Missing `trustedadvisor` in Datadog integration role

[JP-Ellis]

Summary

The AWS Trusted Advisor integration docs state that as of 1 June 2026, Datadog collects Trusted Advisor data via the newer Trusted Advisor API and requires:

• trustedadvisor:ListRecommendations
• trustedadvisor:ListRecommendationResources

and that support:describe* / support:refresh* are no longer required after that date.

aws/datadog_integration_role.yaml still grants only the legacy Support API actions and has never been updated to include the trustedadvisor: ones. Anyone who provisioned the integration role from the published CloudFormation template therefore has a role that cannot make the calls Datadog now needs.

Expected

The integration role template grants the permissions the documentation says the integration requires.

Actual

The only Trusted Advisor grants in the template are the legacy Support API ones, in the inline DatadogAWSIntegrationPolicy:

cloudformation-template/aws/datadog_integration_role.yaml

Lines 196 to 197 in 7202b96

	- 'support:DescribeTrustedAdvisor*'
	- 'support:RefreshTrustedAdvisorCheck'

There are no trustedadvisor: permissions anywhere in the file.

Fix

The solution is trivial:

• Remove the old support:* permissions (if truely unused)
• Add the two new required trustuedadvisor: permissions

                     - 'states:DescribeStateMachine'
                     - 'states:ListStateMachines'
-                    - 'support:DescribeTrustedAdvisor*'
-                    - 'support:RefreshTrustedAdvisorCheck'
                     - 'tag:GetResources'
                     - 'tag:GetTagKeys'
                     - 'tag:GetTagValues'
+                    - 'trustedadvisor:ListRecommendations'
+                    - 'trustedadvisor:ListRecommendationResources'
                     - 'timestream:DescribeEndpoints'
                     - 'wafv2:ListLoggingConfigurations'
                     - 'xray:BatchGetTraces'
                     - 'xray:GetTraceSummaries'

Retaining the support:* actions alongside them would keep the change backwards-compatible for accounts that have not yet cut over, but it is unclear under what circumstance that is necessary.