Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Telemetry enablement rules

You can create telemetry enablement rules to automatically configure telemetry collection for your Amazon resources. Rules help you standardize telemetry collection across your organization or accounts and ensure consistent monitoring coverage.

How rules work

Telemetry configuration follows specific patterns when evaluating and applying rules.

Rule evaluation hierarchy

Enablement rules are evaluated according to a hierarchical pattern. Organizational rules are evaluated first, then rules that apply to organizational units (OUs), and finally rules that apply to individual accounts. Rules at the organizational level provide the baseline required telemetry for your organization. Rules at the OU and account level can collect additional telemetry data, but they cannot collect less telemetry data. If such a rule is created, it will create a rule conflict.

Within each scope (organization, OU, or account), rules must maintain uniqueness based on their resource type, telemetry type, and destination configuration. Duplicate rules trigger a conflict exception. If the same rule exists in different scopes, such as an organization level rule for Amazon VPC Flow logs to CloudWatch and an OU level rule for Amazon VPC Flow logs, the rule higher in the hierarchy is applied. However, if there are multiple conflicting rules, none of the rules are applied.

When multiple rules apply to the same resource, telemetry configuration resolves conflicts using these priorities:

Rule behavior on updates

If you update an enablement rule, only new resources that match the rule adopt the updated configuration. The existing telemetry settings remain unchanged for existing resources. If a resource becomes non-compliant with an existing rule due to manual deletion of telemetry data, the new enablement rule is adopted once the resource is brought back into compliance.

For Amazon VPC Flow logs, telemetry config only creates new flow logs for resources that match the rule scope. It does not delete or impact previously established Amazon VPC Flow logs, even if they differ from current rule parameters. For CloudWatch Logs, existing log groups are maintained provided they match the resource pattern.

Integration with Amazon Config

CloudWatch telemetry auditing and configuration integrates with Amazon Config to automatically discover resources that match your enablement rule and apply it to your telemetry data collection. When you create an enablement rule, the telemetry configuration creates a corresponding Amazon Config recorder. This recorder includes configuration items for the specific resource types you define in the enablement rule.

Amazon CloudWatch uses Amazon Config Internal service linked recorder. You are not charged for CIs that CloudWatch uses as part of the Internal Service Linked Recorders.

Telemetry config uses Amazon Config to:

Rules across Regions

When you create a rule with target Regions, the current Region becomes the home Region for that rule. The rule is automatically replicated to the spoke Regions you select.

Key concepts for multi-Region rules:

When a replicated rule is created, updated, or deleted in a spoke Region, Amazon CloudTrail records an AwsServiceEvent in the spoke Region. These events are logged with observabilityadmin.amazonaws.com as the invoking service and include the rule ARN in the spoke Region. You can use these events to audit multi-Region rule replication activity.

The following is an example Amazon CloudTrail event recorded when a replicated rule is created in a spoke Region:

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "123456789012",
        "invokedBy": "observabilityadmin.amazonaws.com"
    },
    "eventTime": "2026-04-06T19:50:37Z",
    "eventSource": "observabilityadmin.amazonaws.com",
    "eventName": "CreateTelemetryRule",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "observabilityadmin.amazonaws.com",
    "userAgent": "observabilityadmin.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "435d6da2-d099-4775-8944-1e039418de6f",
    "readOnly": false,
    "resources": [
        {
            "accountId": "123456789012",
            "type": "AWS::ObservabilityAdmin::TelemetryRule",
            "ARN": "arn:aws:observabilityadmin:us-east-1:123456789012:telemetry-rule/my-multi-region-rule"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management"
}

The eventName field reflects the operation performed on the replicated rule: CreateTelemetryRule, UpdateTelemetryRule, or DeleteTelemetryRule. The eventType is always AwsServiceEvent because the operation is performed by the ObservabilityAdmin service on behalf of the customer, not by a direct customer API call.

Creating a telemetry enablement rule

When you create a telemetry enablement rule, you specify:

Managing telemetry rules

After creating rules, you can edit or delete them. You can also view which resources each rule affects and monitor rule compliance.

Managing replicated rules

When you view a replicated rule in a spoke Region, the console displays an informational alert indicating that the rule was replicated from another Region. The Edit rule and Delete actions are disabled for replicated rules in spoke Regions.

To edit or delete a replicated rule, navigate to the home Region where the rule was originally created. The home Region is displayed in the informational alert.

You can add or modify tags on replicated rules in spoke Regions. Tag changes made in spoke Regions apply only to the local copy of the rule and are not replicated back to the home Region.

Supported data sources

The following data sources are supported by telemetry enablement rules. Each data source has specific behavior and configuration considerations.