Amazon CloudWatch

Amazon Web Services (AWS) CloudWatch is a web service that provides real-time monitoring to Amazon's EC2 customers on their resource utilization such as CPU, disk, network and replica lag for RDS Database replicas. The metrics collected by Amazon CloudWatch enables the auto-scaling feature to dynamically add or remove EC2 instances.

In AWS CloudWatch:

Create a new AWS role for the Relyance AI integration, then give that role appropriate permissions and a trust relationship by following these steps:

1. Click Create Role.
2. Enter these details:
   • Account ID: 580082088342 (the Relyance AI AWS account ID that will be used to do the connection to your account).
   • External ID: a string, for example <yourcompany>-relyance.
3. Click the Next: Permissions button.
4. Grant CloudWatchReadOnlyAccess permission policy.
5. Click the Next: Tags button.
6. Leave the tags screen empty; click the Next button.
7. Fill in the Role Name and Description.
8. Click the Create role button.
9. Open the newly created Role.
10. Click the Trust Relationship tab.
11. Click on the Edit Trust Relationship button.
12. Change the line (if present) with “Principal”: { “AWS”: "arn:aws:iam::580082088342:root" } to “Principal”: {"AWS": "arn:aws:iam::580082088342:user/tenant-prod-access" }

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<< external ID >>"
        }
      }
    }
  ]
}

In Relyance AI:

1. Click Settings on the Relyance app menu.
2. Click Integrations from the settings menu.
3. Click the Infrastructure Integration tab.
4. Click the AWS CloudWatch card to open its connections.
5. Under Authentication Method, select IAM Assume-Role, then open the Account Details JSON editor.
6. Account Details is a JSON array, so one connection can cover several AWS accounts — add an object per account:
   • product: Tenant-specific product name that you want to associate with the integration analysis.
   • account-id: Your AWS account ID.
   • role-name: Role name you created in the AWS CloudWatch steps above.
   • external-id: The external ID string you created in the AWS CloudWatch steps above.
   • region: The AWS region where the resource exists.
7. Click Authenticate.
8. Click Authenticate.
9. Congratulations, your integration is complete!

Verify the connection is really working

Relyance reads metrics only — two actions, both reads:

CloudWatchReadOnlyAccess covers both, and the Terraform module at the end of this page grants exactly these two.

1. A failure at Authenticate is the trust policy or the external ID — both must match the connection exactly.
2. Connected but no metrics. Check the region on the connection: metrics are regional, and one connection covers one account and region.
3. Nothing in the scan window. GetMetricStatistics returns nothing for a period with no datapoints, which is indistinguishable from a permission problem in the result. Confirm in the CloudWatch console that the metric has data for the same window.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "aws_cloudwatch" {
  vendor = "aws_cloudwatch"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    params = {
      accounts = jsonencode([
        {
          account-id = ""
          external-id = ""
          product = ""
          region = ""
          role-name = ""
        }
      ])
    }
  }

  scans = { "data-inspection" = { enabled = true } }
}