// AWS integration — coming soon
Connect an account without pasting long-lived access keys.
Not available to connect right now. AWS monitoring is being reworked. Everything below describes what it does when it returns.
Beaam assumes a read-only role (one-click CloudFormation — no IAM user or long-lived keys) and discovers EC2, Lambda, Step Functions, RDS, DynamoDB, Application Load Balancers, and SQS across every enabled region, polling CloudWatch each minute. Following the 'curate alarms, be generous with data' principle (ADR-0018), it alerts on a small attention-worthy set and collects more for context.
Curated deliberately: a short list worth your attention, not every metric that exists. Each one needs repeated evidence before Beaam calls it — a single bad reading is not an incident.
| Signal | When Beaam speaks up |
|---|---|
| EC2 status checks | Instance impaired (failing AWS health checks) → broken. |
| EC2 CPU | ≥ 95% sustained → degraded. |
| Lambda errors | Any errors in the window → broken. |
| Lambda throttles | Any throttles → degraded. |
| Step Functions failures | Any failed executions → broken. |
| RDS CPU | ≥ 90% sustained → degraded. |
| DynamoDB throttles / errors | Any throttles → degraded; system errors → broken. |
| ALB 5xx / hosts | LB-generated 5xx → broken; an unhealthy target → degraded. |
| SQS backlog age | Oldest message ≥ 5 min → degraded (a stuck consumer). |
Charted on the service page and there for context when something does break — but it will not wake you unless you ask it to.
setup
Launch Beaam’s CloudFormation role, then Beaam discovers monitorable resources.
Beaam applies sensible defaults. Threshold configuration is optional, not onboarding.
access
Beaam never writes to AWS. Credentials are encrypted with AES-256-GCM using a key held as a deploy secret, and are deleted immediately when you disconnect.
9 signals can raise an incident: EC2 status checks, EC2 CPU, Lambda errors, Lambda throttles, Step Functions failures, RDS CPU, DynamoDB throttles / errors, ALB 5xx / hosts, SQS backlog age. Everything else is collected for context but stays quiet until you opt in.
Launch Beaam’s CloudFormation role, then Beaam discovers monitorable resources. Most connections are watching within a few minutes, and you can send a test alert immediately to prove the path works end to end.
No. Beaam only ever performs read operations — there is no code path that writes to a connected provider. Worth separating from that: what Beaam *does* and what a token *permits* are different things. Where AWS offers a read-scoped credential, use it; some providers only issue tokens carrying broader rights than Beaam uses, which is a property of their API rather than of Beaam's behaviour. Scope it as narrowly as the provider allows. Credentials are encrypted with AES-256-GCM before storage and deleted the moment you disconnect.
The free plan covers two integrations and five watched services, with email, push, Slack and webhook alerts. Solo is $19/month flat for unlimited integrations and services, adding SMS — there is no per-host, per-check or per-alert metering.
Most stacks are several services with seams between them, and the seams are where the damaging failures hide. Beaam correlates across every connected integration, so a database problem reads as one incident rather than five alarms from five tools.