AWS AmazonCloudWatch documentation change
Summary
Updated multi-account setup documentation with clearer initialization steps, added account management procedures post-initialization, and corrected agent installation link
Security assessment
Changes focus on operational clarity (delegated admin usage, scope modification cooldown) and documentation formatting. No explicit security vulnerabilities or security feature additions are mentioned. The service-linked role permissions mentioned are standard operational requirements.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md index e975a9649..cc00cb4a5 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md @@ -124 +124 @@ To add accounts to your Network Flow Monitor scope, sign in with the delegated a -After you sign in with the delegated administrator account, initialize Network Flow Monitor to authorize the required service-linked role permissions, set the scope for your network observability by adding accounts, and create an initial topology for the accounts in your scope. The account that you sign in with—in this case, the delegated administrator account—is automatically included in your Network Flow Monitor scope. To add accounts to your scope so that you can monitor network flows for resources in multiple accounts, follow the steps here. +After you sign in, follow the steps to initialize Network Flow Monitor, a process which authorizes the required service-linked role permissions, lets you set the scope for your network observability by adding accounts, and then creates an initial topology for the accounts in the scope you've set. The account that you sign in with—in this case, the delegated administrator account—is automatically included in your Network Flow Monitor scope. @@ -126 +126 @@ After you sign in with the delegated administrator account, initialize Network F -###### To add accounts to your scope +###### To initialize Network Flow Monitor with multiple accounts in your scope @@ -128 +128 @@ After you sign in with the delegated administrator account, initialize Network F - 1. Sign in to the console with your organization’s management account. + 1. Sign in to the console with your organization’s delegated administrator account. @@ -144,0 +145,21 @@ After you sign in with the delegated administrator account, initialize Network F +To add or remove accounts for your scope after you've already initialized Network Flow Monitor, follow the steps here. + +Be aware that after you make a change to your scope, either to add or delete accounts, you must wait about 20 minutes before you can make another change to the scope. This delay is because Network Flow Monitor requires a brief period of time to update its topology information. + +###### To add or remove accounts for your scope + + 1. Sign in to the console with your organization’s delegated administrator account. + + 2. In the navigation pane for the CloudWatch console, under **Network Monitoring** , choose **Flow monitors**. + + 3. Under **Monitors** , select a monitor. + + 4. On the **Monitor details** tab, under **Accounts in scope** , choose **Add** or **Delete**. + + 5. Select accounts to add to your scope, up to a total of 100 accounts, or select accounts to delete. + + 6. Complete the steps in the confirmation dialog. + + + + @@ -151 +172 @@ For each of the account in your scope, create a role, **NetworkFlowMonitorAccoun -This policy is in addition to the policy that you must add to each instance so that the Network Flow Monitor agent can send performance metrics from the instance to the Network Flow Monitor ingestion backend server. For more information about requirements for agents, see [Install Network Flow Monitor agents on instances](./CloudWatch-NetworkFlowMonitor-agents.html). +This policy is in addition to the policy that you must add to each instance so that the Network Flow Monitor agent can send performance metrics from the instance to the Network Flow Monitor ingestion backend server. For more information about requirements for agents, see [Install Network Flow Monitor agents on EC2 and self-managed Kubernetes instances](./CloudWatch-NetworkFlowMonitor-agents.html).