Question 1

Which AWS services does Ana support?

Accepted Answer

Any AWS service reachable through the AWS SDK, subject to the permissions on the IAM role you configure. Common services include S3, EC2, CloudWatch, Lambda, RDS, DynamoDB, IAM, Cost Explorer, and CloudTrail. Admins control which services Ana can reach via IAM policy.

Question 2

Should I use keys or role assumption?

Accepted Answer

We recommend role assumption. Configure the connector to assume a dedicated TextQL IAM role using short-lived credentials. This eliminates the need to store long-lived access keys and gives you fine-grained control via IAM policies. Long-lived keys also work if needed.

Question 3

How is CloudTrail integrated?

Accepted Answer

Every API call Ana makes goes through standard AWS SDK endpoints, so all activity is automatically captured in your CloudTrail logs. You get a unified audit trail across TextQL and the rest of your AWS environment without any additional configuration.

Question 4

Can Ana write to AWS?

Accepted Answer

Yes if the IAM policy allows it. By default we recommend read-only policies. For write operations like posting SNS messages or invoking Lambda, grant only the specific actions needed. All write operations are audit-logged in CloudTrail for full traceability.

Question 5

Which AWS regions are supported?

Accepted Answer

All standard commercial AWS regions. For GovCloud, China, or sovereign regions, an admin whitelists the corresponding endpoint domains in the TextQL admin console. The same credential handling and sandboxing apply across regions.