 2: Add AWS connection to NOFire AI

Test the connection

Troubleshooting

Multiple accounts

​Prerequisites

​Step 1: Create IAM role

​Step 2: Add AWS connection to NOFire AI

​Test the connection

​Troubleshooting

​Multiple accounts

Prerequisites

Step 1: Create IAM role

Step 2: Add AWS connection to NOFire AI

Test the connection

Troubleshooting

Multiple accounts