AWS AmazonCloudWatch documentation change
Summary
Major restructuring of CloudWatch telemetry configuration documentation, changing from 'auditing' terminology to 'configuration' terminology, reorganizing sections, adding multi-region support instructions, and updating navigation paths.
Security assessment
The changes are primarily terminology updates (from 'auditing' to 'configuration'), structural reorganization, and addition of multi-region configuration features. There is no evidence of addressing a specific security vulnerability, weakness, or incident. The changes focus on improving user experience and feature documentation rather than addressing security concerns.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/telemetry-config-turn-on.md b/AmazonCloudWatch/latest/monitoring/telemetry-config-turn-on.md index a0cc6632f..475a2e1fe 100644 --- a//AmazonCloudWatch/latest/monitoring/telemetry-config-turn-on.md +++ b//AmazonCloudWatch/latest/monitoring/telemetry-config-turn-on.md @@ -7 +7 @@ -Configuring Telemetry Auditing Feature for your organizationConfiguring Telemetry Auditing Feature for your accountDeregistering a delegated administrator accountTurning off trusted access for AWS Organizations +Prerequisites and permissionsEnable telemetry configuration for your accountRegistering a delegated administrator account for your organization @@ -9 +9 @@ Configuring Telemetry Auditing Feature for your organizationConfiguring Telemetr -# Turning on telemetry auditing and configuration +# Setting up telemetry configuration @@ -11 +11 @@ Configuring Telemetry Auditing Feature for your organizationConfiguring Telemetr -Use the CloudWatch console to audit and configure telemetry for your AWS account or organization. For an organization, as a AWS organization management account or a CloudWatch delegated administrator account, CloudWatch discovers AWS resources and provides visibility into the telemetry configurations across all the member accounts in the organization. +Use the CloudWatch console to set up telemetry configuration for your AWS account or organization. For an organization, as a management account or a CloudWatch delegated administrator account, CloudWatch discovers AWS resources and provides visibility into the telemetry configurations across all the member accounts in the organization. @@ -13 +13 @@ Use the CloudWatch console to audit and configure telemetry for your AWS account -Telemetry config remains active until you turn it off. For more information, see [Turning off CloudWatch telemetry configuration](./telemetry-config-turn-off.html). +Telemetry config remains active until you turn it off. For more information, see [Disabling telemetry configuration](./telemetry-config-turn-off.html). @@ -17 +17 @@ Telemetry config remains active until you turn it off. For more information, see - * Configuring Telemetry Auditing Feature for your organization + * Prerequisites and permissions @@ -19 +19 @@ Telemetry config remains active until you turn it off. For more information, see - * Configuring Telemetry Auditing Feature for your account + * Enable telemetry configuration for your account @@ -21 +21 @@ Telemetry config remains active until you turn it off. For more information, see - * Deregistering a delegated administrator account + * [Enable telemetry configuration for your organization](./telemetry-config-organization.html) @@ -23 +23 @@ Telemetry config remains active until you turn it off. For more information, see - * Turning off trusted access for AWS Organizations + * Registering a delegated administrator account for your organization @@ -28 +28 @@ Telemetry config remains active until you turn it off. For more information, see -## Configuring Telemetry Auditing Feature for your organization +## Prerequisites and permissions @@ -30 +30 @@ Telemetry config remains active until you turn it off. For more information, see -To turn on telemetry auditing and configuration experience for your organization, you must use a AWS Organization management account or a delegated administrator account. CloudWatch uses this account to discover your organization's AWS resources and configure their telemetry. +Before you can configure telemetry for your organization, you need to enable trusted access between AWS Organizations and CloudWatch. When you enable trusted access, CloudWatch creates a service-linked role named **AWSServiceRoleForObservabilityAdmin** to support resource and telemetry configuration discovery for the organization. The role is created in all member accounts of the organization. @@ -32 +32 @@ To turn on telemetry auditing and configuration experience for your organization -Before you can configure telemetry for your organization, you need to enable trusted access between AWS Organizations and CloudWatch. When you enable trusted access, CloudWatch creates a service-linked role named **AWSServiceRoleForObservabilityAdmin** to support resource and telemetry configuration discovery for the organization. The role is created in all member accounts of the organization. For more information about the service-linked role, see [Service-linked role permissions for CloudWatch telemetry config](./using-service-linked-roles.html#service-linked-role-telemetry-config). For more information about AWS Organizations, see [Amazon CloudWatch and AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-cloudwatch.html) in the AWS Organizations User Guide. +For more information about the service-linked role, see [Service-linked role permissions for CloudWatch telemetry config](./using-service-linked-roles.html#service-linked-role-telemetry-config). For more information about AWS Organizations, see [Amazon CloudWatch and AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-cloudwatch.html) in the AWS Organizations User Guide. @@ -34 +34 @@ Before you can configure telemetry for your organization, you need to enable tru -###### To turn on telemetry auditing for your organization +## Enable telemetry configuration for your account @@ -36,5 +36 @@ Before you can configure telemetry for your organization, you need to enable tru - 1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). - - 2. In the navigation pain, choose **Settings**. - - 3. Choose the **Organizations** tab. +Configure telemetry for your AWS account to monitor telemetry for the AWS resources in that account. If you have an organization in AWS Organizations, configure telemetry for your organization instead. For more information, see [Configuring telemetry for your organization](./telemetry-config-organization.html#telemetry-config-turn-on-organization). @@ -42 +38 @@ Before you can configure telemetry for your organization, you need to enable tru - 4. On the **CloudWatch** settings page, in the **Organizational settings management** pane, choose **Enable trusted access**. The **Enable trusted access** page appears. +###### To configure telemetry for your AWS account @@ -44 +40 @@ Before you can configure telemetry for your organization, you need to enable tru -To review the role policy, choose **View permission details** and the role policy appears in a window. Confirm that you want to provide these permissions to the management account by choosing **Enable trusted access**. + 1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). @@ -46 +42 @@ To review the role policy, choose **View permission details** and the role polic - 5. Under **Manage Settings** , in the **Organizations tab** in the **CloudWatch Telemetry Config** block choose **Turn on**. + 2. In the navigation pane, choose **Telemetry config**. @@ -48 +44 @@ To review the role policy, choose **View permission details** and the role polic - 6. After Telemetry config is turned on for the organization, a notification appears. On the notification, choose Go to Telemetry config. The Telemetry Configuration experience can be accessed in the **Ingestion** page and CloudWatch begins discovering AWS resources in the organization. As CloudWatch discovers resources, it updates information on the **Telemetry config** page. + 3. Choose the **Data Source** tab, and then select **Enable Resource Discovery**. CloudWatch begins discovering AWS resources in your account. As CloudWatch discovers resources, it updates information on the **Overview** page. @@ -52,2 +48 @@ To review the role policy, choose **View permission details** and the role polic -The time delay before resources appear on the **Telemetry config** page depends on the number of member accounts and resources in your organization or account. - +The delay before resources appear on the **Overview** page depends on the number of resources in your account. @@ -57 +51,0 @@ The time delay before resources appear on the **Telemetry config** page depends -### Registering a delegated administrator account for your organization @@ -59 +53 @@ The time delay before resources appear on the **Telemetry config** page depends -A delegated administrator account is a member account that shares administrator access for service-managed permissions. The account that you register as a delegated administrator must be in your organization. A delegated administrator account for your organization can be used outside of CloudWatch, so make sure that you understand this account type before you follow this procedure. For more information, see [ Amazon CloudWatch and AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-cloudwatch.html) in the AWS Organizations User Guide. +### Enabling across Regions @@ -61 +55 @@ A delegated administrator account is a member account that shares administrator -To remove or change the delegated administrator account, deregister the account first. For more information, see Deregistering a delegated administrator account. +You can extend telemetry configuration to multiple AWS Regions from a single Region. When you enable multi-Region support, the current Region becomes your _home Region_. Telemetry configuration is replicated to the Regions you select. @@ -63 +57 @@ To remove or change the delegated administrator account, deregister the account -###### To register a delegated administrator account +###### To enable telemetry configuration across Regions for your account (initial setup) @@ -67,7 +61 @@ To remove or change the delegated administrator account, deregister the account - 2. In the navigation pane, choose **Settings**. - - 3. Choose the **Organization** tab. - - 4. In the **Organizational settings management** pane, choose **Register delegated administrator**. - - 5. In the **Register delegated administrator** dialog, for **Delegated administrator account ID** , enter the 12-digit account ID for an organization member account. + 2. In the navigation pane, choose **Settings** , and then choose the **Account** tab. @@ -75 +63 @@ To remove or change the delegated administrator account, deregister the account - 6. Choose **Register delegated administrator**. At the top of the **CloudWatch settings** page, a message appears indicating the account was registered successfully. To see information about the delegated administrator account, select the number below **Delegated administrators**. + 3. In the **CloudWatch telemetry config** section on the **Global** tab, the status shows **Off**. When multi-Region is enabled, a **Target regions** selector appears inline below the status. @@ -76,0 +65 @@ To remove or change the delegated administrator account, deregister the account + 4. Use the **All regions** toggle to include all Regions, or use the multiselect dropdown to choose individual Regions. The current Region is always included automatically and is not shown in the selector. @@ -77,0 +67 @@ To remove or change the delegated administrator account, deregister the account + 5. Choose **Turn on**. @@ -78,0 +69 @@ To remove or change the delegated administrator account, deregister the account + 6. After telemetry configuration is turned on, a **Region status** table appears showing the per-Region evaluation status. @@ -80 +70,0 @@ To remove or change the delegated administrator account, deregister the account -### Configuring Telemetry Auditing Feature for your organization @@ -82 +71,0 @@ To remove or change the delegated administrator account, deregister the account -Configure telemetry for AWS Organizations to monitor the telemetry for the AWS resources across all your member accounts. This also configures the telemetry for individual accounts. You can also configure telemetry for only your account. For more information, see Configuring Telemetry Auditing Feature for your account. @@ -84 +72,0 @@ Configure telemetry for AWS Organizations to monitor the telemetry for the AWS r -You can disable trusted access across all your member accounts. For more information, see Turning off trusted access for AWS Organizations. @@ -86 +74 @@ You can disable trusted access across all your member accounts. For more informa -###### To configure telemetry auditing for your organization +###### To reconfigure Regions (telemetry already running) @@ -90 +78 @@ You can disable trusted access across all your member accounts. For more informa - 2. In the navigation pane, choose **Ingestion**. + 2. In the navigation pane, choose **Settings** , and then choose the **Account** tab. @@ -92 +80 @@ You can disable trusted access across all your member accounts. For more informa - 3. Choose **Data Sources Tab** , and then choose the **Enable Resources Discovery Button**. CloudWatch begins discovering AWS resources in your organization. As CloudWatch discovers resources, it updates information in the **Overview** page. + 3. In the **CloudWatch telemetry config** section, choose **Configure regions**. The **Target regions** selector appears inline, pre-populated with the currently configured Regions. @@ -94 +82 @@ You can disable trusted access across all your member accounts. For more informa -###### Note + 4. Modify the Region selection as needed, and then choose **Save**. @@ -96 +83,0 @@ You can disable trusted access across all your member accounts. For more informa -The delay before resources appear on the **Overview** page depends on the number of member accounts and resources in your organization. @@ -99,0 +87 @@ The delay before resources appear on the **Overview** page depends on the number +If you select **All regions** , new Regions are automatically included when you opt in to them. The system periodically reconciles configuration across Regions to correct any drift. @@ -101 +89 @@ The delay before resources appear on the **Overview** page depends on the number -## Configuring Telemetry Auditing Feature for your account +## Registering a delegated administrator account for your organization @@ -103 +91 @@ The delay before resources appear on the **Overview** page depends on the number -Configure telemetry for your AWS account to monitor telemetry for the AWS resources in that account. If you have an organization in AWS Organizations, configure telemetry for your organization instead. For more information, see Configuring Telemetry Auditing Feature for your organization. +A delegated administrator account is a member account that shares administrator access for service-managed permissions. The account that you register as a delegated administrator must be in your organization. A delegated administrator account for your organization can be used outside of CloudWatch, so make sure that you understand this account type before you follow this procedure. For more information, see [Amazon CloudWatch and AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-cloudwatch.html) in the AWS Organizations User Guide. @@ -105 +93,3 @@ Configure telemetry for your AWS account to monitor telemetry for the AWS resour -###### To configure telemetry for your AWS account +To remove or change the delegated administrator account, deregister the account first. For more information, see Deregistering a delegated administrator account. + +###### To register a delegated administrator account @@ -109 +99 @@ Configure telemetry for your AWS account to monitor telemetry for the AWS resour - 2. In the navigation pane, choose **Telemetry config**. + 2. In the navigation pane, choose **Settings**. @@ -111 +101 @@ Configure telemetry for your AWS account to monitor telemetry for the AWS resour - 3. Choose the **Data Source** tab, and then select **Enable Resource Discovery**. CloudWatch begins discovering AWS resources in your account. As CloudWatch discovers resources, it updates information on the **Overview** page. + 3. Choose the **Organization** tab. @@ -113 +103 @@ Configure telemetry for your AWS account to monitor telemetry for the AWS resour -###### Note + 4. In the **Organizational settings management** pane, choose **Register delegated administrator**. @@ -115 +105,3 @@ Configure telemetry for your AWS account to monitor telemetry for the AWS resour -The delay before resources appear on the **Overview** page depends on the number of resources in your account. + 5. In the **Register delegated administrator** dialog, for **Delegated administrator account ID** , enter the 12-digit account ID for an organization member account. + + 6. Choose **Register delegated administrator**. At the top of the **CloudWatch settings** page, a message appears indicating the account was registered successfully. To see information about the delegated administrator account, select the number below **Delegated administrators**. @@ -120 +112 @@ The delay before resources appear on the **Overview** page depends on the number -## Deregistering a delegated administrator account +### Deregistering a delegated administrator account @@ -139 +131 @@ To register an account as a delegated administrator, see Registering a delegated -## Turning off trusted access for AWS Organizations +### Turning off trusted access for AWS Organizations @@ -168 +160 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Audit and turn on AWS telemetry related configurations +What is telemetry discovery and enablement? @@ -170 +162 @@ Audit and turn on AWS telemetry related configurations -Viewing resources +Enable telemetry configuration for your organization