Using Amazon Config for resource discovery
CloudWatch Omni uses Amazon Config to find the Amazon resources in your account. Omni then adds those resources to the context graph. This page lists the resource types that Amazon Config records for Omni, and describes how the recorder works.
To learn how discovered resources appear in the graph, see Using Context Graph.
How the recorder works
Omni creates a service-linked configuration recorder
when you create a space. The recorder is named
AWSConfigurationRecorderForCloudWatch. You do not create
it. You do not configure it.
A service-linked recorder belongs to the service that it is linked to. That service sets the resource types to record. To learn more, see Working with the configuration recorder in the Amazon Config Developer Guide.
The recorder works as follows:
-
You pay no Amazon Config fee. Omni uses an internal recording scope. Amazon Config does not send these records to your delivery channel, and you cannot read them in Amazon Config. You can still see the recorder itself in the Amazon Config console.
-
The recorder's settings are fixed. You cannot change them in Amazon Config. You cannot rename the recorder, and you cannot start it or stop it. Omni sets which resource types the recorder records, and it records the same types in every account.
-
You can delete the recorder, but not while a space uses it. When you call
DeleteServiceLinkedConfigurationRecorder, Amazon Config asks Omni whether it still uses the recorder. While your space has an active Amazon Config integration, Omni answers yes and your call fails. To remove the recorder, delete the space first. -
Deleting the recorder stops resource discovery. Omni keeps the resources that it already found, and it adds no new ones. Amazon Config keeps the records that it already made.
-
Your own recorder is separate. Omni does not change or use your customer managed recorder.
Note
Other CloudWatch features also create service-linked recorders. Your account can hold more than one recorder that is linked to CloudWatch.
Which resources become graph nodes
Amazon Config records every type in the resource-type table on this page. Omni adds a graph node for only some of those types. Omni uses the other records to add detail to nodes that exist. For example, Omni reads subnet and security group records. It uses them to find the network address of a service.
A resource can appear in the graph before Omni gets telemetry from it. To learn more, see Using Context Graph.
Which Regions are recorded
Omni creates the recorder in the same Region as your space. The recorder records the resources in that Region.
To add the resources from another Region, centralize that Region's telemetry into the space's account. For more information, see Set up Omni for your organization.
Amazon Config makes a record only for a type that Amazon Config supports in the Region. If Amazon Config does not support a type in a Region, no resource of that type appears in the graph for that Region.
Describe calls in CloudTrail
Amazon Config takes an inventory of the resources in your account at regular times.
It does this for all resources, not only for the types that this page lists.
You can therefore see ConfigResourceCompositionSession and
AWSConfig-Describe calls in CloudTrail, including calls for
types that Omni does not record. This behavior keeps the Amazon Config inventory
consistent.
Recorded resource types
Amazon Config records the following resource types for Omni.
| Category | Amazon service | Resource types |
|---|---|---|
| Compute | Amazon App Runner | Amazon::AppRunner::Service |
| Compute | Amazon Elastic Beanstalk | Amazon::ElasticBeanstalk::Environment |
| Compute | Amazon Lambda | Amazon::Lambda::Function |
| Compute | Amazon EC2 | Amazon::EC2::Instance
Amazon::EC2::LaunchTemplate |
| Compute | Amazon EC2 Auto Scaling | Amazon::AutoScaling::AutoScalingGroup
Amazon::AutoScaling::LaunchConfiguration |
| Compute | Amazon ECS | Amazon::ECS::CapacityProvider
Amazon::ECS::Cluster
Amazon::ECS::Service
Amazon::ECS::TaskDefinition
Amazon::ECS::TaskSet |
| Compute | Amazon EKS | Amazon::EKS::Cluster
Amazon::EKS::FargateProfile
Amazon::EKS::Nodegroup |
| Compute | Amazon WorkSpaces | Amazon::WorkSpaces::Workspace |
| Networking and content delivery | Amazon Global Accelerator | Amazon::GlobalAccelerator::Accelerator |
| Networking and content delivery | Amazon CloudFront | Amazon::CloudFront::Distribution |
| Networking and content delivery | Amazon Route 53 | Amazon::Route53::HostedZone |
| Networking and content delivery | Amazon VPC | Amazon::EC2::ClientVpnEndpoint
Amazon::EC2::EIP
Amazon::EC2::FlowLog
Amazon::EC2::InternetGateway
Amazon::EC2::NatGateway
Amazon::EC2::NetworkInterface
Amazon::EC2::RouteTable
Amazon::EC2::SecurityGroup
Amazon::EC2::Subnet
Amazon::EC2::TransitGateway
Amazon::EC2::TransitGatewayAttachment
Amazon::EC2::VPC
Amazon::EC2::VPCEndpoint
Amazon::EC2::VPCPeeringConnection
Amazon::EC2::VPNConnection
Amazon::EC2::VPNGateway |
| Networking and content delivery | Elastic Load Balancing | Amazon::ElasticLoadBalancing::LoadBalancer
Amazon::ElasticLoadBalancingV2::Listener
Amazon::ElasticLoadBalancingV2::LoadBalancer
Amazon::ElasticLoadBalancingV2::TargetGroup |
| APIs | Amazon AppSync | Amazon::AppSync::GraphQLApi |
| APIs | Amazon API Gateway | Amazon::ApiGateway::Method
Amazon::ApiGateway::RestApi
Amazon::ApiGateway::Stage
Amazon::ApiGatewayV2::Api
Amazon::ApiGatewayV2::Integration
Amazon::ApiGatewayV2::Stage |
| Databases and storage | Amazon DynamoDB | Amazon::DynamoDB::Table |
| Databases and storage | Amazon EFS | Amazon::EFS::FileSystem |
| Databases and storage | Amazon Keyspaces | Amazon::Cassandra::Keyspace |
| Databases and storage | Amazon OpenSearch Service | Amazon::Elasticsearch::Domain
Amazon::OpenSearch::Domain |
| Databases and storage | Amazon QLDB | Amazon::QLDB::Ledger |
| Databases and storage | Amazon RDS | Amazon::RDS::DBCluster
Amazon::RDS::DBInstance |
| Databases and storage | Amazon Redshift | Amazon::Redshift::Cluster |
| Databases and storage | Amazon S3 | Amazon::S3::AccessPoint
Amazon::S3::Bucket |
| Application integration | Amazon IoT Core | Amazon::IoT::TopicRule |
| Application integration | Amazon Step Functions | Amazon::StepFunctions::Activity
Amazon::StepFunctions::StateMachine |
| Application integration | Amazon Data Firehose | Amazon::KinesisFirehose::DeliveryStream |
| Application integration | Amazon EventBridge | Amazon::Events::ApiDestination
Amazon::Events::Connection
Amazon::Events::EventBus
Amazon::Events::Rule |
| Application integration | Amazon EventBridge Scheduler | Amazon::Scheduler::ScheduleGroup |
| Application integration | Amazon Kinesis Data Streams | Amazon::Kinesis::Stream |
| Application integration | Amazon MQ | Amazon::AmazonMQ::Broker |
| Application integration | Amazon MSK | Amazon::MSK::Cluster
Amazon::MSK::ServerlessCluster |
| Application integration | Amazon SNS | Amazon::SNS::Topic |
| Application integration | Amazon SQS | Amazon::SQS::Queue |
| Containers and service discovery | Amazon Cloud Map | Amazon::ServiceDiscovery::HttpNamespace
Amazon::ServiceDiscovery::PublicDnsNamespace
Amazon::ServiceDiscovery::Service |
| Containers and service discovery | Amazon ECR | Amazon::ECR::PublicRepository
Amazon::ECR::Repository |
| Security and identity | Amazon Certificate Manager | Amazon::ACM::Certificate |
| Security and identity | Amazon IAM | Amazon::IAM::Policy
Amazon::IAM::Role |
| Security and identity | Amazon KMS | Amazon::KMS::Key |
| Security and identity | Amazon Network Firewall | Amazon::NetworkFirewall::Firewall |
| Security and identity | Amazon Secrets Manager | Amazon::SecretsManager::Secret |
| Security and identity | Amazon WAF | Amazon::WAFv2::WebACL |
| Security and identity | Amazon Cognito | Amazon::Cognito::IdentityPool
Amazon::Cognito::UserPool |
| Management and governance | Amazon CloudFormation | Amazon::CloudFormation::Stack |
| Management and governance | Amazon CloudTrail | Amazon::CloudTrail::Trail |
| Management and governance | Amazon CloudWatch | Amazon::CloudWatch::Alarm
Amazon::CloudWatch::MetricStream |
| Management and governance | Amazon CloudWatch Logs | Amazon::Logs::Destination |
| Machine learning | Amazon Bedrock | Amazon::Bedrock::DataSource
Amazon::Bedrock::Guardrail
Amazon::Bedrock::KnowledgeBase
Amazon::Bedrock::Prompt |
| Machine learning | Amazon Kendra | Amazon::Kendra::Index |
| Machine learning | Amazon Lex | Amazon::Lex::Bot
Amazon::Lex::BotAlias |
| Machine learning | Amazon SageMaker AI | Amazon::SageMaker::Domain
Amazon::SageMaker::EndpointConfig
Amazon::SageMaker::Model
Amazon::SageMaker::NotebookInstance |
| Analytics | Amazon Glue | Amazon::Glue::Crawler
Amazon::Glue::Database
Amazon::Glue::Job |
| Analytics | Amazon Athena | Amazon::Athena::WorkGroup |
| Analytics | Amazon QuickSight | Amazon::QuickSight::DataSource |
| Developer tools and migration | Amazon CodeBuild | Amazon::CodeBuild::Project |
| Developer tools and migration | Amazon CodeDeploy | Amazon::CodeDeploy::Application
Amazon::CodeDeploy::DeploymentGroup |
| Developer tools and migration | Amazon CodePipeline | Amazon::CodePipeline::Pipeline |
| Developer tools and migration | Amazon DMS | Amazon::DMS::ReplicationInstance |
| Developer tools and migration | Amazon Transfer Family | Amazon::Transfer::Server |
| Developer tools and migration | Amazon AppFlow | Amazon::AppFlow::Flow |
Related information
-
Working with the configuration recorder in the Amazon Config Developer Guide