CloudWatch

Create the read-only IAM role

Create an IAM role that ewake’s AWS account (058264427976) can assume with your External ID. The role name must start with EwakeCloudWatchReadOnly, ewake’s task role is only permitted to assume roles named this way.

If the role name does not start with EwakeCloudWatchReadOnly, ewake cannot assume it.

Option A, CloudFormation (recommended)Creates the correctly named role, trust policy, and permissions in one step. Save this template as ewake-cloudwatch-readonly.yaml:

AWSTemplateFormatVersion: '2010-09-09'
Description: >-
  Read-only IAM role that lets ewake's AI SRE query this account's Amazon
  CloudWatch metrics, logs, and alarms via cross-account AssumeRole.

Parameters:
  EwakeAccountId:
    Type: String
    Default: '058264427976'
    Description: ewake's AWS account ID (the principal allowed to assume this role). Leave as default unless ewake tells you otherwise.
    AllowedPattern: '^[0-9]{12}$'
  ExternalId:
    Type: String
    Description: Shared secret from Step 1. Use the exact value you enter in the ewake CloudWatch integration screen.
    MinLength: 8
  RoleName:
    Type: String
    Default: EwakeCloudWatchReadOnly
    Description: Keep the EwakeCloudWatchReadOnly prefix; ewake's task role is only permitted to assume roles named this way.
    AllowedPattern: '^EwakeCloudWatchReadOnly.*$'

Resources:
  EwakeCloudWatchReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${EwakeAccountId}:root'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      Policies:
        - PolicyName: EwakeCloudWatchReadOnly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CloudWatchRead
                Effect: Allow
                Resource: '*'
                Action:
                  - 'cloudwatch:DescribeAlarms'
                  - 'cloudwatch:DescribeAlarmHistory'
                  - 'cloudwatch:GetMetricData'
                  - 'cloudwatch:ListMetrics'
                  - 'logs:DescribeLogGroups'
                  - 'logs:DescribeQueryDefinitions'
                  - 'logs:ListLogAnomalyDetectors'
                  - 'logs:ListAnomalies'
                  - 'logs:StartQuery'
                  - 'logs:GetQueryResults'
                  - 'logs:StopQuery'

Outputs:
  RoleArn:
    Description: Paste this into the ewake CloudWatch integration as "Role ARN".
    Value: !GetAtt EwakeCloudWatchReadOnlyRole.Arn

Deploy it, replacing the External ID with the one from Step 1:

aws cloudformation deploy \
  --template-file ewake-cloudwatch-readonly.yaml \
  --stack-name ewake-cloudwatch-readonly \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides ExternalId="YOUR-UNIQUE-EXTERNAL-ID"

Read the Role ARN from the stack output, that is what you paste into ewake:

aws cloudformation describe-stacks \
  --stack-name ewake-cloudwatch-readonly \
  --query "Stacks[0].Outputs[?OutputKey=='RoleArn'].OutputValue" --output text

Prefer the console? Go to CloudFormation → Create stack → upload a template file, upload the same YAML, set ExternalId, and read RoleArn from the stack Outputs tab.Option B, Manual (IAM console)In the AWS IAM Console, go to Roles → Create role → Custom trust policy and paste the following, replacing YOUR-UNIQUE-EXTERNAL-ID with the ID from Step 1:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::058264427976:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "YOUR-UNIQUE-EXTERNAL-ID" }
      }
    }
  ]
}

On the next screen, create and attach this read-only permissions policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudWatchRead",
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "cloudwatch:DescribeAlarms",
        "cloudwatch:DescribeAlarmHistory",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "logs:DescribeLogGroups",
        "logs:DescribeQueryDefinitions",
        "logs:ListLogAnomalyDetectors",
        "logs:ListAnomalies",
        "logs:StartQuery",
        "logs:GetQueryResults",
        "logs:StopQuery"
      ]
    }
  ]
}

Name the role starting with EwakeCloudWatchReadOnly, create it, then copy the Role ARN from the summary page. It looks like arn:aws:iam::123456789012:role/EwakeCloudWatchReadOnly.

Field	Value
IAM Role ARN	The role ARN from Step 2
External ID	The ID generated in Step 1
AWS Region	The region where your CloudWatch data lives

Introduction

Get Started

Integrations

Working With Ewake

Interfaces

Trust & Security

Resources

FAQ

Prerequisites

How it works

Configuration

​Prerequisites

​How it works

​Configuration

Prerequisites

How it works

Configuration