CloudWatch

#What Antimetal does with CloudWatch

• Query metrics across AWS services to establish when behavior changed
• Search log groups for the error behind an alert
• Read alarm state and history to see what fired and how often
• Correlate infrastructure-level symptoms with application errors from other tools

#Connecting CloudWatch

Prerequisites

• An AWS account
• A user account with permissions to create cross-account IAM Roles

1. Open the CloudWatch integration page in Antimetal

   Navigate to Integrations > CloudWatch > Connect in the Antimetal dashboard. Antimetal generates a unique External ID for your organization automatically.

2. Deploy the CloudFormation stack

   Click Deploy Stack in AWS. This opens the CloudFormation quick-create page with the External ID and Trusted Account ID pre-filled.

3. Exclude specific log groups (optional)

   To prevent Antimetal from accessing certain log groups, paste comma-separated log group ARNs in the ExcludedLogGroups field. Find ARNs under CloudWatch Console > Log groups > [select group] > Copy ARN.

4. Acknowledge IAM resource creation

   Scroll to the bottom and check the box confirming the stack may create IAM resources.

5. Create the stack and copy the Role ARN

   Click Create stack and wait for CREATE_COMPLETE. Open the Outputs tab and copy the value next to AntimetalReadOnlyRole.

6. Complete setup in Antimetal

   Back in the Antimetal dashboard, paste the Role ARN, select your AWS region, and click Add. The External ID is pre-filled automatically.

#Permissions and access

Antimetal uses a read-only cross-account IAM Role provisioned via CloudFormation, scoped by an External ID unique to your organization. No write operations are performed in your AWS environment.

All tenant data is processed in isolated environments. See security and compliance for details.

#Resources

• Video walkthrough