From 96fd42c3ace0094c83d98f808947ef0c67bd3a0e Mon Sep 17 00:00:00 2001
From: JP-Ellis <josh@jpellis.me>
Date: Thu, 30 Jul 2026 13:23:00 +1000
Subject: [PATCH] fix: use new trustedadvisor permissions

From 1 June 2026, Datadog's Trusted Advisor integration uses the AWS
Trusted Advisor APIs, instead of the AWS Support APIs. As a result, the
permissions required for the integration role have changed.

Fixes: #342
Signed-off-by: JP-Ellis <josh@jpellis.me>
---
 aws/datadog_integration_role.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/aws/datadog_integration_role.yaml b/aws/datadog_integration_role.yaml
index 58101b53..092b5bb5 100644
--- a/aws/datadog_integration_role.yaml
+++ b/aws/datadog_integration_role.yaml
@@ -193,12 +193,12 @@ Resources:
                     - 'ssm:ListCommands'
                     - 'states:DescribeStateMachine'
                     - 'states:ListStateMachines'
-                    - 'support:DescribeTrustedAdvisor*'
-                    - 'support:RefreshTrustedAdvisorCheck'
                     - 'tag:GetResources'
                     - 'tag:GetTagKeys'
                     - 'tag:GetTagValues'
                     - 'timestream:DescribeEndpoints'
+                    - 'trustedadvisor:ListRecommendations'
+                    - 'trustedadvisor:ListRecommendationResources'
                     - 'wafv2:ListLoggingConfigurations'
                     - 'xray:BatchGetTraces'
                     - 'xray:GetTraceSummaries'