AWS AmazonCloudWatch documentation change
Summary
Added support for Application Signals services and SLOs in cross-account monitoring setup
Security assessment
The change adds new functionality for monitoring but does not address security specifically
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.md index faa4417bd..34f879304 100644 --- a/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.md +++ b/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.md @@ -61 +61 @@ To create links between a monitoring account and a source account, you must be s -If the link isn't going to share all five resource types (metrics, logs, traces, Application Insights applications, and Internet Monitor monitors), you can omit `cloudwatch:Link`, `logs:Link`, `xray:Link`, `applicationinsights:Link`, or `internetmonitor:Link` as needed. +If the link isn't going to share all seven resource types (metrics, logs, traces, Application Insights applications, Application Signals services and service level objectives (SLOs), and Internet Monitor monitors), you can omit `cloudwatch:Link`, `logs:Link`, `xray:Link`, `applicationinsights:Link`, `application-signals:Link`, or `internetmonitor:Link` as needed. @@ -120,0 +121,5 @@ If the link isn't going to share all five resource types (metrics, logs, traces, + }, + { + "Action": "application-signals:Link", + "Effect": "Allow", + "Resource": "*" @@ -127 +132 @@ If the link isn't going to share all five resource types (metrics, logs, traces, -If the link isn't going to share all five resource types (metrics, logs, traces, Application Insights applications, and Internet Monitor monitors), you can omit `cloudwatch:Link`, `logs:Link`, `xray:Link`, `applicationinsights:Link`, or `internetmonitor:Link` as needed. +If the link isn't going to share all seven resource types (metrics, logs, traces, Application Insights applications, Application Signals services and service level objectives (SLOs), and Internet Monitor monitors), you can omit `cloudwatch:Link`, `logs:Link`, `xray:Link`, `applicationinsights:Link`, `application-signals:Link`, or `internetmonitor:Link` as needed. @@ -182,0 +188,5 @@ If the link isn't going to share all five resource types (metrics, logs, traces, + }, + { + "Action": "application-signals:Link", + "Effect": "Allow", + "Resource": "*" @@ -255 +265 @@ To set up an account as a monitoring account, you must have certain permissions. - 5. For **Select data** , choose whether this monitoring account will be able to view **Logs** , **Metrics** , **Traces** , **Application Insights - Applications** , and **Internet Monitor - Monitors** data from the source accounts it is linked to. + 5. For **Select data** , choose whether this monitoring account will be able to view **Logs** , **Metrics** , **Traces** , **Application Insights - Applications** , **Internet Monitor - Monitors** , and **Application Signals - Services, Service Level Objectives (SLOs)** data from the source accounts it is linked to.