Skip to main content

AWS integrationguides

Six telephone operators in headsets working a long switchboard of jacks and cords, 1945

How Stripe, Shopify, Datadog, Okta, Terraform and eight more systems plug into AWS, written and reviewed by AWS-certified architects.

Talk to an engineer
13 guidesLast reviewed September 2026Connect onceThe guidesFAQ

Where integrations break

Integrations rarely break at the API.They break at the join:a webhook delivered twice,a key that lived too long,a role nobody scoped.

A long row of telephone operators seated at a newly installed switchboard, Salt Lake City, 1907
A new switchboard, Salt Lake City, 1907
Telephone operators in kimono seated along a switchboard in a vaulted exchange hall, Japan, 1902
Telephone exchange, Japan, 1902

Who it is for. Engineering and platform teams wiring commerce, payments, identity, data and delivery tools into an AWS estate.

What each guide holds. The reference architecture, implementation steps, failure modes, pricing and a section on when not to use the tool at all.

Who does the work. An AWS Select Tier Services Partner with 50+ AWS certifications on staff, reviewed by Solutions Architect – Professional holders.

Connect once

Pick the systems you run. The board lights the AWS services all of them meet on, so the same roles, buses and buckets carry every integration.

23AWS services carry all 13 guides. Pick yours to see where they meet.

Your systems

AWS services they meet on

  • LambdaDatadog, GitHub Actions, MongoDB Atlas, NetSuite, Okta, Salesforce, Stripe
  • S3MongoDB Atlas, NetSuite, Okta, Salesforce, Shopify, Snowflake, Terraform
  • IAMDatadog, GitHub Actions, Vault, Kubernetes, MongoDB Atlas, Terraform
  • CloudWatchDatadog, GitHub Actions, Kubernetes, LangChain
  • EKSDatadog, GitHub Actions, Vault, Kubernetes
  • PrivateLinkDatadog, Vault, Kubernetes, MongoDB Atlas
  • Secrets ManagerVault, Kubernetes, NetSuite, Stripe
  • API GatewayOkta, Salesforce, Stripe
  • AthenaNetSuite, Shopify, Snowflake
  • BedrockLangChain, MongoDB Atlas, Salesforce
  • EventBridgeSalesforce, Shopify, Stripe
  • GlueNetSuite, Shopify, Snowflake
  • Kinesis Data FirehoseDatadog, Okta, Shopify
  • KMSVault, MongoDB Atlas, Terraform
  • DynamoDBShopify, Stripe
  • ECRGitHub Actions, Kubernetes
  • IAM Identity CenterOkta, Terraform
  • OrganizationsOkta, Terraform
  • Step FunctionsNetSuite, Stripe
  • AppFlowSalesforce
  • CloudTrailGitHub Actions
  • Lake FormationSnowflake
  • RedshiftSnowflake

The 13 guides

Each one names the architecture, the AWS services it meets on, what breaks and when not to use it. Reviewed by AWS-certified architects.

How an integration engagement runs

  1. First we map what is connected.

    Your AWS accounts, the tools already in play and the gaps someone still handles by hand. Week one ends with an integration scorecard, not a slide deck.

  2. Then we pick the simplest pattern.

    AWS-native where it is credible, third-party where it wins. OIDC, IAM Identity Center, PrivateLink and KMS are the defaults.

  3. We build it in your pipelines.

    AWS-certified engineers work alongside your team in your IaC. Handoff includes runbooks, alerts, IAM policies and an owner matrix.

  4. We stay on call for 30 days.

    Then quarterly reviews of cost, security drift and new AWS features that touch the integration.

Operators in headsets at the switchboard of the Chinese Telephone Exchange, San Francisco, 1918
Chinese Telephone Exchange, San Francisco, 1918

AWS-nativeor third-party

Every guide ends with the case against the tool, so you know which side we will argue for. These are the calls we make most often.

Read the trade-offs

Workforce sign-in

IAM Identity Center beats Okta for a pure AWS shop. Okta wins for customer and partner identity at scale.

  • IAM Identity Center
  • Okta
  • OIDC

Secrets

Secrets Manager beats Vault when you run one cloud with static credentials. Vault wins on dynamic database credentials and transit encryption.

  • Secrets Manager
  • Vault
  • KMS

Observability

CloudWatch for AWS-native metrics and alarms, Datadog as the one pane for traces, custom metrics and cross-account views. ADOT stops double instrumentation.

  • CloudWatch
  • Datadog
  • ADOT

Analytics

A small AWS-only team with a predictable workload usually does better on Redshift Serverless or Athena with Iceberg. Snowflake earns its bill when analytics spans clouds.

  • Snowflake
  • Redshift Serverless
  • Athena
A wall-mounted Siemens & Halske switchboard with a hand-cranked telephone and plug cords
Siemens & Halske switchboard, Elisa Telephone Museum

Customer messages on AWS

Calls, chat, email, SMS and WhatsApp have their own offers, built on Amazon Connect, SES and the AWS messaging services.

Common questions

When should we use AWS-native vs a third-party integration?
Start with the AWS-native service when the control plane belongs with your workload (IAM Identity Center for workforce SSO, Secrets Manager for workload secrets, CloudWatch for basic infrastructure metrics, EventBridge for event routing). Add a third-party when you need a capability that AWS does not match at equivalent depth: Datadog for cross-cloud observability, Okta for customer and partner identity at scale, HashiCorp Vault for dynamic database credentials and transit encryption, Snowflake for multi-cloud analytics. Our per-integration guides include a "When NOT to use this" section specifically to make that trade-off explicit.
How do you keep integration costs from quietly escalating?
Every integration we implement ships with cost guardrails: tagged resources, a CloudWatch or Datadog cost dashboard, and — for egress-sensitive integrations — VPC endpoints, PrivateLink, or S3 Transfer Acceleration based on the actual access pattern. We also run a 90-day FinOps review against AWS Cost Optimization Hub and the Split Cost Allocation Data in CUR 2.0 so per-integration unit economics are visible, not aggregated into a generic "third-party SaaS" line.
Can I consolidate observability between Datadog and CloudWatch?
Yes, and in most mid-market AWS estates you should. The pattern we deploy most often is: CloudWatch for AWS-service-native metrics and the occasional alarm, Datadog (or an equivalent) as the single pane of glass for application traces, custom metrics, LLM observability, and cross-account correlation. AWS Distro for OpenTelemetry (ADOT) makes the hand-off clean so you are not double-instrumenting.
What does your security review look like before we connect a third-party tool to AWS?
We audit the trust relationship first: prefer OIDC federation with scoped subject claims over long-lived IAM users, require external-ID on assumed roles, confirm data residency and PrivateLink endpoints for regulated workloads, and validate the vendor against our SOC 2 / ISO 27001:2022 / HIPAA matrix. For PCI-in-scope integrations (Stripe, payment orchestrators) we validate against PCI DSS 4.0.1 specifically, including the new MFA and script integrity requirements.
Do these integrations work for multi-cloud or hybrid workloads?
Several are explicitly multi-cloud or hybrid (Okta, Datadog, HashiCorp Vault, Snowflake, MongoDB Atlas, EKS Hybrid Nodes). Where AWS offers a comparable native service we call out the decision criteria — for example, IAM Identity Center beats Okta for pure AWS shops, and AWS Secrets Manager beats Vault if you are single-cloud with straightforward static credentials. Our guides are written so an AWS-only team and a hybrid team both get an honest answer.
Can you run the integration project end-to-end, or only advise?
Both. We offer discrete advisory engagements (security review of an existing integration, architecture review before a rollout, FinOps review of an existing tool) and implementation engagements where our AWS-certified engineers build, test, and hand off the integration to your team with full documentation. Implementation engagements range from 2 weeks for a narrow scope (GitHub Actions OIDC rollout) to 12 weeks for cross-team platform changes (Okta + IAM Identity Center + AWS Verified Access).

Connect

Tell us which systems you run, and an AWS engineer will map the integration with you.

Pictures:L.M.Ericsson Manual telephone exchange circa 1910 Elisa Telephone Museum, Antti Leppänen (CC BY 4.0); Siemens & Halske telephone switchboard Elisa Telephone Museum, Antti Leppänen (CC BY 4.0); Telephone switchboard 6 Oct 1907 Salt Lake City, The Salt Lake Herald (public domain); Telephone operators, Japan, 1902 (public domain); Chinese Telephone Exchange, San Francisco, California, 1918 (public domain); WAC telephone operators at the Victory switchboard, Potsdam Conference, 1945 (public domain); American telephone practice (1905), Kempster B. Miller (no known copyright restrictions). Via Wikimedia Commons.