Setting up telemetry configuration

Use the CloudWatch console to set up telemetry configuration for your AWS account or organization. For an organization, as a management account or a CloudWatch delegated administrator account, CloudWatch discovers AWS resources and provides visibility into the telemetry configurations across all the member accounts in the organization.

Telemetry config remains active until you turn it off. For more information, see Disabling telemetry configuration.

Prerequisites and permissions

Telemetry configuration for your organization requires trusted access between AWS Organizations and CloudWatch. When trusted access is enabled, CloudWatch creates a service-linked role named AWSServiceRoleForObservabilityAdmin to support resource and telemetry configuration discovery for the organization.

When you turn on telemetry configuration for your organization from a management account, CloudWatch automatically enables trusted access and creates the service-linked role. You do not need to set up trusted access manually before starting telemetry evaluation.

The following example JSON policy grants the additional permissions required to turn on telemetry configuration for an organization:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCreateObservabilityAdminServiceLinkedRoles",
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/observabilityadmin.amazonaws.com/AWSServiceRoleForObservabilityAdmin",
                "arn:aws:iam::*:role/aws-service-role/telemetry-enablement.observabilityadmin.amazonaws.com/AWSServiceRoleForObservabilityAdmin_TelemetryEnablement"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": [
                        "observabilityadmin.amazonaws.com",
                        "telemetry-enablement.observabilityadmin.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Sid": "AllowEnableTrustedAccessForObservabilityAdmin",
            "Effect": "Allow",
            "Action": "organizations:EnableAWSServiceAccess",
            "Resource": "*"
        }
    ]
}

For more information about the service-linked role, see Service-linked role permissions for CloudWatch telemetry config. For more information about AWS Organizations, see Amazon CloudWatch and AWS Organizations in the AWS Organizations User Guide.

Enable telemetry configuration for your account

Configure telemetry for your AWS account to monitor telemetry for the AWS resources in that account. If you have an organization in AWS Organizations, configure telemetry for your organization instead. For more information, see Configuring telemetry for your organization.

Enabling across Regions

You can extend telemetry configuration to multiple AWS Regions from a single Region. When you enable multi-Region support, the current Region becomes your home Region. Telemetry configuration is replicated to the Regions you select.

If you select All regions, new Regions are automatically included when you opt in to them. The system periodically reconciles configuration across Regions to correct any drift.

Registering a delegated administrator account for your organization

A delegated administrator account is a member account that shares administrator access for service-managed permissions. The account that you register as a delegated administrator must be in your organization. A delegated administrator account for your organization can be used outside of CloudWatch, so make sure that you understand this account type before you follow this procedure. For more information, see Amazon CloudWatch and AWS Organizations in the AWS Organizations User Guide.

To remove or change the delegated administrator account, deregister the account first. For more information, see Deregistering a delegated administrator account.

Deregistering a delegated administrator account

Deregister the delegated administrator account before turning off trusted access for AWS Organizations. You can also deregister a delegated administrator account if it no longer has access to the appropriate AWS resources for telemetry configuration or to choose a different member account to be the delegated administrator. This account will not be able to perform account management tasks for AWS Organizations. For more information, see Amazon CloudWatch and AWS Organizations in the AWS Organizations User Guide.

To register an account as a delegated administrator, see Registering a delegated administrator account for your organization.

Turning off trusted access for AWS Organizations

Trusted access extends the functionality of the management account in AWS Organizations to other AWS services. When you turn off trusted access, trusted access between your organization and all AWS services—not just CloudWatch—will stop.

If you no longer want trusted access turned on for your organization, you can turn it off. For more information, see Amazon CloudWatch and AWS Organizations in the AWS Organizations User Guide.