Create an AWS cloud action to discover assets across your AWS environment. This lets Lansweeper inventory your cloud infrastructure (such as EC2 instances, RDS databases, and S3 buckets), so you can track resources, improve visibility, and maintain accurate asset data across hybrid environments.
Prerequisites
- You have completed the steps in Prepare AWS for Cloud Discovery
- Your Main account role ARN and Reading roles name
Create an AWS cloud action
- In your Lansweeper Site, go to Discovery > Actions.
- Select Create action.
- Select Cloud as the action type.
- In the pop-up, select Cloud provider - Amazon Web Services (AWS) as the cloud source.
- Select Create.
- Enter your Main account role ARN and Reading roles name.
- Select either Standalone account or Organization.
- Select List accounts.
- Choose the AWS accounts you want to add to the discovery action.
- Under Asset types, select which workloads to scan.
- Under Regions, select the regions to include in the scan.
- Optionally, select Add tag filter to include or exclude resources with specific tags.
- Select Create trigger.
- Select Instant to run at a scheduled time on select days. Enter the name, time, and days you prefer.
- Finally, select Save and finish.
What to expect after the action runs
After the trigger runs for the first time, Lansweeper discovers the resources in the AWS accounts and regions you selected and adds them to your asset inventory. Each discovered resource, such as an EC2 instance, RDS database, or S3 bucket, becomes an asset with its own asset page showing details, relationships, and tags.
Discovery runs on the schedule you set in the trigger, so the data refreshes with each successful run.
Troubleshoot the AWS cloud action
If a discovered asset is missing data, open the asset and check the Scan issues tab. Permission or scanning problems for that asset appear there.
If the action doesn't return the results you expect, check the following:
- Connection or authentication fails. Confirm your Main account role ARN and Reading roles name are correct, and that the OIDC identity provider, main role, and trust policies are configured as described in Prepare AWS for Cloud Discovery.
- No accounts or assets are discovered. Confirm the main account has the accounts listing policy, and that each target account has the reading role, using the same role name across all accounts, with the reading policy attached. Verify you selected Standalone account or Organization to match your setup.
- Kubernetes detail is missing for EKS clusters. Reading EKS clusters at the Kubernetes level, such as nodes, pods, and services, needs extra access to the cluster's Kubernetes API, as described in Prepare AWS for Cloud Discovery.