Integrations

Amazon Web Services

Dun reaches a broad slice of AWS — ECS, App Runner, Lambda, EKS, RDS, S3, ECR, CloudFront, Secrets Manager, and more — using a SigV4-signed access key. Every mutation is gated behind your approval.

Connect with an API tokenHosting28 products

Note

Every mutating action — a deploy, a scale, a secret rotation, a DNS change — surfaces a plan in chat first. Dun never touches your Amazon Web Services resources until you approve it.

How to connect

Connect once from Integrations → Amazon Web Services, then toggle on the products you want Dun to manage.

Step 1

Open AWS Console → IAM → Users → Create user (never the root account).

Step 2

Attach a policy scoped to the AWS services you want DunOps to manage (e.g. ReadOnlyAccess plus the specific write actions per service docs) — DunOps only calls a service when you use it.

Step 3

Open Security credentials → Create access key → Application running outside AWS.

Step 4

Paste the access key id, secret, and your primary region below, then click Connect.

Where to get credentials: https://console.aws.amazon.com/iam/

What Dun can do

Each product below is something you can turn on. The examples are real prompts you can type in a chat thread.

ECS

Manage ECS services — redeploy (forced new deployment), scale desired count, roll back the task-definition revision, and read awslogs.

Type in a chat thread

Redeploy my ECS service in the prod cluster
Scale my web service to 4 tasks

Permission	Required	What it does
List clusters + services	Yes	Discover where Dun can deploy.
Update services (redeploy / scale / rollback)	Yes	Deploys run only after chat approval.

App Runner

Trigger App Runner deployments, adjust the instance CPU/Memory config, and read application logs.

Type in a chat thread

Show me my Amazon Web Services app runner

Permission	Required	What it does
List services	Yes	—
Deploy + update services	Yes	Runs only after chat approval.

Lambda

Apply approved function code updates (zip or image), set reserved concurrency, roll back an alias, and read /aws/lambda logs.

Type in a chat thread

Show the latest logs for my checkout Lambda

Permission	Required	What it does
List functions	Yes	—
Update code + concurrency + aliases	Yes	—

Elastic Beanstalk

Deploy a new application version to an environment, adjust autoscaling bounds, and pull the environment log tail.

Type in a chat thread

Show me my Amazon Web Services elastic beanstalk

Permission	Required	What it does
List applications + environments	Yes	—
Update environments	Yes	Runs only after chat approval.

EKS

Inspect clusters and nodegroups, scale a nodegroup, and read Container Insights logs. (Workload rollout-restart is coming soon.)

Type in a chat thread

Show me my Amazon Web Services eks

Permission	Required	What it does
List clusters + nodegroups	Yes	—
Scale nodegroups	Optional	Runs only after chat approval.

RDS

Reboot RDS instances, take snapshots, and read recent database logs.

Type in a chat thread

Is my orders RDS instance healthy?

Permission	Required	What it does
List + inspect instances	Yes	—
Reboot + snapshot	Optional	Runs only after chat approval.

ElastiCache

Reboot ElastiCache clusters and inspect their status.

Type in a chat thread

Show me my Amazon Web Services elasticache

Permission	Required	What it does
List + inspect clusters	Yes	—
Reboot clusters	Optional	Runs only after chat approval.

Secrets Manager

Read, write, rotate, and delete secrets. Values are redacted from durable run state.

Type in a chat thread

Rotate the STRIPE_KEY secret in Secrets Manager

Permission	Required	What it does
Read + list secrets	Yes	Secret values are redacted from run history.
Write / rotate / delete	Optional	Runs only after chat approval.

Parameter Store

Read and write SSM Parameter Store parameters. SecureString values are redacted.

Type in a chat thread

Show me my Amazon Web Services parameter store

Permission	Required	What it does
Read + list parameters	Yes	SecureString values are redacted from run history.
Write parameters	Optional	Runs only after chat approval.

KMS

Inspect keys, encrypt/decrypt data, and manage key rotation. Key material is never exposed.

Type in a chat thread

Show me my Amazon Web Services kms

Permission	Required	What it does
List + inspect keys	Yes	—
Encrypt / decrypt / rotation	Optional	Decrypted plaintext is redacted; runs after approval.

CodeBuild

List CodeBuild projects and trigger builds.

Type in a chat thread

Show me my Amazon Web Services codebuild

Permission	Required	What it does
List projects + builds	Yes	—
Trigger builds	Optional	Runs only after chat approval.

CodeDeploy

List CodeDeploy applications, trigger deployments, and roll back.

Type in a chat thread

Show me my Amazon Web Services codedeploy

Permission	Required	What it does
List applications + groups	Yes	—
Trigger deploy + rollback	Optional	Runs only after chat approval.

Amplify

Trigger Amplify release jobs, roll back to a previous commit, and read build logs.

Type in a chat thread

Show me my Amazon Web Services amplify

Permission	Required	What it does
List apps + branches	Yes	—
Release + rollback	Optional	Runs only after chat approval.

API Gateway

List REST + HTTP/WebSocket APIs and deploy a stage (v1 + v2).

Type in a chat thread

Show me my Amazon Web Services api gateway

Permission	Required	What it does
List APIs + stages	Yes	—
Deploy a stage	Optional	Runs only after chat approval.

S3

List buckets + objects, generate presigned download URLs, read access-log config, and delete objects.

Type in a chat thread

List my S3 buckets

Permission	Required	What it does
List buckets + objects	Yes	—
Presign + delete objects	Optional	Presigned URLs are redacted; delete runs after approval.

ECR

List repositories + images, mint docker-login tokens (redacted), and delete images.

Type in a chat thread

Show me my Amazon Web Services ecr

Permission	Required	What it does
List repositories + images	Yes	—
Auth token + delete images	Optional	Tokens are redacted; delete runs after approval.

SNS

List SNS topics and publish messages.

Type in a chat thread

Show me my Amazon Web Services sns

Permission	Required	What it does
List + inspect topics	Yes	—
Publish messages	Optional	Runs only after chat approval.

SQS

List SQS queues, send test messages, and purge a queue (destructive).

Type in a chat thread

Show me my Amazon Web Services sqs

Permission	Required	What it does
List + inspect queues	Yes	—
Send + purge	Optional	Runs only after chat approval (purge is destructive).

CloudFront

List distributions, create cache invalidations, and read logging config.

Type in a chat thread

Show me my Amazon Web Services cloudfront

Permission	Required	What it does
List + inspect distributions	Yes	—
Create invalidations	Optional	Runs only after chat approval.

EC2

List + inspect instances, reboot/start/stop them, and read console output.

Type in a chat thread

Show me my Amazon Web Services ec2

Permission	Required	What it does
List + inspect instances	Yes	—
Reboot / start / stop	Optional	State-guarded; runs only after chat approval.

VPC

Inspect VPCs, subnets, security groups, internet gateways, and route tables. Read-only.

Type in a chat thread

Show me my Amazon Web Services vpc

Permission	Required	What it does
List + inspect networks	Yes	Read-only — no network changes.

IAM

List roles, users, and policies, inspect role detail, and simulate policy decisions. Strictly read-only.

Type in a chat thread

Show me my Amazon Web Services iam

Permission	Required	What it does
List + simulate (read-only)	Yes	DunOps never creates or modifies IAM resources.

CloudFormation

List stacks, inspect status + events (parameter values hidden), and execute a ready change set.

Type in a chat thread

Show me my Amazon Web Services cloudformation

Permission	Required	What it does
List + inspect stacks	Yes	Parameter values are never returned.
Execute change set	Optional	Runs only after chat approval.

Step Functions

List state machines, inspect executions + history, and start an execution (STANDARD + EXPRESS).

Type in a chat thread

Show me my Amazon Web Services step functions

Permission	Required	What it does
List + inspect executions	Yes	The state-machine definition is never returned.
Start an execution	Optional	Runs only after chat approval.

Load Balancers

Inspect load balancers, target groups, and per-target health. Read-only (ELBv2: ALB + NLB).

Type in a chat thread

Show me my Amazon Web Services load balancers

Permission	Required	What it does
List + inspect (read-only)	Yes	Target health is the headline; no changes are made.

SES

Manage email — verify domains (DKIM records), send test email, read sending stats, and manage the suppression list.

Type in a chat thread

Show me my Amazon Web Services ses

Permission	Required	What it does
List identities + stats	Yes	—
Verify, send + suppression	Optional	Sending + suppression changes run after chat approval.

EventBridge Scheduler

List schedules and enable or disable them.

Type in a chat thread

Show me my Amazon Web Services eventbridge scheduler

Permission	Required	What it does
List + inspect schedules	Yes	—
Enable / disable	Optional	Disable runs only after chat approval.

CloudWatch

List alarms, inspect state + history, read metric statistics, and toggle alarm actions.

Type in a chat thread

Show me my Amazon Web Services cloudwatch

Permission	Required	What it does
List alarms + metrics	Yes	—
Toggle alarm actions	Optional	Disabling alarm actions runs after chat approval.

Next steps

Browse all integrations →

See every provider Dun can connect to, grouped by category.

Key concepts →

How approval gates, plans, and the confirm-before-mutate model work.