Amazon Web Services#

Collects CloudWatch metrics, resource inventory, CloudTrail audit events and Cost Explorer spend.

Choose an access method#

An IAM role with an external ID is recommended. Nothing long-lived is stored, and you can revoke it in one action.

Access keys are simpler to set up and appropriate for a trial or where role assumption is not possible.

Option A: IAM role#

1. In ObserveIQ open Integrations → AWS → Add account. Copy the ObserveIQ account ID and the generated external ID shown on screen.
2. In the AWS console create a role with a trusted entity of AWS account, enter the ObserveIQ account ID, tick Require external ID and paste the external ID.
3. Attach the AWS managed policy ReadOnlyAccess, or the narrower policy below.
4. Copy the role ARN back into ObserveIQ and save.

Option B: Access keys#

Create an IAM user with no console access, attach the policy below, create an access key, and paste the key ID and secret into ObserveIQ.

Minimum permissions#

ReadOnlyAccess works. To be narrower:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "cloudwatch:GetMetricData",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:ListMetrics",
      "cloudwatch:DescribeAlarms",
      "logs:DescribeLogGroups",
      "logs:FilterLogEvents",
      "logs:GetLogEvents",
      "ec2:Describe*",
      "rds:Describe*",
      "lambda:List*",
      "lambda:GetFunctionConfiguration",
      "ecs:List*", "ecs:Describe*",
      "eks:List*", "eks:Describe*",
      "elasticloadbalancing:Describe*",
      "s3:ListAllMyBuckets", "s3:GetBucketLocation",
      "cloudfront:List*",
      "apigateway:GET",
      "dynamodb:List*", "dynamodb:DescribeTable",
      "elasticache:Describe*",
      "sqs:ListQueues", "sqs:GetQueueAttributes",
      "sns:List*",
      "route53:List*",
      "cloudtrail:LookupEvents",
      "ce:GetCostAndUsage", "ce:GetCostForecast",
      "organizations:ListAccounts",
      "tag:GetResources",
      "sts:GetCallerIdentity"
    ],
    "Resource": "*"
  }]
}

Every action is read-only. Nothing here can change your account.

Choose regions and services#

Select the regions you operate in. Each region is polled separately, so adding regions you do not use costs CloudWatch API calls for no benefit.

Then select services. Common starting points:

Cost Explorer#

Cost data requires ce:GetCostAndUsage, and Cost Explorer must be enabled in the AWS account first. Costs are refreshed daily, because AWS itself updates them daily. See Cost Explorer.

For AWS Organizations, connect the management account to get consolidated spend across every member account.

Lambda#

Lambda gets extra treatment. Beyond CloudWatch metrics, ObserveIQ reads the function log group and extracts cold starts, initialisation duration, billed duration and maximum memory used. These are not available as CloudWatch metrics and are the numbers that actually explain Lambda performance and cost. Enable log collection on the Lambda service for this to work.

For tracing inside Lambda, see APM setup.

Verify#

After the first collection interval, open Cloud → Explorer. You should see EC2 instances, RDS instances and other selected resources. If the integration shows connected but nothing is listed, confirm at least one service and one region are selected.