CloudWatch
CloudWatch is where AWS records what your infrastructure was doing when something broke. Antimetal connects through a read-only cross-account IAM role provisioned by CloudFormation, so no long-lived keys are exchanged.
What Antimetal does with CloudWatch
- Query metrics across AWS services to establish when behavior changed
- Search log groups for the error behind an alert
- Read alarm state and history to see what fired and how often
- Correlate infrastructure-level symptoms with application errors from other tools
Connecting CloudWatch
Prerequisites
- An AWS account
- A user account with permissions to create cross-account IAM Roles
Navigate to Integrations > CloudWatch > Connect in the Antimetal dashboard. Antimetal generates a unique External ID for your organization automatically.
Click Deploy Stack in AWS. This opens the CloudFormation quick-create page with the External ID and Trusted Account ID pre-filled.
To prevent Antimetal from accessing certain log groups, paste comma-separated log group ARNs in the ExcludedLogGroups field. Find ARNs under CloudWatch Console > Log groups > [select group] > Copy ARN.
Scroll to the bottom and check the box confirming the stack may create IAM resources.
Click Create stack and wait for
CREATE_COMPLETE. Open the Outputs tab and copy the value next to AntimetalReadOnlyRole.Back in the Antimetal dashboard, paste the Role ARN, select your AWS region, and click Add. The External ID is pre-filled automatically.
Permissions and access
Antimetal uses a read-only cross-account IAM Role provisioned via CloudFormation, scoped by an External ID unique to your organization. No write operations are performed in your AWS environment.
All tenant data is processed in isolated environments. See security and compliance for details.
Resources
- Video walkthroughwww.loom.com
Related integrations
Need help?
Contact us via Slack or at support@antimetal.com.