"The checkout service is slow, I think it's one of the frontend boxes in prod." Every AWS team has seen that ticket. The agent then opens the AWS console, guesses the account, switches Regions and hunts for the instance before any real work starts.
OnLink now imports AWS into Jira Service Management Assets: accounts from AWS Organizations, and EC2 instances, Dedicated Hosts and IAM resources from AWS Resource Explorer, across every account and Region in one call. The requester picks web-frontend-01 from an Assets field, and the agent sees the account, Region and tags on the ticket.
Watch the 30-second demo:
Why put AWS in Assets
- Requesters pick the exact resource. An Assets field lists real instances by their Name tag, so nobody has to describe "the frontend box".
- Agents get context on the ticket. Account, Region, environment tag and last-seen time show up without a console login.
- Route by account. Automation reads the instance's AWS account and sends the request to the team that owns it.
- Change and incident history per resource. Link changes and incidents to the instances and accounts they touched.
- Account lifecycle in plain sight. A suspended or closing account shows on every request that references it.
- One CMDB across clouds. AWS sits next to Google Cloud, Azure, devices and people from OnLink's other 100+ sources.
How it fits together
OnLink calls AWS Organizations for accounts and Resource Explorer for instances, then writes each into its own Assets object type. The instance's owning account becomes a reference to the AWS Account object.
Authentication
OnLink signs every AWS request with Signature Version 4, using an access key for a read-only IAM user. There is no token call. Set it up once and reuse it for every AWS import.
- Turn on Resource Explorer for the organization. In the management account, run setup with Organization scope and pick one aggregator Region, such as
us-east-1. Turn it on in every Region that runs workloads. - Create an organization-wide view with tags. Views > Create view, visibility Organization-wide resources, Include tags on. The default views don't include tags, and the Name tag is the instance name. Copy the view ARN.
- Create a read-only policy and user. Allow
resource-explorer-2:Search (it authorizes ListResources), the Resource Explorer view and index reads, and organizations:List* / DescribeOrganization. Attach it to a user called onlink-assets-sync with no console access. - Create an access key for that user (use case Third-party service) and enter the key ID and secret in OnLink with auth type AWS Signature V4.
Organizations calls only work from the management account or a delegated administrator for Organizations. The signing service and Region must match the endpoint: resource-explorer-2 in the view's Region, and organizations in us-east-1. The full policy and CLI commands are in the setup guide.
The API calls
Two calls cover accounts and instances. Both are POST requests with a JSON body, and both page with a NextToken in the body.
Call | Returns | Useful fields | Paging and filters |
|---|
Resource Explorer ListResources | EC2 instances, Dedicated Hosts, IAM roles and users, one type per import | Arn, OwningAccountId, Region, LastReportedAt, tags in Properties | MaxResults 500 (at 1000 AWS returns no NextToken); FilterString such as resourcetype:ec2:instance region:us-east-1 |
Organizations ListAccounts | Every member account | Id, Name, Email, State, JoinedTimestamp, Paths | 20 per page; ListAccountsForParent with a ParentId for one OU |
POST https://resource-explorer-2.us-east-1.amazonaws.com/ListResources
Content-Type: application/json
{
"ViewArn": "arn:aws:resource-explorer-2:us-east-1:111122223333:view/onlink-org-view/1a2b3c4d-...",
"Filters": { "FilterString": "resourcetype:ec2:instance" },
"MaxResults": 500
}
Resource Explorer doesn't return instance state, type or IP address. If agents need those, the setup guide covers adding them from AWS Config.
OnLink mapping
Each object type gets its own import. Import accounts first so the instance's Account reference finds its target.
AWS Account (Organizations ListAccounts, data path Accounts)
key:Id=Account ID
map:Name=Name
map:Email=Root Email
map:State=State
map:JoinedTimestamp=Joined
map:jsonpath__Paths.0=Path
AWS EC2 Instance (Resource Explorer ListResources, data path Resources)
key:Arn=ARN
map:accountid=Account ID
map:Region=Region
map:LastReportedAt=Last Seen
Keep Account ID as a Text attribute: account IDs can start with 0. Map State, not Status, which AWS scheduled for retirement on September 9, 2026.
Filters go in the FilterString, so you import only what your service desk supports:
Filter | Example | Use it to |
|---|
region: | region:us-east-1,eu-west-1 | Import only the Regions you support |
accountid: | accountid:444455556666 | Start with one account |
tag: | tag:env=prod | Import production only |
-tag.key: | -tag.key:eks\:cluster-name | Leave out short-lived EKS nodes |
Try it
FAQ
Do I need a request per account and Region?
No. With an organization-wide Resource Explorer view, one ListResources call returns every instance across all accounts and Regions that have Resource Explorer turned on.
Does OnLink get write access to AWS?
No. The IAM policy only allows read and list actions, and the access key belongs to a user with no console access.
Why are some instance names empty?
The view doesn't include tags, or the instance has no Name tag. Recreate the view with Include tags on, and tag instances you want people to pick.
Can I import instance type, state and IP address?
Not from Resource Explorer. If you run AWS Config with an organization aggregator, a second import can add them; the setup guide shows the query.
How often does it sync?
You set a schedule per import: hourly, daily, weekly or monthly. Daily suits accounts; a few times a day suits EC2 instances that come and go.
