AWS AmazonCloudWatch documentation change

Service: AmazonCloudWatch · 2026-06-07 · Documentation medium

File: AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md

Summary

Added guidance for shared VPCs with EKS clusters and required EKS read permissions for cross-account monitoring

Security assessment

Clarifies secure configuration for network flow monitoring in complex environments. Added IAM permissions enable security visibility but don't fix vulnerabilities.

Diff

diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md
index 4c2797ed0..81627520e 100644
--- a//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md
+++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-multi-account.md
@@ -20,0 +21,4 @@ Use the guidance in the following sections to complete these steps.
+###### Shared VPC with Amazon EKS clusters
+
+If your Amazon EKS cluster runs in a member account that uses a shared subnet (a subnet owned by another account), you must create the monitor in the account that owns the subnet (typically the delegated admin or management account), not in the member account where the Amazon EKS cluster resides. A monitor created in the member account cannot match network flow data because the member account does not own the subnet resources. To monitor flows for the Amazon EKS cluster, create the monitor in the subnet-owning account and specify the Amazon EKS cluster as the local resource.
+
@@ -173,0 +178,25 @@ For each of the account in your scope, create a role, **NetworkFlowMonitorAccoun
+If you want to view Amazon EKS cluster resources from other accounts in the console, you must also add the following permissions to the **NetworkFlowMonitorAccountResourceAccess** role:
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "EKSReadAccess",
+                "Effect": "Allow",
+                "Action": [
+                    "eks:ListClusters",
+                    "eks:DescribeCluster",
+                    "eks:ListNodegroups",
+                    "eks:DescribeNodegroup",
+                    "eks:ListFargateProfiles",
+                    "eks:DescribeFargateProfile",
+                    "eks:ListAddons",
+                    "eks:DescribeAddon",
+                    "eks:AccessKubernetesApi"
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+