本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
步骤 1：创建与 OpenSearch 服务的集成
第一步是创建与 S OpenSearch ervice 的集成，您只需执行一次即可。创建集成将在您的账户中创建以下资源。
没有高可用@@ 性的 OpenSearch Service 时间序列集合。
集合是一组 OpenSearch 服务索引，它们协同工作以支持工作负载。
该集合的@@ 两项安全策略。一种定义了加密类型，即使用客户管理的 Amazon KMS 密钥或服务拥有的密钥。另一个策略定义了网络访问权限，允许 OpenSearch 服务应用程序访问集合。有关更多信息，请参阅 Amazon OpenSearch 服务的静态数据加密。
一种 OpenSearch 服务数据访问策略，用于定义谁可以访问集合中的数据。
一种 OpenSearch 服务直接查询数据源，其源定义为 CloudWatch 日志。
名@@ 为的 OpenSearch 服务应用程序
aws-analytics。该应用程序将被配置为允许创建工作区。如果名为的应用程序aws-analytics已经存在，则会对其进行更新以将此集合添加为数据源。一个 OpenSearch 服务工作区，用于托管仪表板，并允许所有被授予访问权限的人从工作区读取。
所需的权限
要创建集成，您必须登录具有CloudWatchOpenSearchDashboardsFullAccess托管 IAM 策略或等效权限的账户，如下所示。您还必须具有这些权限才能删除集成、创建、编辑和删除仪表板以及手动刷新仪表板。
{ "Version": "2012-10-17", "Statement": [{ "Sid": "CloudWatchOpenSearchDashboardsIntegration", "Effect": "Allow", "Action": [ "logs:ListIntegrations", "logs:GetIntegration", "logs:DeleteIntegration", "logs:PutIntegration", "logs:DescribeLogGroups", "opensearch:ApplicationAccessAll", "iam:ListRoles", "iam:ListUsers" ], "Resource": "*" }, { "Sid": "CloudWatchLogsOpensearchReadAPIs", "Effect": "Allow", "Action": [ "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "es:ListApplications" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsOpensearchCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService", "Condition": { "StringEquals": { "iam:AWSServiceName": "opensearchservice.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsObservabilityCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "iam:AWSServiceName": "observability.aoss.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsCollectionRequestAccess", "Effect": "Allow", "Action": [ "aoss:CreateCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsApplicationRequestAccess", "Effect": "Allow", "Action": [ "es:CreateApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/OpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsCollectionResourceAccess", "Effect": "Allow", "Action": [ "aoss:DeleteCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsApplicationResourceAccess", "Effect": "Allow", "Action": [ "es:UpdateApplication", "es:GetApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsCollectionPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateSecurityPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:DeleteSecurityPolicy", "aoss:GetAccessPolicy", "aoss:GetSecurityPolicy" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAPIAccessAll", "Effect": "Allow", "Action": [ "aoss:APIAccessAll" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*" } } }, { "Sid": "CloudWatchLogsIndexPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:GetAccessPolicy", "aoss:CreateLifecyclePolicy", "aoss:DeleteLifecyclePolicy" ], "Resource": "*", "Condition": { "StringLike": { "aoss:index": "cloudwatch-logs-*", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsDQSRequestQueryAccess", "Effect": "Allow", "Action": [ "es:AddDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsStartDirectQueryAccess", "Effect": "Allow", "Action": [ "opensearch:StartDirectQuery", "opensearch:GetDirectQuery" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*" }, { "Sid": "CloudWatchLogsDQSResourceQueryAccess", "Effect": "Allow", "Action": [ "es:GetDirectQueryDataSource", "es:DeleteDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "directquery.opensearchservice.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAossTagsAccess", "Effect": "Allow", "Action": [ "aoss:TagResource" ], "Resource": "arn:aws:aoss:*:*:collection/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsApplicationTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:application/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ], "aws:CalledViaFirst": "logs.amazonaws.com" }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsDataSourceTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:datasource/*", "Condition": { "StringEquals": { "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ], "aws:CalledViaFirst": "logs.amazonaws.com" }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } } ] }
创建集成
使用以下步骤创建集成。
将 CloudWatch 日志与集成 Amazon OpenSearch Service
打开 CloudWatch 控制台，网址为https://console.aws.amazon.com/cloudwatch/
。 在左侧导航窗格中，选择 Logs Insights，然后选择分析方式 OpenSearch选项卡。
选择创建集成。
在集成名称中，输入集成的名称。
（可选）要加密写入无服务器 OpenSearch 服务的数据，请在 KMS 密钥 ARN 中输入要使用的密钥的 ARN。 Amazon KMS 有关更多信息，请参阅《Amazon OpenSearch 服务开发者指南》中的静态加密。
对于数据保留，请输入您希望保留 OpenSearch 服务数据索引的时间长度。这还定义了您可以在仪表板中查看数据的最大时间段。选择较长的数据保留期将产生额外的搜索和索引成本。有关更多信息，请参阅无服务器OpenSearch 服务定价
。 最长保留期为 30 天。
数据保留期限还将用于创建 OpenSearch 服务收集生命周期策略。
对于用于写入 OpenSearch 集合的 IAM 角色，请创建一个新的 IAM 角色或选择用于写入 OpenSearch 服务集合的现有 IAM 角色。
创建新角色是最简单的方法，将使用必要的权限创建该角色。
注意
如果您创建了一个角色，则该角色将有权读取账户中的所有日志组。
如果要选择现有角色，则该角色应具有中列出的权限集成所需的权限。或者，您可以选择 “使用现有角色”，然后在 “验证所选角色的访问权限” 部分中选择 “创建角色”。这样，您就可以将中列出的权限集成所需的权限用作模板并对其进行修改。例如，如果您想为日志组指定更精细的控件。
对于可以查看仪表板的 IAM 角色和用户，您可以选择如何向 IAM 角色和 IAM 用户授予销售日志控制面板访问权限：
要仅允许部分用户访问控制面板，请选择选择 IAM 角色和可以查看仪表板的用户，然后在文本框中搜索并选择要授予访问权限的 IAM 角色和 IAM 用户。
要向所有用户授予控制面板访问权限，请选择允许此账户中的所有角色和用户查看仪表板。
重要
选择角色或用户，或者选择所有用户，只会将他们添加到访问存储仪表板数据的 OpenSearch 服务集合所需的数据访问策略中。为了让他们能够查看出售的日志仪表板，您还必须向这些角色和用户授予CloudWatchOpenSearchDashboardAccess托管 IAM 策略。
选择 “创建集成”
创建集成需要几分钟。