# AWS Integration and Inspector

**URL:** <https://discuss.elastic.co/t/aws-integration-and-inspector/354145>\
**Category:** Elasticsearch\
**Created:** [February 26, 2024, 6:43pm UTC](https://discuss.elastic.co/t/aws-integration-and-inspector/354145 "2024-02-26T18:43:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeffmaley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeffmaley/32/125431_2.png) [@jeffmaley](https://discuss.elastic.co/u/jeffmaley)\
**Post date:** [February 26, 2024, 6:43pm UTC](https://discuss.elastic.co/t/aws-integration-and-inspector/354145/1 "2024-02-26T18:43:52Z")

</div>

I have ELK running with the AWS integration. I have one agent policy running on several agents with a role configured for the agent to use. The agents are running on EC2 and are able to assume the role easily. I've setup a second agent policy with the intention of using a different role for certain AWS API calls, specifically for Inspector and Security Hub. Despite having a role configured, the agent calls to AWS fail with a 403 Invalid Token. If I specify and access key/secret, these calls work find and the agent is able to retrieve data. Notably, the agent policy reflects the usage of an access key/secret, but does not have any indication when it's set to use a role. Has anyone else experienced this?

---

<div class="post-metadata">

**Author:** ![itsjorge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itsjorge/32/132597_2.png) [@itsjorge](https://discuss.elastic.co/u/itsjorge)\
**Post date:** [March 13, 2024, 9:15pm UTC](https://discuss.elastic.co/t/aws-integration-and-inspector/354145/2 "2024-03-13T21:15:21Z")

</div>

Hey @jeffmaley, I'm running into the same issues. Unfortunately, it looks like the current integration package (I'm using 2.11.3) requires the usage of access and secret keys:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e08f509a919f6a07651cd924de8a619f9b34f868.png)

---

<div class="post-metadata">

**Author:** ![jeffmaley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeffmaley/32/125431_2.png) [@jeffmaley](https://discuss.elastic.co/u/jeffmaley)\
**Post date:** [March 13, 2024, 10:37pm UTC](https://discuss.elastic.co/t/aws-integration-and-inspector/354145/3 "2024-03-13T22:37:42Z")

</div>

Thanks for much for this. Do you have the link to the doc where you found that? I somehow missed it.

EDIT: nvm, I found it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2024, 10:38pm UTC](https://discuss.elastic.co/t/aws-integration-and-inspector/354145/4 "2024-04-10T22:38:23Z")

</div>

Closed on April 10, 2024, 10:38pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.