schemaId: builtin:hyperscaler-authentication.connections.aws
scope: environment
value:
  # Connection name (free-form label)
  name: my-aws-connection

  # Currently the only supported type is awsRoleBasedAuthentication.
  type: awsRoleBasedAuthentication

  awsRoleBasedAuthentication:
    # AWS IAM role ARN. May be left empty at creation time and patched later
    # via 'dtctl update aws connection --name <name> --roleArn <arn>'.
    # Pattern: arn:aws:iam::<account-id|aws>:role/<role-name>
    roleArn: "arn:aws:iam::123456789012:role/DynatraceMonitoringRole"

    # Consumer — which Dynatrace integration is allowed to use this connection.
    #
    # IMPORTANT: the schema enforces maxObjects=1 — exactly ONE consumer per
    # connection. To wire the same AWS role into multiple consumers, create
    # one connection per consumer (they can share the same roleArn).
    #
    # Allowed values for awsRoleBasedAuthentication (from the live schema enum
    # ConsumersOfAwsRoleBasedAuthentication) — uncomment exactly one:
    consumers:
      - SVC:com.dynatrace.da             # Data Acquisition extension (default)
      # - SVC:com.dynatrace.bo           # Business Observability
      # - SVC:com.dynatrace.openpipeline # OpenPipeline
      # - SVC:com.dynatrace.grail        # Grail
