> ## Documentation Index
> Fetch the complete documentation index at: https://docs.honeycomb.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect AWS to Canvas

> Connect your AWS identity so the Canvas Agent can search AWS documentation and call AWS APIs during an investigation.

Early Access (EA)

> [!NOTE]
>
> The AWS connector is available in Early Access (EA).
> Contact your Honeycomb account team for more information.

Connect your AWS identity to let the Canvas Agent check your AWS resources during an investigation.

> [!TIP]
>
> Connectors work per user and per Honeycomb Team.
> You connect your own account, and the Canvas Agent uses the connected service as your account.
> Connecting a connector does not connect it for anyone else on your Honeycomb Team.
> If you belong to more than one Honeycomb Team, connect your account in each Team.
> Your [tool permissions](https://docs.honeycomb.io/investigate/canvas/connectors/#managing-tool-permissions) also apply only to you, in one Honeycomb Team.
> There are no Team-level connector controls yet.
>
> Connectors work through your account, so an [automatic investigation](https://docs.honeycomb.io/investigate/canvas/auto-investigate.md) has no connector access at all.

## What the Canvas Agent can do

* Search and read AWS documentation.
* Check which AWS services and features are available in each region.
* Run scripts that call AWS APIs.
* Create presigned URLs for Amazon S3 objects.

> [!NOTE]
>
> Honeycomb reviews each tool in a connector and gives it a default permission.
> Until you set your own tool permissions, these defaults apply:
>
> * The Canvas Agent runs reviewed read-only tools without asking.
> * For reviewed write tools and destructive tools, the Canvas Agent asks you to approve each call.
> * The Canvas Agent does not run deprecated tools.
>
> The Canvas Agent runs a tool only when your investigation needs it.
> To change the defaults, visit [Managing tool permissions](https://docs.honeycomb.io/investigate/canvas/connectors/#managing-tool-permissions).

## Access this connector grants

> [!WARNING]
>
> The Canvas Agent calls AWS APIs with your AWS identity.
> A script can call any AWS API that your IAM permissions allow, including calls that change or delete resources.
> A presigned URL lets anyone who has it upload or download an S3 object for up to 15 minutes.
> Honeycomb classifies both tools as tools that change data, so the Canvas Agent asks you to approve each call by default.

## Before you connect

The Canvas Agent connects to AWS through the AWS MCP Server.
The server has these requirements:

* Your IAM permissions control what the Canvas Agent can do in AWS.
  To limit the Canvas Agent, connect with an identity that has only the permissions an investigation needs.
* Honeycomb US connects through the AWS `us-east-1` Region, and Honeycomb EU connects through the AWS `eu-central-1` Region.
* AWS ends the connection after at most 12 hours.
  When it expires, [reconnect AWS](https://docs.honeycomb.io/investigate/canvas/connectors/#reconnecting-a-connector).

## Connecting AWS

1. Navigate to  **Canvas** > **Connectors**.
2. Find **AWS** in the connector list.
3. Select **Connect**.
4. Sign in to AWS and authorize Honeycomb.

After the connection succeeds, the AWS connector shows a **Connected** badge.

## Turning AWS on or off

1. In a Canvas chat, select the  plus (`+`) button.
2. Choose **Connectors**.
3. Use the toggle beside **AWS**.

## Disconnecting AWS

1. Navigate to  **Canvas** > **Connectors**.
2. Find **AWS** and select **Manage**.
3. Select **Disconnect**.

To learn more, visit [Canvas Connectors](https://docs.honeycomb.io/investigate/canvas/connectors/).