本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 步骤 1：创建与 OpenSearch 服务的集成
<a name="OpenSearch-Dashboards-Integrate"></a>

第一步是创建与 S OpenSearch ervice 的集成，您只需执行一次即可。创建集成将在您的账户中创建以下资源。
+ 没有高可用@@ **[性的 OpenSearch Service 时间序列集合](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-collections.html)**。

  集合是一组 OpenSearch 服务*索引*，它们协同工作以支持工作负载。
+ 集合的**两个安全策略**。一种定义了加密类型，即使用客户管理的 AWS KMS 密钥或服务拥有的密钥。另一个策略定义了网络访问权限，允许 OpenSearch 服务应用程序访问集合。有关更多信息，请参阅 [Amazon OpenSearch 服务的静态数据加密](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html)。
+ **[一种 OpenSearch 服务数据访问策略](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html)**，用于定义谁可以访问集合中的数据。
+ **[一种 OpenSearch 服务直接查询数据源，其源](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/direct-query-s3.html)**定义为 CloudWatch 日志。
+ 名@@ **[为的 OpenSearch 服务应用程序](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/application.html)**`aws-analytics`。该应用程序将配置为允许创建工作区。如果名为 `aws-analytics` 的应用程序已存在，则会对其进行更新，以添加此集合作为数据来源。
+ **[一个 OpenSearch 服务工作区](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/application.html)**，用于托管仪表板，并允许所有被授予访问权限的人从工作区读取。

**Topics**
+ [所需的权限](#OpenSearch-Dashboards-Perms)
+ [创建集成](#OpenSearch-Dashboards-Procedure)

## 所需的权限
<a name="OpenSearch-Dashboards-Perms"></a>

要创建集成，您必须登录具有**CloudWatchOpenSearchDashboardsFullAccess**托管 IAM 策略或等效权限的账户，如下所示。您还必须拥有这些权限才能删除集成、创建、编辑和删除控制面板以及手动刷新控制面板。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [{
            "Sid": "CloudWatchOpenSearchDashboardsIntegration",
            "Effect": "Allow",
            "Action": [
                "logs:ListIntegrations",
                "logs:GetIntegration",
                "logs:DeleteIntegration",
                "logs:PutIntegration",
                "logs:DescribeLogGroups",
                "opensearch:ApplicationAccessAll",
                "iam:ListRoles",
                "iam:ListUsers"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudWatchLogsOpensearchReadAPIs",
            "Effect": "Allow",
            "Action": [
                "aoss:BatchGetCollection",
                "aoss:BatchGetLifecyclePolicy",
                "es:ListApplications"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsOpensearchCreateServiceLinkedAccess",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "arn:aws:iam::*:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService",
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "opensearchservice.amazonaws.com",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsObservabilityCreateServiceLinkedAccess",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless",
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "observability.aoss.amazonaws.com",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsCollectionRequestAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:CreateCollection"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:RequestTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsApplicationRequestAccess",
            "Effect": "Allow",
            "Action": [
                "es:CreateApplication"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:RequestTag/OpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "OpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsCollectionResourceAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:DeleteCollection"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                }
            }
        },
        {
            "Sid": "CloudWatchLogsApplicationResourceAccess",
            "Effect": "Allow",
            "Action": [
                "es:UpdateApplication",
                "es:GetApplication"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/OpenSearchIntegration": [
                        "Dashboards"
                    ]
                }
            }
        },
        {
            "Sid": "CloudWatchLogsCollectionPolicyAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:CreateSecurityPolicy",
                "aoss:CreateAccessPolicy",
                "aoss:DeleteAccessPolicy",
                "aoss:DeleteSecurityPolicy",
                "aoss:GetAccessPolicy",
                "aoss:GetSecurityPolicy"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aoss:collection": "cloudwatch-logs-*",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsAPIAccessAll",
            "Effect": "Allow",
            "Action": [
                "aoss:APIAccessAll"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aoss:collection": "cloudwatch-logs-*"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsIndexPolicyAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:CreateAccessPolicy",
                "aoss:DeleteAccessPolicy",
                "aoss:GetAccessPolicy",
                "aoss:CreateLifecyclePolicy",
                "aoss:DeleteLifecyclePolicy"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aoss:index": "cloudwatch-logs-*",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsDQSRequestQueryAccess",
            "Effect": "Allow",
            "Action": [
                "es:AddDirectQueryDataSource"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:RequestTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsStartDirectQueryAccess",
            "Effect": "Allow",
            "Action": [
                "opensearch:StartDirectQuery",
                "opensearch:GetDirectQuery"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*"
        },
        {
            "Sid": "CloudWatchLogsDQSResourceQueryAccess",
            "Effect": "Allow",
            "Action": [
                "es:GetDirectQueryDataSource",
                "es:DeleteDirectQueryDataSource"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                }
            }
        },
        {
            "Sid": "CloudWatchLogsPassRoleAccess",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": "directquery.opensearchservice.amazonaws.com",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsAossTagsAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:TagResource"
            ],
            "Resource": "arn:aws:aoss:*:*:collection/*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsEsApplicationTagsAccess",
            "Effect": "Allow",
            "Action": [
                "es:AddTags"
            ],
            "Resource": "arn:aws:opensearch:*:*:application/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/OpenSearchIntegration": [
                        "Dashboards"
                    ],
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "OpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsEsDataSourceTagsAccess",
            "Effect": "Allow",
            "Action": [
                "es:AddTags"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ],
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        }
    ]
}
```

------

## 创建集成
<a name="OpenSearch-Dashboards-Procedure"></a>

请按照以下步骤创建集成。

**将 CloudWatch 日志与集成 Amazon OpenSearch Service**

1. 打开 CloudWatch 控制台，网址为[https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/)。

1. 在左侧导航窗格中，选择 **Logs Insights**，然后选择**分析方式 OpenSearch**选项卡。

1. 选择**创建集成**。

1. 在**集成名称**中，输入集成的名称。

1. （可选）要加密写入无服务器 OpenSearch 服务的数据，请在 KMS 密钥 ARN **中**输入要使用的密钥的 ARN。 AWS KMS 有关更多信息，请参阅《Amazon OpenSearch 服务开发者指南》中的[静态加密](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html)。

1. 对于**数据保留**，请输入您希望保留 OpenSearch 服务数据索引的时间长度。这同时也定义了您可以在控制面板中查看数据的最长时间段。选择较长的数据留存期将产生额外的搜索和索引费用。有关更多信息，请参阅[无服务器OpenSearch 服务定价](https://aws.amazon.com/opensearch-service/pricing/)。

   最长保留期为 30 天。

   数据保留期限还将用于创建 OpenSearch 服务收集生命周期策略。

1. 对于用于**写入 OpenSearch 集合的** IAM 角色，请创建一个新的 IAM 角色或选择用于写入 OpenSearch 服务集合的现有 IAM 角色。

   创建新角色是最简单的方法，将创建拥有必要权限的角色。
**注意**  
如果您创建了一个角色，该角色将拥有读取账户中所有日志组的权限。

   如果您想要选择一个现有角色，则该角色应具备[集成所需的权限](OpenSearch-Dashboards-CreateRole.md)中列出的权限。或者，您可以选择**使用现有角色**，然后在**验证所选角色的访问权限**部分中选择**创建角色**。这样，您可以将[集成所需的权限](OpenSearch-Dashboards-CreateRole.md)中列出的权限用作模板并进行修改。例如，如果您想对日志组进行更精细的控制。

1. 对于**可以查看控制面板的 IAM 角色和用户**，您可以选择如何向 IAM 角色和 IAM 用户授予访问公开发布的日志控制面板的权限：
   + 要将控制面板访问权限限制为仅限部分用户，请选择**选择可以查看控制面板的 IAM 角色和用户**，然后在文本框中搜索并选择要授予访问权限的 IAM 角色和 IAM 用户。
   + 要授予所有用户访问控制面板的权限，请选择**允许此账户中的所有角色和用户查看控制面板**。
**重要**  
选择角色或用户，或者选择所有用户，只会将他们添加到[访问存储仪表板数据的 OpenSearch 服务集合所需的数据访问策略](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html)中。**要让他们能够查看公开发布的日志控制面板，您还必须授予这些角色和用户 [CloudWatchOpenSearchDashboardAccess](iam-identity-based-access-control-cwl.md#managed-policies-cwl-CloudWatchOpenSearchDashboardAccess) 托管 IAM 策略。**

1. 选择**创建集成**

   创建集成需要几分钟时间。