• The Amazon Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.amazonaws.cn/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html). # Azure prerequisites Complete the following steps in your Azure environment. You need the following values from the Amazon prerequisites: + **Issuer URL** — The Amazon OIDC issuer URL from the previous section. + **Subject** — The ARN of the Systems Manager Azure federation role, for example: `arn:aws:iam::{{ACCOUNT_ID}}:role/service-role/SSM-AzureRole-{{connector-name}}-{{id8}}` **To set up the Azure side of the federation** 1. **Create an Azure Entra ID application** Create an application registration in Microsoft Entra ID (formerly Azure Active Directory). Note the *Application (client) ID* from the output. ``` az ad app create --display-name "{{AWSSSMAzureIntegration}}" --query appId ``` 1. **Create a service principal for the application** Create a service principal associated with the application. Note the service principal *ID* from the output. ``` az ad sp create --id {{APPLICATION_ID}} ``` 1. **Add a federated identity credential** Add a federated identity credential to the application that trusts the Amazon OIDC issuer. This allows Azure to accept tokens issued by Amazon on behalf of the Systems Manager Azure federation role (see [Azure federation role](cloud-connector-azure-federation-role.md)). ``` az ad app federated-credential create \ --id {{APPLICATION_ID}} \ --parameters "{ \"name\": \"aws-ssm-federation\", \"issuer\": \"{{AWS_OIDC_ISSUER_URL}}\", \"subject\": \"arn:aws:iam::{{ACCOUNT_ID}}:role/service-role/SSM-AzureRole-{{CONNECTOR_NAME}}-{{ID8}}\", \"audiences\": [\"api://AzureADTokenExchange\"] }" ``` Replace: + {{APPLICATION\_ID}} — The application (client) ID from Step 1. + {{AWS\_OIDC\_ISSUER\_URL}} — The Amazon OIDC issuer URL (for example, `https://a1667813-695b-5415-b0f7-d473d62bb123.tokens.sts.global.api.aws`). + {{ACCOUNT\_ID}} — Your Amazon Web Services account ID. + {{CONNECTOR\_NAME}} — The sanitized display name of your Cloud Connector. + {{ID8}} — The first eight characters of the UUID assigned to the Azure federation role. You can find this in the role name after creating the Cloud Connector in the Amazon Web Services Management Console, or specify it when creating the role manually (see [Azure federation role](cloud-connector-azure-federation-role.md)). 1. **Create the VM Run Command custom role** Create a custom role that grants the minimum permissions required for Systems Manager to run commands on Azure VMs. Replace {{SUBSCRIPTION\_ID}} with the Azure subscription ID you want to manage. ``` az role definition create --role-definition '{ "Name": "AWSSSMVMExtensionRole-{{SUBSCRIPTION_ID}}", "Description": "Allows AWS Systems Manager to run commands on Azure VMs", "Actions": [ "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/runCommand/action", "Microsoft.Compute/virtualMachines/runCommands/*" ], "AssignableScopes": [ "/subscriptions/{{SUBSCRIPTION_ID}}" ] }' ``` For tenant-level scope (all subscriptions in the tenant), use a management group scope instead: ``` az role definition create --role-definition '{ "Name": "AWSSSMVMExtensionRole-{{TENANT_ID}}", "Description": "Allows AWS Systems Manager to run commands on Azure VMs", "Actions": [ "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/runCommand/action", "Microsoft.Compute/virtualMachines/runCommands/*" ], "AssignableScopes": [ "/providers/Microsoft.Management/managementGroups/{{TENANT_ID}}" ] }' ``` To verify the role was created: ``` az role definition list --name "AWSSSMVMExtensionRole-{{SUBSCRIPTION_ID}}" --output table ``` 1. **Assign the VM Run Command role to the service principal** Assign the custom role to the service principal you created in Step 2. The scope determines which Azure resources Systems Manager can manage. For subscription-level scope (repeat for each subscription): ``` az role assignment create \ --assignee {{SERVICE_PRINCIPAL_ID}} \ --role "AWSSSMVMExtensionRole-{{SUBSCRIPTION_ID}}" \ --scope "/subscriptions/{{SUBSCRIPTION_ID}}" ``` For management group-level scope: ``` az role assignment create \ --assignee {{SERVICE_PRINCIPAL_ID}} \ --role "AWSSSMVMExtensionRole-{{TENANT_ID}}" \ --scope "/providers/Microsoft.Management/managementGroups/{{TENANT_ID}}" ``` 1. **Create an Azure Entra ID application for Amazon Config** Create a separate application registration for Amazon Config to use when recording Azure resource state. Note the *Application (client) ID* from the output. ``` az ad app create \ --display-name "AWSConfigAzureIntegration-{{ACCOUNT_ID}}-{{TENANT_ID_PREFIX}}" \ --query appId ``` Create a service principal for the Amazon Config application: ``` az ad sp create --id {{CONFIG_APPLICATION_ID}} ``` 1. **Add a federated identity credential for Amazon Config** Add a federated identity credential to the Amazon Config application. The subject is the Amazon Config service-linked role ARN (created automatically when you create the Config connector in a later step). ``` az ad app federated-credential create \ --id {{CONFIG_APPLICATION_ID}} \ --parameters "{ \"name\": \"aws-config-federation\", \"issuer\": \"{{AWS_OIDC_ISSUER_URL}}\", \"subject\": \"arn:aws:iam::{{ACCOUNT_ID}}:role/aws-service-role/thirdparty.config.amazonaws.com/AWSServiceRoleForConfigThirdParty\", \"audiences\": [\"api://AzureADTokenExchange\"] }" ``` 1. **Assign Reader role to the Amazon Config service principal** Assign the Azure built-in Reader role to the Amazon Config service principal at the tenant (management group) level. This allows Amazon Config to discover Azure resources. ``` az role assignment create \ --assignee {{CONFIG_SERVICE_PRINCIPAL_ID}} \ --role "acdd72a7-3385-48ef-bd42-f606fba81ae7" \ --scope "/providers/Microsoft.Management/managementGroups/{{TENANT_ID}}" ``` 1. **Create an Event Hub for Azure Activity Log streaming** Amazon Config uses an Azure Event Hub to receive Activity Log events that indicate resource changes. Create an Event Hub namespace, hub, and consumer group in one of your Azure subscriptions. ``` # Create a resource group for the Event Hub az group create \ --subscription "{{HOSTING_SUBSCRIPTION_ID}}" \ --name "AWSConfigAzureResources" \ --location eastus # Create an Event Hub namespace with a discovery tag az eventhubs namespace create \ --subscription "{{HOSTING_SUBSCRIPTION_ID}}" \ --resource-group "AWSConfigAzureResources" \ --name "{{EVENT_HUB_NAMESPACE}}" \ --location eastus \ --sku Standard \ --tags "AWSConfig-{{ACCOUNT_ID}}-{{AWS_REGION}}=activitylog" # Create the Event Hub az eventhubs eventhub create \ --subscription "{{HOSTING_SUBSCRIPTION_ID}}" \ --resource-group "AWSConfigAzureResources" \ --namespace-name "{{EVENT_HUB_NAMESPACE}}" \ --name "activitylog" \ --partition-count 4 # Create the consumer group for AWS Config az eventhubs eventhub consumer-group create \ --subscription "{{HOSTING_SUBSCRIPTION_ID}}" \ --resource-group "AWSConfigAzureResources" \ --namespace-name "{{EVENT_HUB_NAMESPACE}}" \ --eventhub-name "activitylog" \ --name "AWSConfig" ``` Replace {{EVENT\_HUB\_NAMESPACE}} with a globally unique name (for example, `awsconfig-{{ACCOUNT_ID}}-{{REGION}}`) and {{HOSTING\_SUBSCRIPTION\_ID}} with the Azure subscription that will host the Event Hub resources. 1. **Assign Event Hubs Data Receiver role to the Amazon Config service principal** Allow the Amazon Config service principal to read from the Event Hub: ``` EVENT_HUB_ID=$(az eventhubs eventhub show \ --subscription "{{HOSTING_SUBSCRIPTION_ID}}" \ --resource-group "AWSConfigAzureResources" \ --namespace-name "{{EVENT_HUB_NAMESPACE}}" \ --name "activitylog" \ --query id \ -o tsv) az role assignment create \ --assignee {{CONFIG_SERVICE_PRINCIPAL_ID}} \ --role "a638d3c7-ab3a-418d-83e6-5f17a39d4fde" \ --scope "$EVENT_HUB_ID" ``` 1. **Configure Activity Log export to the Event Hub** For each Azure subscription you want Amazon Config to monitor, create a diagnostic setting that exports Activity Log events to the Event Hub: ``` az provider register \ --namespace Microsoft.Insights \ --subscription "{{SUBSCRIPTION_ID}}" az rest --method PUT \ --url "https://management.azure.com/subscriptions/{{SUBSCRIPTION_ID}}/providers/Microsoft.Insights/diagnosticSettings/{{EVENT_HUB_NAMESPACE}}?api-version=2021-05-01-preview" \ --body "{ \"properties\": { \"eventHubAuthorizationRuleId\": \"/subscriptions/{{HOSTING_SUBSCRIPTION_ID}}/resourceGroups/AWSConfigAzureResources/providers/Microsoft.EventHub/namespaces/{{EVENT_HUB_NAMESPACE}}/authorizationRules/RootManageSharedAccessKey\", \"eventHubName\": \"activitylog\", \"logs\": [{\"category\": \"Administrative\", \"enabled\": true}] } }" ``` Repeat this step for each subscription you want to monitor. After completing the Azure setup, note the following values. You need them when creating the Cloud Connector: + **Tenant ID** — Your Azure AD directory (tenant) ID. + **SSM Application (Client) ID** — The application ID of the Systems Manager Azure AD app (Step 1). + **Config Application (Client) ID** — The application ID of the Amazon Config Azure AD app (Step 6). + **Subscription IDs** — The Azure subscriptions you want to manage. + **Event Hub namespace hostname** — The fully qualified hostname of the Event Hub namespace (for example, `{{EVENT_HUB_NAMESPACE}}.servicebus.windows.net`).