Cross-account cross-Region CloudWatch console

The cross-account, cross-Region CloudWatch console allows you to easily switch between different accounts and Region by using selectors in the console to view the dashboards, alarms, and metrics in other accounts and Regions. This feature also allows you to create cross-account, cross-Region dashboards which summarize your CloudWatch metrics from multiple AWS accounts and multiple Regions into a single dashboard, making them accessible without having to switch accounts or Regions.

Many organizations have their AWS resources deployed in multiple accounts, to provide billing and security boundaries. In this case, we recommend that you designate one or more of your accounts as your monitoring accounts, and build your cross-account cross-Region dashboards in these accounts. Cross-account cross-Region console functionality is integrated with AWS Organizations, to help you efficiently build your cross-account cross-Region dashboards.

The cross-account, cross-region CloudWatch console experience does not provide cross-account cross-Region visibility for logs. Additionally, it does not support the creation of alarms on metrics in other accounts or Regions from within a monitoring account.

Enabling cross-account cross-Region functionality in CloudWatch

To set up cross-account cross-Region functionality in your CloudWatch console, use the CloudWatch console to set up your sharing accounts and monitoring accounts.

Set up a sharing account

You must enable sharing in each account that will make data available to the monitoring account.

This grants the read-only permissions that you choose in step 5 to all users that view a cross account dashboard in the account that you share with, if the user has corresponding permissions in the account that you share with.

Sharing with an entire organization

Completing the preceding procedure creates an IAM role which enables your account to share data with one account. You can create or edit an IAM role that shares your data with all accounts in an organization. Do this only if you know and trust all accounts in the organization.

This grants the read-only permissions listed in the policies shown in step 5 of the previous procedure to all users that view a cross-account dashboard in the account that you share with, if the user has corresponding permissions in the account that you share with.

Set up a monitoring account

Enable each monitoring account to view cross-account CloudWatch data. You can enable a monitoring account by using the Amazon CloudWatch console or the AWS Cloud Development Kit (AWS CDK).

After you set up a monitoring account, you can create cross-account dashboards. For more information, see Creating a customized CloudWatch dashboard.

Enable a monitoring account by using the console

When you complete the following procedure, CloudWatch creates a service role that CloudWatch uses in the monitoring account to access data shared from your other accounts. This service role is called ServiceRoleForCloudWatchCrossAccountV2.

Enable a monitoring account by using the CDK

You can also set up a monitoring account without using the console. Define the ServiceRoleForCloudWatchCrossAccountV2 role as infrastructure as code. Use this approach when you manage multiple monitoring accounts. It deploys the role consistently across all of them. The following example uses the AWS CDK in TypeScript to define the role with the required trust policy and an inline permissions policy:

import { Role, ServicePrincipal, PolicyDocument, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';

new Role(this, 'ServiceRoleForCloudWatchCrossAccountV2', {
  roleName: 'ServiceRoleForCloudWatchCrossAccountV2',
  assumedBy: new ServicePrincipal('cloudwatch-crossaccount.amazonaws.com'),
  description: 'Allows CloudWatch to assume the CloudWatch-CrossAccountSharingRole in sharing accounts.',
  inlinePolicies: {
    CrossAccountAccess: new PolicyDocument({
      statements: [
        new PolicyStatement({
          effect: Effect.ALLOW,
          actions: ['sts:AssumeRole'],
          resources: ['arn:aws:iam::*:role/CloudWatch-CrossAccountSharingRole'],
        }),
      ],
    }),
  },
});

This example uses a wildcard resource, which is the least restrictive scope. To restrict the monitoring account to specific sharing accounts or to an organization, change the resources array. You can add a conditions property with an aws:ResourceOrgID condition. Either approach matches one of the inline policies in the following section.

To deploy the role to many accounts at once, use the synthesized template with CloudFormation StackSets. A stack set creates the role across multiple accounts and Regions in a single operation. A stack set also automatically deploys the role to new accounts that join your organization. For more information about CloudFormation StackSets, see Working with CloudFormation StackSets in the CloudFormation User Guide.

Scope of accounts the monitoring account can access

When you define the role with the AWS CDK, the inline permissions policy grants sts:AssumeRole permission. CloudWatch uses this permission to assume the CloudWatch-CrossAccountSharingRole in your sharing accounts. To follow the principle of least privilege, limit the Resource of the sts:AssumeRole action to only the accounts that the monitoring account needs. You can scope access in the following ways, from most restrictive to least restrictive:

Cross-Region functionality

This feature provides Cross-Region functionality automatically. You do not need to take any extra steps to display metrics from different Regions in a single account on the same graph or the same dashboard. Cross-Region functionality is not supported for alarms, so you cannot create an alarm in one Region that watches a metric in a different Region.

(Optional) Integrate with AWS Organizations

If you want to integrate cross-account functionality with AWS Organizations, you must make a list of all accounts in the organization available to the monitoring accounts.

Troubleshooting your CloudWatch cross-account setup

This section contains troubleshooting tips for cross-account, console deployment in CloudWatch.

Monitoring account permissions for cross-account access

To access an action in source accounts successfully, the user in the monitoring account must have the equivalent permission for all resources (*) for that action in the monitoring account. This is a local permission requirement in the monitoring account and is unrelated to permissions in the cross-account sharing role in source accounts.

Example

To start a Logs query in a source account, you must have wildcard (*) access to StartQuery in the monitoring account. The source account's cross-account role can still restrict access to specific log groups.

Supported - wildcard resource:

{
  "Effect": "Allow",
  "Action": "logs:StartQuery",
  "Resource": "*"
}

Not supported - specific ARN:

{
  "Effect": "Allow",
  "Action": "logs:StartQuery",
  "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/my-function:*"
}

Disabling and cleaning up after using cross-account

To disable cross-account functionality for CloudWatch, follow these steps.

Step 1: Remove the cross-account stacks or roles

The best method is to remove the CloudFormation stacks that were used to enable cross-account functionality.

If you didn't use the CloudFormation stacks to enable cross-account functionality, do the following:

Step 2: Remove the service role

In the monitoring account, delete the ServiceRoleForCloudWatchCrossAccountV2 IAM service role.