Configuring An AWS Data Source For Coordimap

This guide explains how to configure the Coordimap agent to crawl an AWS account. With AWS configured correctly, Coordimap can discover EC2 instances, VPCs, load balancers, RDS instances, S3 buckets, and other AWS resources, then turn that inventory into diagrams and relationships.

For AWS, use the AWS account ID as scope_id. That value is the stable ownership boundary for AWS assets.

Prerequisites

Before you begin, make sure you have:

1. Installed the Coordimap agent in an environment that can reach AWS APIs.
2. Added the AWS data source in the Coordimap UI so you have an id.
3. Prepared AWS credentials for the agent, either through IAM role, environment variables, or an AWS credentials file.

Find The Correct scope_id

Use the AWS account ID:

aws sts get-caller-identity --query Account --output text

If you run multiple Coordimap AWS connectors against the same account, reuse the same scope_id. That keeps all discovered assets in one identity space.

Configuration File

coordimap:
  api_key: ${COORDIMAP_API_KEY}
  data_sources:
    - type: aws
      id: <YOUR_DATA_SOURCE_ID_FROM_UI>
      config:
        - name: scope_id
          value: "<AWS_ACCOUNT_ID>"
        - name: policy_config
          value: "true"
        - name: access_key_id
          value: ${AWS_ACCESS_KEY_ID}
        - name: secret_access_key
          value: ${AWS_SECRET_ACCESS_KEY}
        - name: crawl_interval
          value: "5m"

Configuration Options

Visualizing Network Flows With VPC Flow Logs

To see how resources inside your AWS VPCs communicate, configure AWS VPC Flow Logs and ingest them through the AWS flow logs data source.

Use the same AWS account scope_id in both the AWS infrastructure crawler and the AWS flow logs crawler. That is how Coordimap knows the flow telemetry belongs to the same AWS asset graph.

Read the flow log setup guide here: AWS Flow Logs Configuration.

Next Steps

1. Prepare the credentials the agent should use.
2. Add the AWS data source block to the agent YAML file.
3. Set COORDIMAP_API_KEY where the agent runs.
4. Restart the agent.
5. Verify that resources appear in Coordimap after the next crawl cycle.

Source References

• Coordimap Agent Example Configuration
• AWS STS GetCallerIdentity
• AWS Managed ReadOnlyAccess Policy

FAQ

What should AWS use as scope_id?

Use the AWS account ID returned by aws sts get-caller-identity. This keeps AWS assets in the same identity space even if the Coordimap connector is recreated.

Should the AWS agent use access keys or an IAM role?

Prefer an IAM role when the agent runs on AWS infrastructure such as EC2 or EKS. Use access keys only when a role is not available, and store them in environment variables or a secret manager.

Should AWS Flow Logs use the same scope_id as the AWS crawler?

Yes. Use the same AWS account ID for the AWS infrastructure crawler and AWS Flow Logs crawler so flow telemetry attaches to the correct AWS assets.