AWS AmazonCloudWatch documentation change
Summary
Updated Service Map documentation with new cross-account monitoring capabilities, uninstrumented service detection, enhanced grouping/filtering options, and expanded visualization features. Added multiple new screenshots and detailed explanations of account-based filtering and change event tracking.
Security assessment
The changes focus on observability improvements and feature enhancements rather than addressing security vulnerabilities. While cross-account monitoring could have security implications, the documentation update describes operational monitoring capabilities without mentioning security controls or vulnerability mitigation. The addition of uninstrumented service detection helps improve observability coverage but doesn't directly address security risks.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/ServiceMap.md b/AmazonCloudWatch/latest/monitoring/ServiceMap.md index c33b7f447..3f4f30a36 100644 --- a//AmazonCloudWatch/latest/monitoring/ServiceMap.md +++ b//AmazonCloudWatch/latest/monitoring/ServiceMap.md @@ -24,0 +25,4 @@ After you [enable your application for Application Signals](./CloudWatch-Applica + * Monitor services across multiple AWS accounts in a single unified application map. Services from different accounts are clearly identified with account information, enabling unified observability for distributed applications. + + * Identify services not yet instrumented in your application. Application Signals automatically detects and displays services that haven't been instrumented yet, helping you achieve complete observability coverage. Un-instrumented services are visually distinguished on the map to help you prioritize instrumentation efforts. + @@ -36 +40 @@ When you visit the application map, by default it shows services grouped by **Re - + @@ -50,0 +55,6 @@ If you want to define your own custom grouping, click **Manage groups** to defin +###### Note + +To enable grouping via OTEL resource attributes, the CloudWatch agent version must be v1.300056.0 or later. + + + @@ -57 +67,5 @@ For each group, you can perform the following actions: - * Click **View insight** to view metrics charts and last deployment time for the group + * Click **View more** to view metrics charts, the last two change events, and last deployment time for the group + + + + * Click **View dashboard** to view metrics dashboard, change events table, and service list for the group @@ -59 +73 @@ For each group, you can perform the following actions: - * Click **View dashboard** to view metrics dashboard and service list for the group + @@ -60,0 +75 @@ For each group, you can perform the following actions: + @@ -64 +78,0 @@ For each group, you can perform the following actions: -You can also use **Group and filter** on the left bar to filter groups which have services with deployment time, SLI health status or compute platform type. @@ -66 +80,11 @@ You can also use **Group and filter** on the left bar to filter groups which hav -Use the **Search and filter** bar to search groups by name or search groups which contain specific service environment or dependency. +You can use **Group and filter** on the left bar to filter groups which have services with deployment time, SLI health status or compute platform type. + + + +You can also filter by account to view services from specific AWS accounts in your cross-account observability setup. + + + +Use the **Search and filter** bar to search groups by name or search groups which contain specific service environment or dependency. Filter by account ID to focus on services from specific accounts. + + @@ -162,0 +187,4 @@ To view services and their dependencies in a group, click on the Group name. It +Un-instrumented services are displayed with a distinctive visual indicator (such as a dashed border or different color) to differentiate them from instrumented services. Hover over an un-instrumented service node to see instrumentation guidance and links to setup documentation. + + + @@ -164,0 +193,2 @@ All Canaries, RUM Clients and AWS Service nodes will be collapsed by default. If + + @@ -166,0 +197,2 @@ If your map is still too large to investigate effectively, you can apply nested + + @@ -171 +203,5 @@ While on this page you can also click **Save view** next to search bar to save y -Click on **View insights** in service node to view Service Audit, Change events, SLI health and Metrics graphs. + + +Click on **View more** in service node to view Service Audit, Change events, SLI health and Metrics graphs. + + @@ -173 +209 @@ Click on **View insights** in service node to view Service Audit, Change events, - +If you want to view service operation and other service detail, click on **View dashboard** to go to service overview page. @@ -175 +211 @@ Click on **View insights** in service node to view Service Audit, Change events, -If you want to view service operation and other service detail, click on **view more details** to go to service overview page. + @@ -179 +215 @@ Alternatively you can click on Edge to view metrics of a specific dependency cal -### Last deployment tracking + @@ -181 +217,3 @@ Alternatively you can click on Edge to view metrics of a specific dependency cal -Track deployment activities with Application Signals' automatic processing of CloudTrail events. Monitor deployment times for services and their dependencies, providing immediate context for operational analysis and troubleshooting. Application Signals automatically correlates deployment times with performance changes, helping you quickly identify if recent deployments contributed to service issues. View deployment history and impact across your services without additional configuration or setup requirements. +### Change Events + +Track change events across your application with Application Signals' automatic processing of CloudTrail events. Monitor configuration and deployment events for services and their dependencies, providing immediate context for operational analysis and troubleshooting. Change event detection is enabled alongside service discovery enablement through the CloudWatch Console or StartDiscovery API. For EKS services, deployment detection requires that the EKS services are instrumented with the Application Signals instrumentation SDK. Application Signals automatically correlates deployment times with performance changes, helping you quickly identify if recent deployments contributed to service issues. View change event history and impact across your services without additional configuration or setup requirements. @@ -185 +223,22 @@ Track deployment activities with Application Signals' automatic processing of Cl -Discover critical insights through Application Signals' audit findings. Application Signals analyzes your applications to report significant observations. These automated findings help you easily identify root cause of service health issues. Application Signals employs advanced analytics to detect patterns, highlight resource inefficiencies, and suggest optimization opportunities. Findings are prioritized based on severity and potential business impact, enabling teams to focus on the most critical issues first. Get actionable recommendations for improving service reliability and performance without manual analysis. +Discover critical insights through Application Signals' audit findings. The service analyzes your applications to report significant observations and potential problems, simplifying root cause analysis. These automated findings consolidate relevant traces, eliminating the need to navigate through multiple clicks. The audit system helps teams quickly identify issues and their underlying causes, enabling faster problem resolution. + +### Cross-Account Observability on Application Map + +Application Signals supports cross-account observability, allowing you to monitor and visualize services distributed across multiple AWS accounts in a single unified application map. This capability is essential for organizations with multi-account architectures following AWS best practices. + +**Key Capabilities:** + + * _Unified View_ : View services from multiple AWS accounts in a single application map, providing a complete picture of your distributed application architecture. + + * _Account Identification_ : Each service node clearly displays its account ID and region, making it easy to identify service ownership and location. + + * _Centralized Monitoring_ : Monitor the health, performance, and SLO status of services across all connected accounts from a single monitoring account. + + * _Cross-Account Filtering_ : Filter and group services by account ID to focus on specific accounts or view cross-account interactions. + + + + +**How It Works:** + +Application Signals uses AWS Organizations and cross-account sharing to enable observability across multiple accounts. To setup cross account observability please refer to [CloudWatch cross-account observability](./CloudWatch-Unified-Cross-Account.html). @@ -191,0 +251,2 @@ View your application services +**Service (Instrumented)** + @@ -210 +271 @@ When you select a service node, a pane opens displaying detailed service informa - * The **Change** section showing recent deployment history and timing. + * The **Change** section showing recent change events and the last deployment time. @@ -235,0 +297,38 @@ When you select a edge node, a pane opens displaying detailed service informatio +**Service (Un-instrumented)** + +Un-instrumented services appear on the Application Map even when they haven't been configured with Application Signals. These services are automatically discovered by leveraging Resource Explorer using application names and tags. The system can automatically detect up to 3,000 resources in your AWS account. + +When you select an un-instrumented service node, a pane opens displaying: + + * Service name and identification information + + * AccountId and region where the service is detected + + * Instrumentation status and guidance + + * Call to action button "Enable Application Signals" that provides setup instructions + + * Compute platform type (if detectable) + + + + +Un-instrumented services help you: + + * Identify gaps in your observability coverage + + * Prioritize which services to instrument next based on their position in your architecture + + * Understand the complete application topology even before full instrumentation + + * Plan instrumentation rollout across your organization + + + + +###### Note + +Un-instrumented services display limited telemetry data since they don't actively send metrics or traces. + + + @@ -242,0 +342,2 @@ Choose a dependency node to open a pane containing error rate and fault rate, me +If the dependency node is a service or resource, then the pane will display change events for the requested time range. + @@ -286 +387 @@ View detailed service information -Example: Resolve an operational health issue +Application observability for AWS Action