# AWS Integration cannot have non-default services added to the monitoring configuration

**URL:** <https://community.dynatrace.com/t/aws-integration-cannot-have-non-default-services-added-to-the-monitoring-configuration/52229>\
**Category:** Troubleshooting\
**Tags:** activegate, aws\
**Created:** [June 25, 2025, 4:26pm UTC](https://community.dynatrace.com/t/aws-integration-cannot-have-non-default-services-added-to-the-monitoring-configuration/52229 "2025-06-25T16:26:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![bsnurka](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/bsnurka/32/26730_2.png) [@bsnurka](https://community.dynatrace.com/u/bsnurka)\
**Post date:** [June 25, 2025, 4:26pm UTC](https://community.dynatrace.com/t/aws-integration-cannot-have-non-default-services-added-to-the-monitoring-configuration/52229/1 "2025-06-25T16:26:40Z")

</div>

# Summary

As part of the [AWS Integration docs](https://docs.dynatrace.com/docs/shortlink/aws-monitoring-guide), especially for non-default AWS Services Monitoring, an EC2-based Environment ActiveGate capable of performing the sts:AssumeRole Task over the AWS IAM Role&nbsp;in the AWS Account wishing to be monitored is required.

# Problem

The IAM Role associated with the ActiveGate is unable to perform the sts:AssumeRole Task, leading to a lack of Metrics/Logs ingest for AWS Resources within the AWS Account.

# Troubleshooting steps

With an incorrect configuration applied, there will be logs similar to the following found within the [ActiveGate’s SupportArchive](https://docs.dynatrace.com/docs/shortlink/activegate-diagnostics#collect-and-review-locally).

\log\dynatracegateway.0.0.log

```markup
com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: User: arn‌‌sts::{AG-AWS-Account-Number}:assumed-role/{AG-Role-Name}/{AG-Instance-ID} is not authorized to perform: sts:AssumeRole on resource: arn‌‌iam::{Target-AWS-Account-Number}:role/{Target-Role-Name}(Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: XXXX; Proxy: null)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1879)

```

Within the Dynatrace UI \> Settings Classic \> Cloud \> AWS, there will be a warning stating that the given integration is “Running on Dynatrace provided infrastructure”.

The AWS Integration cannot have [non-default AWS Services](https://docs.dynatrace.com/docs/shortlink/aws-cloud-services-hub#aws-non-default) added to the integration for monitoring.

# Resolution

1. Ensure the ActiveGate being used for the integration is deployed as an EC2 instance, and has the aws\_monitoring\_enabled set to true within the custom.properties file:&nbsp;[Configuration properties and parameters of ActiveGate — Dynatrace Docs](https://docs.dynatrace.com/docs/shortlink/sgw-configure#aws-monitoring)
2. Confirm the Target AWS Account has the proper IAM Role deployed - [dynatrace-monitoring-role](https://github.com/dynatrace-oss/cloud-snippets/blob/main/aws/role-based-access/role_based_access_monitored_account_template.yml)
  1. Redeploy the linked CloudFormation Template as-needed.

3. Confirm the IAM Policy attached to the ActiveGate matches the [dynatrace-activegate-role](https://github.com/dynatrace-oss/cloud-snippets/blob/main/aws/role-based-access/role_based_access_AG_account_template.yml)
  1. From the ActiveGate’s CLI

  2. Redeploy the linked CloudFormation Template as-needed.

4. Test the sts:AssumeRole task from the ActiveGate’s CLI
  1. 

```auto
<font face="courier new,courier"><span>aws sts assume-role --role-arn <ARN_of_monitoring_role> --role-session-name TestSession --external-id <external_id></span></font>

```

  2. The external\_id can be found within the AWS Integration’s config within the Dynatrace Settings.

5. Confirm there is no [AWS Service Control Policy](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) configured which could be blocking the sts:AssumeRole task, especially if the ActiveGate is deployed in a different AWS Account + ORG than the Target AWS Account.

# What’s next

If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket:

- Link to the ActiveGate being used for the integration
- An ActiveGate SupportArchive
- The ActiveGate’s IAM Role in JSON Format
- The Target AWS Account’s IAM Role in JSON Format
- What non-default Services we are trying to add