# Amazon CloudWatch

![AWS_Cloudwatch_Logo.png](https://assets.relyanceuat.xyz/images/docs/6357449034509/13802014435085.png)
Amazon Web Services (AWS) CloudWatch is a web service that provides real-time monitoring to Amazon's EC2 customers on their resource utilization such as CPU, disk, network and replica lag for RDS Database replicas. The metrics collected by Amazon CloudWatch enables the auto-scaling feature to dynamically add or remove EC2 instances.

#### In AWS CloudWatch:

![3.jpg](https://assets.relyanceuat.xyz/images/docs/6357449034509/6357024731533.jpg)
![4.jpg](https://assets.relyanceuat.xyz/images/docs/6357449034509/6357201117837.jpg)
![5.jpg](https://assets.relyanceuat.xyz/images/docs/6357449034509/6357367880077.jpg)
![6.jpg](https://assets.relyanceuat.xyz/images/docs/6357449034509/6357318735885.jpg)
![7.jpg](https://assets.relyanceuat.xyz/images/docs/6357449034509/6357325180045.jpg)
Create a new AWS role for the Relyance AI integration, then give that role appropriate permissions and a trust relationship by following these steps:

1. Click **Create Role**.
2. Enter these details:
    - *Account ID*: **580082088342** (the Relyance AI AWS account ID that will be used to do the connection to your account).
    - *External ID*: a string, for example **`<yourcompany>`-relyance**.
3. Click the **Next: Permissions** button.
4. Grant **CloudWatchReadOnlyAccess** permission policy.
5. Click the **Next: Tags** button.
6. Leave the tags screen empty; click the **Next** button.
7. Fill in the Role Name and Description.
8. Click the **Create role** button.
9. Open the newly created Role.
10. Click the **Trust Relationship** tab.
11. Click on the **Edit Trust Relationship** button.
12. Change the line (if present) with “Principal”: { “AWS”: "arn:aws:iam::580082088342:root" } to “Principal”: {"AWS": "arn:aws:iam::580082088342:user/tenant-prod-access" }
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<< external ID >>"
        }
      }
    }
  ]
}
```

#### In Relyance AI:

![mceclip0.png](https://assets.relyanceuat.xyz/images/docs/6357449034509/6357410249101.png)
1. Click **Settings** on the Relyance app menu.
2. Click **Integrations** from the settings menu.
3. Click the **Infrastructure Integration** tab.
4. Click the AWS CloudWatch card to open its connections.
5. Under **Authentication Method**, select **IAM Assume-Role**, then open the **Account Details** JSON editor.
6. **Account Details** is a JSON *array*, so one connection can cover several AWS accounts — add an object per account:
    - *product*: Tenant-specific product name that you want to associate with the integration analysis.
    - *account-id*: Your AWS account ID.
    - *role-name*: Role name you created in the AWS CloudWatch steps above.
    - *external-id*: The external ID string you created in the AWS CloudWatch steps above.
    - *region*: The AWS region where the resource exists.
7. Click **Authenticate**.
8. Click **Authenticate**.
9. Congratulations, your integration is complete!

![9.jpg](https://assets.relyanceuat.xyz/images/docs/6357449034509/6357443673485.jpg)

### Verify the connection is really working

Relyance reads metrics only — two actions, both reads:

| Permission | Used for |
| --- | --- |
| `cloudwatch:ListMetrics` | discovering which metrics exist |
| `cloudwatch:GetMetricStatistics` | reading their values over the scan window |

**CloudWatchReadOnlyAccess** covers both, and the Terraform module at the end of
this page grants exactly these two.

1. **A failure at Authenticate** is the trust policy or the external ID — both must
   match the connection exactly.
2. **Connected but no metrics.** Check the region on the connection: metrics are
   regional, and one connection covers one account and region.
3. **Nothing in the scan window.** `GetMetricStatistics` returns nothing for a
   period with no datapoints, which is indistinguishable from a permission problem
   in the result. Confirm in the CloudWatch console that the metric has data for the
   same window.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "aws_cloudwatch" {
  vendor = "aws_cloudwatch"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    params = {
      accounts = jsonencode([
        {
          account-id = ""
          external-id = ""
          product = ""
          region = ""
          role-name = ""
        }
      ])
    }
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->