AWS AmazonCloudWatch documentation change
Summary
Reorganized content sections, added documentation for MCP tools querying, and moved HTTP API section to the end with condensed content.
Security assessment
The change adds documentation for MCP tools that handle authentication automatically, which is a security feature. However, there's no evidence of a security vulnerability being addressed.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-PromQL-Querying.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-PromQL-Querying.md index 5671b2c36..2835c8df1 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-PromQL-Querying.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-PromQL-Querying.md @@ -7 +7 @@ -Querying vended AWS metrics with PromQLQuerying with the HTTP APIQuerying from GrafanaQuerying from Amazon Managed Grafana +Querying vended AWS metrics with PromQLQuerying from GrafanaQuerying from Amazon Managed GrafanaQuerying with MCP toolsQuerying with the HTTP API @@ -95,69 +94,0 @@ The following example selects all time series for the EC2 `CPUUtilization` metri -## Querying with the HTTP API - -In addition to CloudWatch Query Studio and PromQL alarms, you can query CloudWatch PromQL data programmatically through Prometheus-compatible HTTP endpoints. The supported operations are listed in [Prometheus-compatible APIs](./CloudWatch-PromQL-APIs.html). - -### Endpoint - -The PromQL endpoint follows the pattern `https://monitoring.`AWS Region`.amazonaws.com/api/v1/`operation``. For example, for the US East (N. Virginia) (us-east-1) Region, the endpoint for an instant query is `https://monitoring.us-east-1.amazonaws.com/api/v1/query`. - -For the list of AWS Regions where PromQL querying is available, see [Supported AWS Regions](./CloudWatch-PromQL.html#CloudWatch-PromQL-Regions). - -### Authentication - -The endpoint authenticates callers using Signature 4 authentication. For more information, see [AWS Signature Version 4 for API requests](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html). When you sign requests, use `monitoring` as the service name and the AWS Region of the request as the signing Region. - -For the IAM actions required for each operation, see [IAM permissions for PromQL](./CloudWatch-PromQL.html#CloudWatch-PromQL-IAM). - -### Sample query with awscurl - -The [awscurl](https://pypi.org/project/awscurl/) command-line tool signs HTTP requests with SigV4 using your AWS credentials, which makes it a convenient way to call the PromQL endpoints. Install it with `pip install awscurl`. - -The PromQL endpoints expect parameters in a form-encoded request body, so all of the following examples use `POST` with `-H 'Content-Type: application/x-www-form-urlencoded'`. Without that header, `awscurl` defaults to `application/json` and the server rejects the request. - -The following example evaluates an instant query against the US East (N. Virginia) (us-east-1) endpoint: - - - awscurl --service monitoring --region us-east-1 \ - -X POST 'https://monitoring.us-east-1.amazonaws.com/api/v1/query' \ - -H 'Content-Type: application/x-www-form-urlencoded' \ - -d 'query=sum({"http.server.active_requests"})' - -A successful response uses the standard Prometheus JSON envelope: - - - { - "status": "success", - "data": { - "resultType": "vector", - "result": [ - { - "metric": {"__name__": "http.server.active_requests"}, - "value": [1780000000.000, "42"] - } - ] - } - } - -The following example lists the time series that match a selector by calling `/api/v1/series`. Series selectors support exact match (`=`), not equal (`!=`), regex match (`=~`), and negative regex match (`!~`) operators, identical to PromQL label matchers. The `start` and `end` parameters are required and bound the time range. - - - awscurl --service monitoring --region us-east-1 \ - -X POST 'https://monitoring.us-east-1.amazonaws.com/api/v1/series' \ - -H 'Content-Type: application/x-www-form-urlencoded' \ - -d 'match[]={"http.server.active_requests","@resource.service.name"="myservice"}&start=1780662000&end=1780665600' - -The following example uses a regex match selector to find series for any service name that ends in `-api`: - - - awscurl --service monitoring --region us-east-1 \ - -X POST 'https://monitoring.us-east-1.amazonaws.com/api/v1/series' \ - -H 'Content-Type: application/x-www-form-urlencoded' \ - -d 'match[]={"http.server.active_requests","@resource.service.name"=~".*-api"}&start=1780662000&end=1780665600' - -The following example lists label names by calling `/api/v1/labels`: - - - awscurl --service monitoring --region us-east-1 \ - -X POST 'https://monitoring.us-east-1.amazonaws.com/api/v1/labels' \ - -H 'Content-Type: application/x-www-form-urlencoded' - @@ -203,0 +135,24 @@ To configure the data source, complete the following steps. +## Querying with MCP tools + +The [CloudWatch MCP Server](https://awslabs.github.io/mcp/servers/cloudwatch-mcp-server/) provides Model Context Protocol (MCP) tools that let AI assistants and development tools query CloudWatch PromQL data on your behalf. The MCP tools handle authentication and request formatting automatically, so you can focus on writing PromQL queries rather than managing HTTP requests and SigV4 signing. + +The following PromQL tools are available in the CloudWatch MCP Server: + +Tool | Description +---|--- +`execute_promql_query` | Runs an instant PromQL query, returning metric values at a single point in time. +`execute_promql_range_query` | Runs a PromQL range query over a time window, returning time series data for trend analysis and graphing. +`get_promql_label_values` | Retrieves values for a specific PromQL label, such as `__name__` for metric names or `@resource.service.name` for services. +`get_promql_series` | Finds time series matching PromQL label selectors and returns the full label set of each matching series. +`get_promql_labels` | Lists all available PromQL label names to help discover the label structure of your metrics. + +For full details on parameters, configuration, and setup instructions, see [Tools for CloudWatch PromQL](https://awslabs.github.io/mcp/servers/cloudwatch-mcp-server#tools-for-cloudwatch-promql) in the CloudWatch MCP Server documentation. + +## Querying with the HTTP API + +You can also query CloudWatch PromQL data programmatically by calling the Prometheus-compatible HTTP endpoints directly. Requests must be signed with [AWS Signature Version 4](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html) using `monitoring` as the service name. + +The PromQL endpoint follows the pattern `https://monitoring.`AWS Region`.amazonaws.com/api/v1/`operation``. For example, for the US East (N. Virginia) (us-east-1) Region, the endpoint for an instant query is `https://monitoring.us-east-1.amazonaws.com/api/v1/query`. + +For the full API reference, including supported operations, request parameters, and response formats, see [Prometheus-compatible APIs](./CloudWatch-PromQL-APIs.html). For the list of AWS Regions where PromQL querying is available, see [Supported AWS Regions](./CloudWatch-PromQL.html#CloudWatch-PromQL-Regions). For the IAM actions required for each operation, see [IAM permissions for PromQL](./CloudWatch-PromQL.html#CloudWatch-PromQL-IAM). +