Missing `trustedadvisor` in Datadog integration role

Open aws/datadog_integration_role.yaml and inspect the inline DatadogAWSIntegrationPolicy around the existing Trusted Advisor permissions. Compare the policy with the AWS Trusted Advisor integration documentation and update the actions as appropriate. Done means the template grants the required trustedadvisor permissions and handles the legacy support actions consistently with the documented transition.

Summary

The AWS Trusted Advisor integration docs state that as of 1 June 2026, Datadog collects Trusted Advisor data via the newer Trusted Advisor API and requires:

• trustedadvisor:ListRecommendations
• trustedadvisor:ListRecommendationResources

and that support:describe* / support:refresh* are no longer required after that date.

aws/datadog_integration_role.yaml still grants only the legacy Support API actions and has never been updated to include the trustedadvisor: ones. Anyone who provisioned the integration role from the published CloudFormation template therefore has a role that cannot make the calls Datadog now needs.

Expected

The integration role template grants the permissions the documentation says the integration requires.

Actual

The only Trusted Advisor grants in the template are the legacy Support API ones, in the inline DatadogAWSIntegrationPolicy:

https://github.com/DataDog/cloudformation-template/blob/7202b96d612370cb3a25612d82be766ac1dd5850/aws/datadog_integration_role.yaml#L196-L197

There are no trustedadvisor: permissions anywhere in the file.

Fix

The solution is trivial:

• Remove the old support:* permissions (if truely unused)
• Add the two new required trustuedadvisor: permissions

                     - 'states:DescribeStateMachine'
                     - 'states:ListStateMachines'
-                    - 'support:DescribeTrustedAdvisor*'
-                    - 'support:RefreshTrustedAdvisorCheck'
                     - 'tag:GetResources'
                     - 'tag:GetTagKeys'
                     - 'tag:GetTagValues'
+                    - 'trustedadvisor:ListRecommendations'
+                    - 'trustedadvisor:ListRecommendationResources'
                     - 'timestream:DescribeEndpoints'
                     - 'wafv2:ListLoggingConfigurations'
                     - 'xray:BatchGetTraces'
                     - 'xray:GetTraceSummaries'

Retaining the support:* actions alongside them would keep the change backwards-compatible for accounts that have not yet cut over, but it is unclear under what circumstance that is necessary.