将监控账户与源账户相关联

• 设置监控账户 – 您必须拥有监控账户的完全管理员访问权限，或者使用以下权限登录该账户：

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "AllowSinkModification",
              "Effect": "Allow",
              "Action": [
                  "oam:CreateSink",
                  "oam:DeleteSink",
                  "oam:PutSinkPolicy",
                  "oam:TagResource"
              ],
              "Resource": "*"
          },
          {
              "Sid": "AllowReadOnly",
              "Effect": "Allow",
              "Action": ["oam:Get*", "oam:List*"],
              "Resource": "*"
          }
      ]
  }

• 源账户，范围限定为特定的监控账户 – 如要仅为一个指定的监控账户创建、更新和管理关联，您必须至少使用以下权限登录该账户。在本示例中，监控账户为 999999999999。

  如果此关联未打算共享所有五种资源类型（指标、日志、跟踪、Application Insights 应用程序和网络检测仪监控），则可以根据需要省略 cloudwatch:Link、logs:Link、xray:Link、applicationinsights:Link 或 internetmonitor:Link。

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink",
                  "oam:DeleteLink",
                  "oam:GetLink",
                  "oam:TagResource"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:oam:*:*:link/*"
          },
          {
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:oam:*:*:sink/*",
              "Condition": {
                  "StringEquals": {
                      "aws:ResourceAccount": [
                          "999999999999"
                      ]
                  }
              }
          },
          {
              "Action": "oam:ListLinks",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "cloudwatch:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "logs:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "xray:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
               "Action": "applicationinsights:Link",
               "Effect": "Allow",
               "Resource": "*"
           },
          {
               "Action": "internetmonitor:Link",
               "Effect": "Allow",
               "Resource": "*"
          }
      ]
  }

• 源账户，具有关联到任何监控账户的权限 – 要创建与任何现有监控账户接收器的关联并共享指标、日志组、跟踪、Application Insights 应用程序和网络监测仪，您必须以完全管理员权限登录源账户或使用以下权限登录

  如果此关联未打算共享所有五种资源类型（指标、日志、跟踪、Application Insights 应用程序和网络检测仪监控），则可以根据需要省略 cloudwatch:Link、logs:Link、xray:Link、applicationinsights:Link 或 internetmonitor:Link。

  {
      "Version": "2012-10-17",
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink"
              ],
              "Resource": [
                  "arn:aws:oam:*:*:link/*",
                  "arn:aws:oam:*:*:sink/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "oam:List*",
                  "oam:Get*"
              ],
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "oam:DeleteLink",
                  "oam:GetLink",
                  "oam:TagResource"
              ],
              "Resource": "arn:aws:oam:*:*:link/*"
          },
          {
              "Action": "cloudwatch:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "xray:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "logs:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
               "Action": "applicationinsights:Link",
               "Effect": "Allow",
               "Resource": "*"
          },
          {
               "Action": "internetmonitor:Link",
               "Effect": "Allow",
               "Resource": "*"
          }
      ]
  }

• 监控账户的完整管理员访问权限

• 以下跨账户权限以及查看您将要监控的特定类型的资源所需的权限

  {
     "Sid": "AllowReadOnly",
     "Effect": "Allow",
     "Action": [
       "oam:Get*",
       "oam:List*"
     ],
     "Resource": "*"
   }

先决条件

• 如果您将 AWS Organizations 组织中的账户设置为源账户 – 获取组织路径或组织 ID。

• 如果您不使用 Organizations 作为源账户 – 获取源账户的账户 ID。

• 如果您要关联整个组织 – CloudWatch 提供了一个 AWS CloudFormation 模板。

• 如果您要关联单个账户 – 使用 AWS CloudFormation 模板或 CloudWatch 提供的 URL。