CloudWatch Observability Access Monitor examples using Amazon CLI - Amazon Command Line Interface
Actions
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

This documentation is for Version 1 of the Amazon CLI only. For documentation related to Version 2 of the Amazon CLI, see the Version 2 User Guide.

CloudWatch Observability Access Monitor examples using Amazon CLI

The following code examples show you how to perform actions and implement common scenarios by using the Amazon Command Line Interface with CloudWatch Observability Access Monitor.

Actions are code excerpts from larger programs and must be run in context. While actions show you how to call individual service functions, you can see actions in context in their related scenarios.

Each example includes a link to the complete source code, where you can find instructions on how to set up and run the code in context.

Topics

Actions

The following code example shows how to use create-link.

Amazon CLI

To create a link

The following create-link example creates a link between a source account and a sink that you have created in a monitoring account.

aws oam create-link \
    --label-template sourceAccount \
    --resource-types AWS::CloudWatch::Metric \
    --sink-identifier arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345

Output:

{
    "Arn": "arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111",
    "Id": "a1b2c3d4-5678-90ab-cdef-example11111",
    "Label": "sourceAccount",
    "LabelTemplate": "sourceAccount",
    "ResourceTypes": [
        "AWS::CloudWatch::Metric"
    ],
    "SinkArn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
    "Tags": {}
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see CreateLink in Amazon CLI Command Reference.

The following code example shows how to use create-sink.

Amazon CLI

To create a sink

The following create-sink example creates a sink in the current account, so that it can be used as a monitoring account in CloudWatch cross-account observability.

aws oam create-sink \
    --name DemoSink

Output:

{
    "Arn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
    "Id": "a1b2c3d4-5678-90ab-cdef-example12345",
    "Name": "DemoSink",
    "Tags": {}
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see CreateSink in Amazon CLI Command Reference.

The following code example shows how to use delete-link.

Amazon CLI

To delete a link

The following delete-link example deletes a link between a monitoring account sink and a source account.

aws oam delete-link \
    --identifier arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111

This command produces no output.

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see DeleteLink in Amazon CLI Command Reference.

The following code example shows how to use delete-sink.

Amazon CLI

To delete a sink

The following delete-sink example deletes a sink. You must delete all links to a sink before you can delete that sink.

aws oam delete-sink \
    --identifier arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345

This command produces no output.

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see DeleteSink in Amazon CLI Command Reference.

The following code example shows how to use get-link.

Amazon CLI

To return complete information about one link

The following get-link example returns complete information about a link.

aws oam get-link \
    --identifier arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111

Output:

{
    "Arn": "arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111",
    "Id": "a1b2c3d4-5678-90ab-cdef-example11111",
    "Label": "sourceAccount",
    "LabelTemplate": "sourceAccount",
    "ResourceTypes": [
        "AWS::CloudWatch::Metric"
    ],
    "SinkArn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
    "Tags": {}
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see GetLink in Amazon CLI Command Reference.

The following code example shows how to use get-sink-policy.

Amazon CLI

To return the current sink policy attached to the sink

The following get-sink-policy example returns the current sink policy attached to the sink.

aws oam get-sink-policy \
    --sink-identifier arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345

Output:

{
    "SinkArn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
    "SinkId": "a1b2c3d4-5678-90ab-cdef-example12345",
    "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789111:root\"},\"Action\":[\"oam:CreateLink\",\"oam:UpdateLink\"],\"Resource\":\"*\",\"Condition\":{\"ForAllValues:StringEquals\":{\"oam:ResourceTypes\":[\"AWS::Logs::LogGroup\",\"AWS::CloudWatch::Metric\",\"AWS::XRay::Trace\",\"AWS::ApplicationInsights::Application\"]}}}]}"
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see GetSinkPolicy in Amazon CLI Command Reference.

The following code example shows how to use get-sink.

Amazon CLI

To return complete information about one monitoring account sink

The following get-sink example returns complete information about a monitoring account sink.

aws oam get-sink \
    --identifier arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345

Output:

{
    "Arn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
    "Id": "a1b2c3d4-5678-90ab-cdef-example12345",
    "Name": "DemoSink",
    "Tags": {}
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see GetSink in Amazon CLI Command Reference.

The following code example shows how to use list-attached-links.

Amazon CLI

To return a list of source account links that are linked to this monitoring account sink

The following list-attached-links example returns a list of source account links that are linked to this monitoring account sink.

aws oam list-attached-links \
    --sink-identifier arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345

Output:

{
    "Items": [{
        "Label": "Monitoring account",
        "LinkArn": "arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111",
        "ResourceTypes": [
            "AWS::ApplicationInsights::Application",
            "AWS::Logs::LogGroup",
            "AWS::CloudWatch::Metric",
            "AWS::XRay::Trace"
        ]
    }]
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

The following code example shows how to use list-links.

Amazon CLI

To return a list of links for one monitoring account sink

The following list-links example returns a list of links for one monitoring account sink. Run this operation in a source account to return a list of links to monitoring account sinks that this source account has.

aws oam list-links

Output:

{
    "Items": [{
        "Arn": "arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111",
        "Id": "a1b2c3d4-5678-90ab-cdef-example11111",
        "Label": "sourceAccount",
        "ResourceTypes": [
            "AWS::CloudWatch::Metric"
        ],
        "SinkArn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345"
    }]
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see ListLinks in Amazon CLI Command Reference.

The following code example shows how to use list-sinks.

Amazon CLI

To return the list of sinks created in the monitoring account

The following list-sinks example returns a list of sinks created in the monitoring account. Run this operation in a monitoring account.

aws oam list-sinks

Output:

{
    "Items": [
        {
            "Arn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
            "Id": "a1b2c3d4-5678-90ab-cdef-example12345",
            "Name": "DemoSink"
        }
    ]
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see ListSinks in Amazon CLI Command Reference.

The following code example shows how to use list-tags-for-resource.

Amazon CLI

To display the tags associated with a resource

The following list-tags-for-resource example displays the tags associated with a sink.

aws oam list-tags-for-resource \
    --resource-arn arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345

Output:

{
    "Tags": {
        "Team": "Devops"
    }
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

The following code example shows how to use put-sink-policy.

Amazon CLI

To create or update the resource policy

The following put-sink-policy example creates the resource policy that grants permissions to source accounts to link to the monitoring account sink.

aws oam put-sink-policy \
    --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789111:root"},"Action":["oam:CreateLink","oam:UpdateLink"],"Resource":"*","Condition":{"ForAllValues:StringEquals":{"oam:ResourceTypes":["AWS::Logs::LogGroup","AWS::CloudWatch::Metric","AWS::XRay::Trace","AWS::ApplicationInsights::Application"]}}}]}' \
    --sink-identifier arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345

Output:

{
    "SinkArn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
    "SinkId": "a1b2c3d4-5678-90ab-cdef-example12345",
    "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789111:root\"},\"Action\":[\"oam:CreateLink\",\"oam:UpdateLink\"],\"Resource\":\"*\",\"Condition\":{\"ForAllValues:StringEquals\":{\"oam:ResourceTypes\":[\"AWS::Logs::LogGroup\",\"AWS::CloudWatch::Metric\",\"AWS::XRay::Trace\",\"AWS::ApplicationInsights::Application\"]}}}]}"
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see PutSinkPolicy in Amazon CLI Command Reference.

The following code example shows how to use tag-resource.

Amazon CLI

To assign one or more tags to the specified resource

The following tag-resource example tags a sink arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345.

aws oam tag-resource \
    --resource-arn arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345 \
    --tags team=Devops

This command produces no output.

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see TagResource in Amazon CLI Command Reference.

The following code example shows how to use untag-resource.

Amazon CLI

To remove one or more tags from the specified resource.

The following untag-resource example removes a tag with the key team from sink arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345.

aws oam untag-resource \
    --resource-arn arn:aws:oam:us-east-2:123456789012:sink/f3f42f60-f0f2-425c-1234-12347bdd821f \
    --tag-keys team

This command produces no output.

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see UntagResource in Amazon CLI Command Reference.

The following code example shows how to use update-link.

Amazon CLI

To change what types of data are shared from a source account to its linked monitoring account sink

The following update-link example updates the link arn:aws:oam:us-east-2:123456789111:link/0123e691-e7ef-43fa-1234-c57c837fced0 with resource types AWS::CloudWatch::Metric and AWS::Logs::LogGroup.

aws oam update-link \
    --identifier arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111 \
    --resource-types "AWS::CloudWatch::Metric" "AWS::Logs::LogGroup"

Output:

{
    "Arn": "arn:aws:oam:us-east-2:123456789111:link/a1b2c3d4-5678-90ab-cdef-example11111",
    "Id": "a1b2c3d4-5678-90ab-cdef-example11111",
    "Label": "sourceAccount",
    "LabelTemplate": "sourceAccount",
    "ResourceTypes": [
        "AWS::CloudWatch::Metric",
        "AWS::Logs::LogGroup"
    ],
    "SinkArn": "arn:aws:oam:us-east-2:123456789012:sink/a1b2c3d4-5678-90ab-cdef-example12345",
    "Tags": {}
}

For more information, see CloudWatch cross-account observability in the Amazon CloudWatch User Guide.

  • For API details, see UpdateLink in Amazon CLI Command Reference.