One read-only IAM access key turns every EC2 instance, RDS database and Amazon WorkSpace into an ordinary SmartTile device — status checks, CloudWatch metrics, uptime history, spend and security findings — alerting and ticketing in the IT Service Management (ITSM) system your team already uses.
A cloud server usually sits outside the NOC's view: it is not on a switch port, often does not answer ping, and its health lives in the AWS console. SmartTile CloudAutomate reads the account with a least-privilege IAM user and makes each instance a device like any other — the state AWS reports this poll is the truth, so a stopped instance, a failed status check or an expired key shows up instead of staying green.
EC2 instances, RDS databases and Amazon WorkSpaces imported one-to-one under an "AWS us-east-1"-style location. You pick what imports; a re-import updates in place, never duplicates.
Instance state plus both EC2 status checks (system and instance), RDS status and WorkSpace state, every 60 s. DOWN after 2 bad polls, UP at once; every change lands in state history.
CPU, network in/out, EBS read/write ops and CPU credit balance every 5 min; memory and disk too when the CloudWatch agent runs. RDS: CPU, storage used, IOPS.
If AWS stops answering for a key, its servers turn UNKNOWN after ~6 minutes and the NOC gets one e-mail — never a silent green. A launch time is never shown as uptime.
Cost Explorer daily and monthly spend, by service and by region, with the month's forecast — cached hourly on the Spend tab.
GuardDuty (severity 4+) and Security Hub (high / critical), plus SmartTile's own checks: ports 22/3389/3306/1433/5432/27017/6379 open to 0.0.0.0/0, unencrypted EBS, access keys > 90 days.
The Utilization tab flags idle, oversized and hot servers from 24 h, 7 d or 30 d of samples.
With a Business or Enterprise support plan: open a real AWS Support case from the device, or arm a device to open one on a confirmed outage. Both switches off by default.
SmartTileCloudAutomate.smarttile-cloudautomate, no console access, attach the policy directly.AKIA…) and the secret — shown once.| Scope | What the policy allows |
|---|---|
| Monitoring | ec2:Describe instances/status/regions, cloudwatch:GetMetricStatistics, rds:DescribeDBInstances, workspaces:Describe — read only |
| Spend | ce:GetCostAndUsage, ce:GetCostForecast |
| Security | GuardDuty / Security Hub findings, security groups, volumes, IAM users and key ages — read only |
| Support | support:CreateCase and case reads — the only write, and only if ticked |
sts:GetCallerIdentitySave & Test: proves the key and names the accountec2:DescribeRegionsWhich regions to scan when the field is blankec2:DescribeInstancesDaily discovery (02:30) of instances, IPs, type, tagsec2:DescribeInstanceStatusEvery poll: state + system/instance status checksrds:DescribeDBInstancesRDS discovery and statusworkspaces:DescribeWorkspacesWorkSpace inventory, state and connection statecloudwatch:GetMetricStatisticsAWS/EC2, AWS/RDS, AWS/WorkSpaces, CWAgent metricsce:GetCostAndUsage / GetCostForecastHourly spend by day, service, region + forecastguardduty / securityhub GetFindingsHourly threat and posture findingsec2:DescribeSecurityGroups, iam:ListAccessKeysSmartTile's own exposure and key-age checkssupport:CreateCaseOnly when a case is opened — switches off by defaultDevice: web-01 · t3.medium (2 vCPU / 4 GB) · Location "AWS us-east-1"
Seen by SmartTile: state running, instance status check impaired on two polls in a row → DOWN
Then: the normal ticket path for the company — Rev.io or the connected ITSM system — with state history and the Uptime chart showing the outage
The policy is built from the scopes you tick. Without Support ticked nothing in it can create, change, stop or delete anything.
The secret access key is encrypted at rest the moment it is saved and never returned by the API — only whether one is stored.
Each company connects its own AWS account; every CloudAutomate call is fenced to the caller's organization, and adding or testing keys needs an admin.
Region, name and tag filters apply before discovery; the import table shows exactly what will be created or updated.
Engine, status sync, health metrics, spend, security, WorkSpaces, auto-region and support cases each have their own Engine Safety switch, plus a global kill switch.
Key created, tested, updated or deleted, every import and every support case is written to the activity log, and every sync to the Connections tab log.
| Question | Answer |
|---|---|
| Can SmartTile change our AWS account? | No — every scope except Support is read-only, and Support is opt-in. The only write is support:CreateCase. |
| Why no memory or disk? | AWS only publishes them through the CloudWatch agent (CWAgent). Install it and they appear; CPU, network and status checks work without it. |
| Does a stopped server alert? | Yes — anything not running or pending is DOWN. Keep a deliberately-stopped server out with the import filter or its own alert switches. |