# Fleets AWS Integration Clarification

**URL:** <https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262>\
**Category:** Beats\
**Tags:** fleet\
**Created:** [April 26, 2021, 1:56pm UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262 "2021-04-26T13:56:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![DaveRT](https://avatars.discourse-cdn.com/v4/letter/d/4bbf92/32.png) [@DaveRT](https://discuss.elastic.co/u/DaveRT)\
**Post date:** [April 26, 2021, 1:56pm UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262/1 "2021-04-26T13:56:40Z")

</div>

I'm trying to test the Fleets Beta AWS integration. Initially just with CloudTrail logs before adding others. So far I have done the below:

-Created IAM User  
-Created permissions policy with required permissions, and granted the new IAM user this permission policy  
-Configured the integration via the UI, with username, accesskey and secretkey  
-Configured the SQS (linked with the SNS subscription for the CloudTrail S3 bucket)  
-Added the SQS queue URL and saved the integration.

I can see the integration saved into the default policy. I have no hosts to install into, as I didn't think this was required via the integration method (using IAM access keys etc to get the data).

Am I supposed to do something more than the above? I cannot see any data in Kibana using the [Logs AWS] CloudTrail option.

Apologies in advance if I'm missing something obvious. I'm particularly new to Elastic. I should add, I'm using the vanilla install of Elastic Cloud on AWS.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 26, 2021, 3:16pm UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262/2 "2021-04-26T15:16:49Z")

</div>

How did you install the agent? Is it reachable by Kibana/Elasticsearch?

---

<div class="post-metadata">

**Author:** ![DaveRT](https://avatars.discourse-cdn.com/v4/letter/d/4bbf92/32.png) [@DaveRT](https://discuss.elastic.co/u/DaveRT)\
**Post date:** [April 26, 2021, 11:35pm UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262/3 "2021-04-26T23:35:19Z")

</div>

Hi Kvch,

This is where I get confused. The docs don't make it clear what I should do regarding Agents. I'm aware that in other integrations I would need to install agents into host machines, but with AWS it's less clear.

Is there something I need to do on the Elastic/Kibana side to allow them to see the data coming in from AWS? I was under the impression the "installation" of the integration would complete all the other requirements, but I'm probably being a bit naive as I'm new to Elastic.

---

<div class="post-metadata">

**Author:** ![stefs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefs/32/58596_2.png) [@stefs](https://discuss.elastic.co/u/stefs)\
**Post date:** [May 3, 2021, 10:32pm UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262/4 "2021-05-03T22:32:16Z")

</div>

Hi David,

Can you confirm you've setup your policy as described in this Metricbeat policy example: [AWS module | Metricbeat Reference [master] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-module-aws.html#_aws_credentials_types)

(Correlates to the AWS Permissions which shows in the UI: [integrations/README.md at master · elastic/integrations · GitHub](https://github.com/elastic/integrations/blob/master/packages/aws/docs/README.md))

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [May 4, 2021, 2:09am UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262/5 "2021-05-04T02:09:43Z")

</div>

The agent can be installed on any system. The modules that poll remote apis don't matter what the system is.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2021, 4:10am UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262/6 "2021-06-01T04:10:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
