AWS Observability Admin and AWS Organizations

Amazon CloudWatch is a monitoring service built for DevOps engineers, developers, site reliability engineers (SREs), IT managers, and product owners. By integrating with Organizations, you can make modifications to configurations supported by CloudWatch for Organizations.

You can use Organizations for CloudWatch to discover and understand the state of telemetry configuration for your AWS resources from a central view in the CloudWatch console. This simplifies the process of auditing your telemetry collection configurations across multiple resource types across your AWS organization or account. You must enable trusted access to use telemetry config across your organization. For more information see Auditing CloudWatch telemetry configurations in the Amazon CloudWatch user guide.

Use the following information to help you integrate AWS Observability Admin with AWS Organizations.

Service-linked roles created when you enable integration

The following service-linked role is automatically created in your organization's management account when you enable trusted access. This role allows Observability Admin to perform supported operations within your organization's accounts in your organization.

You can delete or modify this role only if you disable trusted access between Observability Admin and Organizations, or if you remove the member account from the organization.

Service principals used by Observability Admin

The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by Observability Admin grant access to the following service principals:

Enabling trusted access with Observability Admin

Enables the use of telemetry monitoring.

For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.

You can enable trusted access using either the AWS Observability Admin console or the AWS Organizations console.

To enable trusted access using the Observability Admin console

See Turning on CloudWatch telemetry auditing in the Amazon CloudWatch user guide.

You can enable trusted access by using either the AWS Organizations console, by running a AWS CLI command, or by calling an API operation in one of the AWS SDKs.

AWS Management Console

To enable trusted service access using the Organizations console

1. Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.

2. In the navigation pane, choose Services.

3. Choose AWS Observability Admin in the list of services.

4. Choose Enable trusted access.

5. In the Enable trusted access for AWS Observability Admin dialog box, type enable to confirm, and then choose Enable trusted access.

6. If you are the administrator of only AWS Organizations, tell the administrator of AWS Observability Admin that they can now enable that service to work with AWS Organizations from the service console .

AWS CLI, AWS API

To enable trusted service access using the OrganizationsCLI/SDK

Use the following AWS CLI commands or API operations to enable trusted service access:

• AWS CLI: enable-aws-service-access

  Run the following command to enable AWS Observability Admin as a trusted service with Organizations.

  $ aws organizations enable-aws-service-access \ 
      --service-principal observabilityadmin.amazonaws.com

  This command produces no output when successful.

• AWS API: EnableAWSServiceAccess

Disabling trusted access with Observability Admin

For information about the permissions needed to disable trusted access, see Permissions required to disable trusted access.

You can disable trusted access using either the AWS Observability Admin or the AWS Organizations tools.

To disable trusted access using the Observability Admin console

See Turning off CloudWatch telemetry auditing in the Amazon CloudWatch user guide

You can disable trusted access by running a Organizations AWS CLI command, or by calling an Organizations API operation in one of the AWS SDKs.

AWS CLI, AWS API

To disable trusted service access using the Organizations CLI/SDK

Use the following AWS CLI commands or API operations to disable trusted service access:

• AWS CLI: disable-aws-service-access

  Run the following command to disable AWS Observability Admin as a trusted service with Organizations.

  $ aws organizations disable-aws-service-access \
      --service-principal observabilityadmin.amazonaws.com

  This command produces no output when successful.

• AWS API: DisableAWSServiceAccess

Enabling a delegated administrator account for Observability Admin

When you designate a member account as a delegated administrator for the organization, users and roles from that account can perform administrative actions for Observability Admin that otherwise can be performed only by users or roles in the organization's management account. This helps you to separate management of the organization from management of Observability Admin.

You can register a delegated administrator account using the CloudWatch console, or by using the Organizations RegisterDelegatedAdministrator CLI or SDK operation. For information on how to register a delegated administrator using the CloudWatch console, see Turning on CloudWatch telemetry auditing in the Amazon CloudWatchuser guide.

Disabling a delegated administrator for Observability Admin

You can remove the delegated administrator using either the CloudWatch console, or by using the Organizations DeregisterDelegatedAdministrator CLI or SDK operation. For more information see Turning on CloudWatch telemetry auditing in the Amazon CloudWatchuser guide.