步骤 1：创建与 OpenSearch 服务的集成

第一步是创建与 S OpenSearch ervice 的集成，您只需执行一次即可。创建集成将在您的账户中创建以下资源。

没有高可用@@ 性的 OpenSearch Service 时间序列集合。

集合是一组 OpenSearch 服务索引，它们协同工作以支持工作负载。
该集合的@@ 两项安全策略。一种定义了加密类型，即使用客户管理的 AWS KMS 密钥或服务拥有的密钥。另一个策略定义了网络访问权限，允许 OpenSearch 服务应用程序访问集合。有关更多信息，请参阅 Amazon OpenSearch 服务的静态数据加密。
一种 OpenSearch 服务数据访问策略，用于定义谁可以访问集合中的数据。
一种 OpenSearch 服务直接查询数据源，其源定义为 CloudWatch 日志。
名@@ 为的 OpenSearch 服务应用程序aws-analytics。该应用程序将被配置为允许创建工作区。如果名为的应用程序aws-analytics已经存在，则会对其进行更新以将此集合添加为数据源。
一个 OpenSearch 服务工作区，用于托管仪表板，并允许所有被授予访问权限的人从工作区读取。

所需的权限

要创建集成，您必须登录具有CloudWatchOpenSearchDashboardsFullAccess托管 IAM 策略或等效权限的账户，如下所示。您还必须具有这些权限才能删除集成、创建、编辑和删除仪表板以及手动刷新仪表板。

JSON


{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "CloudWatchOpenSearchDashboardsIntegration",
            "Effect": "Allow",
            "Action": [
                "logs:ListIntegrations",
                "logs:GetIntegration",
                "logs:DeleteIntegration",
                "logs:PutIntegration",
                "logs:DescribeLogGroups",
                "opensearch:ApplicationAccessAll",
                "iam:ListRoles",
                "iam:ListUsers"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudWatchLogsOpensearchReadAPIs",
            "Effect": "Allow",
            "Action": [
                "aoss:BatchGetCollection",
                "aoss:BatchGetLifecyclePolicy",
                "es:ListApplications"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsOpensearchCreateServiceLinkedAccess",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "arn:aws:iam::*:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService",
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "opensearchservice.amazonaws.com",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsObservabilityCreateServiceLinkedAccess",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless",
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "observability.aoss.amazonaws.com",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsCollectionRequestAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:CreateCollection"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:RequestTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsApplicationRequestAccess",
            "Effect": "Allow",
            "Action": [
                "es:CreateApplication"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:RequestTag/OpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "OpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsCollectionResourceAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:DeleteCollection"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                }
            }
        },
        {
            "Sid": "CloudWatchLogsApplicationResourceAccess",
            "Effect": "Allow",
            "Action": [
                "es:UpdateApplication",
                "es:GetApplication"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/OpenSearchIntegration": [
                        "Dashboards"
                    ]
                }
            }
        },
        {
            "Sid": "CloudWatchLogsCollectionPolicyAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:CreateSecurityPolicy",
                "aoss:CreateAccessPolicy",
                "aoss:DeleteAccessPolicy",
                "aoss:DeleteSecurityPolicy",
                "aoss:GetAccessPolicy",
                "aoss:GetSecurityPolicy"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aoss:collection": "cloudwatch-logs-*",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsAPIAccessAll",
            "Effect": "Allow",
            "Action": [
                "aoss:APIAccessAll"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aoss:collection": "cloudwatch-logs-*"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsIndexPolicyAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:CreateAccessPolicy",
                "aoss:DeleteAccessPolicy",
                "aoss:GetAccessPolicy",
                "aoss:CreateLifecyclePolicy",
                "aoss:DeleteLifecyclePolicy"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aoss:index": "cloudwatch-logs-*",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsDQSRequestQueryAccess",
            "Effect": "Allow",
            "Action": [
                "es:AddDirectQueryDataSource"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:RequestTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsStartDirectQueryAccess",
            "Effect": "Allow",
            "Action": [
                "opensearch:StartDirectQuery",
                "opensearch:GetDirectQuery"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*"
        },
        {
            "Sid": "CloudWatchLogsDQSResourceQueryAccess",
            "Effect": "Allow",
            "Action": [
                "es:GetDirectQueryDataSource",
                "es:DeleteDirectQueryDataSource"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                }
            }
        },
        {
            "Sid": "CloudWatchLogsPassRoleAccess",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": "directquery.opensearchservice.amazonaws.com",
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsAossTagsAccess",
            "Effect": "Allow",
            "Action": [
                "aoss:TagResource"
            ],
            "Resource": "arn:aws:aoss:*:*:collection/*",
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaFirst": "logs.amazonaws.com",
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsEsApplicationTagsAccess",
            "Effect": "Allow",
            "Action": [
                "es:AddTags"
            ],
            "Resource": "arn:aws:opensearch:*:*:application/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/OpenSearchIntegration": [
                        "Dashboards"
                    ],
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "OpenSearchIntegration"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsEsDataSourceTagsAccess",
            "Effect": "Allow",
            "Action": [
                "es:AddTags"
            ],
            "Resource": "arn:aws:opensearch:*:*:datasource/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/CloudWatchOpenSearchIntegration": [
                        "Dashboards"
                    ],
                    "aws:CalledViaFirst": "logs.amazonaws.com"
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": "CloudWatchOpenSearchIntegration"
                }
            }
        }
    ]
}

创建集成

使用以下步骤创建集成。

将 CloudWatch 日志与集成 Amazon OpenSearch Service

打开 CloudWatch 控制台，网址为https://console.aws.amazon.com/cloudwatch/。
在左侧导航窗格中，选择 Logs Insights，然后选择分析方式 OpenSearch选项卡。
选择创建集成。
在集成名称中，输入集成的名称。
（可选）要加密写入无服务器 OpenSearch 服务的数据，请在 KMS 密钥 ARN 中输入要使用的密钥的 ARN。 AWS KMS 有关更多信息，请参阅《Amazon OpenSearch 服务开发者指南》中的静态加密。
对于数据保留，请输入您希望保留 OpenSearch 服务数据索引的时间长度。这还定义了您可以在仪表板中查看数据的最大时间段。选择较长的数据保留期将产生额外的搜索和索引成本。有关更多信息，请参阅无服务器OpenSearch 服务定价。

最长保留期为 30 天。

数据保留期限还将用于创建 OpenSearch 服务收集生命周期策略。
对于用于写入 OpenSearch 集合的 IAM 角色，请创建一个新的 IAM 角色或选择用于写入 OpenSearch 服务集合的现有 IAM 角色。

创建新角色是最简单的方法，将使用必要的权限创建该角色。

注意
如果您创建了一个角色，则该角色将有权读取该账户中的所有日志组。

如果要选择现有角色，则该角色应具有中列出的权限集成所需的权限。或者，您可以选择 “使用现有角色”，然后在 “验证所选角色的访问权限” 部分中选择 “创建角色”。这样，您就可以将中列出的权限集成所需的权限用作模板并对其进行修改。例如，如果您想为日志组指定更精细的控件。
对于可以查看仪表板的 IAM 角色和用户，您可以选择如何向 IAM 角色和 IAM 用户授予销售日志控制面板访问权限：
- 要仅允许部分用户访问控制面板，请选择选择 IAM 角色和可以查看仪表板的用户，然后在文本框中搜索并选择要授予访问权限的 IAM 角色和 IAM 用户。
- 要向所有用户授予控制面板访问权限，请选择 “允许此账户中的所有角色和用户查看仪表板”。
  
  重要
  选择角色或用户，或者选择所有用户，只会将他们添加到访问存储仪表板数据的 OpenSearch 服务集合所需的数据访问策略中。为了让他们能够查看出售的日志仪表板，您还必须向这些角色和用户授予CloudWatchOpenSearchDashboardAccess托管 IAM 策略。
选择创建集成

创建集成需要几分钟。

Javascript 在您的浏览器中被禁用或不可用。

要使用 Amazon Web Services 文档，必须启用 Javascript。请参阅浏览器的帮助页面以了解相关说明。

文档惯例

使用亚马逊 OpenSearch 服务进行分析

步骤 2：创建预付费日志仪表板

步骤 1：创建与 OpenSearch 服务的集成

主题

所需的权限

创建集成

将 CloudWatch 日志与集成 Amazon OpenSearch Service

注意

重要