Amazon CloudWatch and AWS Organizations - AWS Organizations
Service-linked rolesService principalsEnable trusted accessDisable trusted accessEnable delegated administratorDisabling a delegated administrator for CloudWatch

Amazon CloudWatch and AWS Organizations

You can use Organizations for Amazon CloudWatch to discover and understand the state of telemetry configuration for your AWS resources from a central view in the CloudWatch console. This simplifies the process of auditing your telemetry collection configurations across multiple resource types across your AWS organization or account. You must enable trusted access to use telemetry config across your organization.

For more information, see Auditing telemetry configurations in the Amazon CloudWatch User Guide.

Use the following information to help you integrate Amazon CloudWatch with AWS Organizations.

Service-linked roles created when you enable integration

Create the following service-linked role in your organization's management account. The service-linked role is automatically created in member accounts when you enable trusted access. This role allows CloudWatch to perform supported operations within your organization's accounts in your organization. You can delete or modify this role only if you disable trusted access between CloudWatch and Organizations, or if you remove the member account from the organization.

  • AWSServiceRoleForObservabilityAdmin

Service principals used by the service-linked roles

The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by CloudWatch grant access to the following service principals:

  • observabilityadmin.amazonaws.com

Enabling trusted access with CloudWatch

For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.

After you have enabled trusted access you can use Amazon CloudWatch to audit telemetry configurations and manage CloudWatch related configurations across your organization. For more information, see Auditing telemetry configurations in the Amazon CloudWatch User Guide.

Important

We strongly recommend that whenever possible, you use the Amazon CloudWatch console or tools to enable integration with Organizations.

You can enable trusted access using either the Amazon CloudWatch console or the AWS Organizations console.

Important

We strongly recommend that whenever possible, you use the Amazon CloudWatch console or tools to enable integration with Organizations. This lets Amazon CloudWatch perform any configuration that it requires, such as creating resources needed by the service. Proceed with these steps only if you can’t enable integration using the tools provided by Amazon CloudWatch. For more information, see this note.

If you enable trusted access by using the Amazon CloudWatch console or tools then you don’t need to complete these steps.

You can enable trusted access by using either the AWS Organizations console, by running a AWS CLI command, or by calling an API operation in one of the AWS SDKs.

AWS Management Console
To enable trusted service access using the Organizations console

  1. Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.

  2. In the navigation pane, choose Services.

  3. Choose Amazon CloudWatch in the list of services.

  4. Choose Enable trusted access.

  5. In the Enable trusted access for Amazon CloudWatch dialog box, type enable to confirm it, and then choose Enable trusted access.

  6. If you are the administrator of only AWS Organizations, tell the administrator of Amazon CloudWatch that they can now enable that service using its console to work with AWS Organizations.

AWS CLI, AWS API
To enable trusted service access using the OrganizationsCLI/SDK

You can use the following AWS CLI commands or API operations to enable trusted service access:

  • AWS CLI: enable-aws-service-access

    You can run the following command to enable Amazon CloudWatch as a trusted service with Organizations.

    $ aws organizations enable-aws-service-access \ 
    --service-principal observabilityadmin.amazonaws.com

    This command produces no output when successful.

  • AWS API: EnableAWSServiceAccess

Disabling trusted access with CloudWatch

For information about the permissions needed to disable trusted access, see Permissions required to disable trusted access.

CloudWatch requires trusted access with Organizations to enable telemetry config to work across your member accounts.

Only an administrator in the AWS Organizations management account can disable trusted access with Amazon CloudWatch. You can disable trusted access only with the Organizations tools, using either the AWS Organizations console, running an Organizations AWS CLI command, or calling an Organizations API operation in one of the AWS SDKs.

You can disable trusted access by using either the AWS Organizations console, by running an Organizations AWS CLI command, or by calling an Organizations API operation in one of the AWS SDKs.

AWS Management Console
To disable trusted service access using the Organizations console

  1. Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.

  2. In the navigation pane, choose Services.

  3. Choose Amazon CloudWatch in the list of services.

  4. Choose Disable trusted access.

  5. In the Disable trusted access for Amazon CloudWatch dialog box, type disable to confirm it, and then choose Disable trusted access.

  6. If you are the administrator of only AWS Organizations, tell the administrator of Amazon CloudWatch that they can now disable that service using its console or tools from working with AWS Organizations.

AWS CLI, AWS API
To disable trusted service access using the Organizations CLI/SDK

You can use the following AWS CLI commands or API operations to disable trusted service access:

  • AWS CLI: disable-aws-service-access

    You can run the following command to disable Amazon CloudWatch as a trusted service with Organizations.

    $ aws organizations disable-aws-service-access \
    --service-principal observabilityadmin.amazonaws.com

    This command produces no output when successful.

  • AWS API: DisableAWSServiceAccess

Enabling a delegated administrator account for CloudWatch

Minimum permissions

Only an administrator in the Organizations management account can register a delegated administrator for CloudWatch.

You can register a delegated administrator account using the CloudWatch console, or by using the Organizations RegisterDelegatedAdministrator CLI or SDK operation. For information on how to register a delegated administrator using the CloudTrail console, see Auditing CloudWatch telemetry configurations in the Amazon CloudWatch User Guide.

Disabling a delegated administrator for CloudWatch

Only an administrator in the Organizations management account can remove a delegated administrator for CloudWatch. You can remove the delegated administrator using either the CloudWatch console, or by using the Organizations DeregisterDelegatedAdministrator CLI or SDK operation. For information on how to remove a delegated administrator using the CloudWatch console, see Auditing telemetry configurations in the Amazon CloudWatch User Guide.