連結監控帳戶與來源帳戶

• 若要設定監控帳戶：您必須在監控帳戶中擁有完整的系統管理員存取權，或者您必須擁有下列許可並登入該帳戶：

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "AllowSinkModification",
              "Effect": "Allow",
              "Action": [
                  "oam:CreateSink",
                  "oam:DeleteSink",
                  "oam:PutSinkPolicy",
                  "oam:TagResource"
              ],
              "Resource": "*"
          },
          {
              "Sid": "AllowReadOnly",
              "Effect": "Allow",
              "Action": ["oam:Get*", "oam:List*"],
              "Resource": "*"
          }
      ]
  }

• 範圍為特定監控帳戶的來源帳戶：若要僅針對某個指定監控帳戶建立、更新和管理連結，您必須擁有下列許可並登入該帳戶。在此範例中，監控帳戶為 999999999999。

  如果連結不會共用全部五種資源類型 (指標、記錄檔、追蹤、應用程式深入解析應用程式和網際網路監視器監視器) cloudwatch:Linklogs:Link，您可以視需要省略xray:Linkapplicationinsights:Link、、、或internetmonitor:Link。

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink",
                  "oam:DeleteLink",
                  "oam:GetLink",
                  "oam:TagResource"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:oam:*:*:link/*"
          },
          {
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:oam:*:*:sink/*",
              "Condition": {
                  "StringEquals": {
                      "aws:ResourceAccount": [
                          "999999999999"
                      ]
                  }
              }
          },
          {
              "Action": "oam:ListLinks",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "cloudwatch:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "logs:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "xray:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
               "Action": "applicationinsights:Link",
               "Effect": "Allow",
               "Resource": "*"
           },
          {
               "Action": "internetmonitor:Link",
               "Effect": "Allow",
               "Resource": "*"
          }
      ]
  }

• 具有連結至任何監視帳戶之權限的來源帳戶 — 若要建立任何現有監視帳戶接收器的連結，並共用指標、記錄群組、追蹤、Application Insights 應用程式和 Internet Monitor 監視器，您必須以完整管理員權限登入來源帳戶，或使用下列權限登入該帳戶

  如果連結不會共用全部五種資源類型 (指標、記錄檔、追蹤、應用程式深入解析應用程式和網際網路監視器監視器) cloudwatch:Linklogs:Link，您可以視需要省略xray:Linkapplicationinsights:Link、、、或internetmonitor:Link。

  {
      "Version": "2012-10-17",
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink"
              ],
              "Resource": [
                  "arn:aws:oam:*:*:link/*",
                  "arn:aws:oam:*:*:sink/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "oam:List*",
                  "oam:Get*"
              ],
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "oam:DeleteLink",
                  "oam:GetLink",
                  "oam:TagResource"
              ],
              "Resource": "arn:aws:oam:*:*:link/*"
          },
          {
              "Action": "cloudwatch:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "xray:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "logs:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
               "Action": "applicationinsights:Link",
               "Effect": "Allow",
               "Resource": "*"
          },
          {
               "Action": "internetmonitor:Link",
               "Effect": "Allow",
               "Resource": "*"
          }
      ]
  }

必要條件

• 如果您要將 AWS Organizations 組織中的帳戶設定為來源帳戶，請取得組織路徑或組織 ID。

• 如果您未將 Organizations 用於來源帳戶：請取得來源帳戶的帳戶 ID。

• 如果您要連結整個組織，則會 CloudWatch 提供 AWS CloudFormation 範本。

• 如果您要連結個別帳號 — 請使用 AWS CloudFormation 範本或提 CloudWatch 供的 URL。