Amazon CloudWatch and AWS Organizations

You can use Organizations for Amazon CloudWatch to discover and understand the state of telemetry configuration for your AWS resources from a central view in the CloudWatch console. This simplifies the process of auditing your telemetry collection configurations across multiple resource types across your AWS organization or account.

By integrating with Organizations, you can make modifications to configurations supported by Amazon CloudWatch for Organizations. You must enable trusted access to use telemetry config across your organization.

For more information, see Auditing telemetry configurations in the Amazon CloudWatch User Guide.

Use the following information to help you integrate Amazon CloudWatch with AWS Organizations.

Service-linked roles created when you enable integration

Create the following service-linked role in your organization's management account. The service-linked role is automatically created in member accounts when you enable trusted access. This role allows CloudWatch to perform supported operations within your organization's accounts in your organization. You can delete or modify this role only if you disable trusted access between CloudWatch and Organizations, or if you remove the member account from the organization.

Service principals used by the service-linked roles

The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by CloudWatch grant access to the following service principals:

Enabling trusted access with CloudWatch

For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.

You can enable trusted access using either the Amazon CloudWatch console or the AWS Organizations console.

To enable trusted access using the CloudWatch console

See Turning on CloudWatch telemetry auditing in the Amazon CloudWatch User Guide.

You can enable trusted access by using either the AWS Organizations console, by running a AWS CLI command, or by calling an API operation in one of the AWS SDKs.

AWS Management Console

To enable trusted service access using the Organizations console

1. Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.

2. In the navigation pane, choose Services.

3. Choose Amazon CloudWatch in the list of services.

4. Choose Enable trusted access.

5. In the Enable trusted access for Amazon CloudWatch dialog box, type enable to confirm, and then choose Enable trusted access.

6. If you are the administrator of only AWS Organizations, tell the administrator of Amazon CloudWatch that they can now enable that service to work with AWS Organizations from the service console .

AWS CLI, AWS API

To enable trusted service access using the OrganizationsCLI/SDK

Use the following AWS CLI commands or API operations to enable trusted service access:

• AWS CLI: enable-aws-service-access

  Run the following command to enable Amazon CloudWatch as a trusted service with Organizations.

  $ aws organizations enable-aws-service-access \ 
      --service-principal observabilityadmin.amazonaws.com

  This command produces no output when successful.

• AWS API: EnableAWSServiceAccess

Disabling trusted access with CloudWatch

For information about the permissions needed to disable trusted access, see Permissions required to disable trusted access.

You can disable trusted access using either the Amazon CloudWatch or the AWS Organizations tools.

To disable trusted access using the CloudWatch console

See Turning off CloudWatch telemetry auditing in the Amazon CloudWatch User Guide

You can disable trusted access by running a Organizations AWS CLI command, or by calling an Organizations API operation in one of the AWS SDKs.

AWS CLI, AWS API

To disable trusted service access using the Organizations CLI/SDK

Use the following AWS CLI commands or API operations to disable trusted service access:

• AWS CLI: disable-aws-service-access

  Run the following command to disable Amazon CloudWatch as a trusted service with Organizations.

  $ aws organizations disable-aws-service-access \
      --service-principal observabilityadmin.amazonaws.com

  This command produces no output when successful.

• AWS API: DisableAWSServiceAccess

Enabling a delegated administrator account for CloudWatch

When you designate a member account as a delegated administrator for the organization, users and roles from that account can perform administrative actions for CloudWatch that otherwise can be performed only by users or roles in the organization's management account. This helps you to separate management of the organization from management of CloudWatch.

You can register a delegated administrator account using the CloudWatch console, or by using the Organizations RegisterDelegatedAdministrator CLI or SDK operation. For information on how to register a delegated administrator using the CloudWatch console, see Turning on CloudWatch telemetry auditing in the Amazon CloudWatch ser guide.

Disabling a delegated administrator for CloudWatch

You can remove the delegated administrator using either the CloudWatch console, or by using the Organizations DeregisterDelegatedAdministrator CLI or SDK operation. For more information see Turning off CloudWatch telemetry auditing in the Amazon CloudWatch User Guide.