Skip to main content
Early Access (EA)
The AWS connector is available in Early Access (EA). Contact your Honeycomb account team for more information.
Connect your AWS identity to let the Canvas Agent check your AWS resources during an investigation.
Connectors work per user and per Honeycomb Team. You connect your own account, and the Canvas Agent uses the connected service as your account. Connecting a connector does not connect it for anyone else on your Honeycomb Team. If you belong to more than one Honeycomb Team, connect your account in each Team. Your tool permissions also apply only to you, in one Honeycomb Team. There are no Team-level connector controls yet.Connectors work through your account, so an automatic investigation has no connector access at all.

​
What the Canvas Agent can do

  • Search and read AWS documentation.
  • Check which AWS services and features are available in each region.
  • Run scripts that call AWS APIs.
  • Create presigned URLs for Amazon S3 objects.
Honeycomb reviews each tool in a connector and gives it a default permission. Until you set your own tool permissions, these defaults apply:
  • The Canvas Agent runs reviewed read-only tools without asking.
  • For reviewed write tools and destructive tools, the Canvas Agent asks you to approve each call.
  • The Canvas Agent does not run deprecated tools.
The Canvas Agent runs a tool only when your investigation needs it. To change the defaults, visit Managing tool permissions.

​
Access this connector grants

The Canvas Agent calls AWS APIs with your AWS identity. A script can call any AWS API that your IAM permissions allow, including calls that change or delete resources. A presigned URL lets anyone who has it upload or download an S3 object for up to 15 minutes. Honeycomb classifies both tools as tools that change data, so the Canvas Agent asks you to approve each call by default.

​
Before you connect

The Canvas Agent connects to AWS through the AWS MCP Server. The server has these requirements:
  • Your IAM permissions control what the Canvas Agent can do in AWS. To limit the Canvas Agent, connect with an identity that has only the permissions an investigation needs.
  • Honeycomb US connects through the AWS us-east-1 Region, and Honeycomb EU connects through the AWS eu-central-1 Region.
  • AWS ends the connection after at most 12 hours. When it expires, reconnect AWS.

​
Connecting AWS

  1. Navigate to Canvas > Connectors.
  2. Find AWS in the connector list.
  3. Select Connect.
  4. Sign in to AWS and authorize Honeycomb.
After the connection succeeds, the AWS connector shows a Connected badge.

​
Turning AWS on or off

  1. In a Canvas chat, select the plus (+) button.
  2. Choose Connectors.
  3. Use the toggle beside AWS.

​
Disconnecting AWS

  1. Navigate to Canvas > Connectors.
  2. Find AWS and select Manage.
  3. Select Disconnect.
To learn more, visit Canvas Connectors.