連結監控帳戶與來源帳戶

• 若要設定監控帳戶：您必須在監控帳戶中擁有完整的系統管理員存取權，或者您必須擁有下列許可並登入該帳戶：

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "AllowSinkModification",
              "Effect": "Allow",
              "Action": [
                  "oam:CreateSink",
                  "oam:DeleteSink",
                  "oam:PutSinkPolicy",
                  "oam:TagResource"
              ],
              "Resource": "*"
          },
          {
              "Sid": "AllowReadOnly",
              "Effect": "Allow",
              "Action": ["oam:Get*", "oam:List*"],
              "Resource": "*"
          }
      ]
  }

• 範圍為特定監控帳戶的來源帳戶：若要僅針對某個指定監控帳戶建立、更新和管理連結，您必須擁有下列許可並登入該帳戶。在此範例中，監控帳戶為 999999999999。

  如果連結不會共用所有七種資源類型 （指標、日誌、追蹤、Application Insights 應用程式、Application Signals 服務和服務層級目標 (SLOs) 和網路監視器），您可以internetmonitor:Link視需要省略 cloudwatch:Link、logs:Link、xray:Link、applicationinsights:Link、application-signals:Link、 或 。

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink",
                  "oam:DeleteLink",
                  "oam:GetLink",
                  "oam:TagResource"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:oam:*:*:link/*"
          },
          {
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:oam:*:*:sink/*",
              "Condition": {
                  "StringEquals": {
                      "aws:ResourceAccount": [
                          "999999999999"
                      ]
                  }
              }
          },
          {
              "Action": "oam:ListLinks",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "cloudwatch:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "logs:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "xray:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
               "Action": "applicationinsights:Link",
               "Effect": "Allow",
               "Resource": "*"
           },
          {
               "Action": "internetmonitor:Link",
               "Effect": "Allow",
               "Resource": "*"
          },
          {
               "Action": "application-signals:Link",
               "Effect": "Allow",
               "Resource": "*"
          }
      ]
  }

• 來源帳戶，具有連結至任何監控帳戶的許可 – 若要建立任何現有監控帳戶接收器的連結並共用指標、日誌群組、追蹤、Application Insights 應用程式和網路監視器，您必須使用完整的管理員許可登入來源帳戶，或使用下列許可登入來源帳戶

  如果連結不會共用所有七種資源類型 （指標、日誌、追蹤、Application Insights 應用程式、Application Signals 服務和服務層級目標 (SLOs) 和網路監視器），您可以internetmonitor:Link視需要省略 cloudwatch:Link、logs:Link、xray:Link、applicationinsights:Link、application-signals:Link、 或 。

  {
      "Version": "2012-10-17",
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "oam:CreateLink",
                  "oam:UpdateLink"
              ],
              "Resource": [
                  "arn:aws:oam:*:*:link/*",
                  "arn:aws:oam:*:*:sink/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "oam:List*",
                  "oam:Get*"
              ],
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "oam:DeleteLink",
                  "oam:GetLink",
                  "oam:TagResource"
              ],
              "Resource": "arn:aws:oam:*:*:link/*"
          },
          {
              "Action": "cloudwatch:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "xray:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "logs:Link",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
               "Action": "applicationinsights:Link",
               "Effect": "Allow",
               "Resource": "*"
          },
          {
               "Action": "internetmonitor:Link",
               "Effect": "Allow",
               "Resource": "*"
          },
          {
               "Action": "application-signals:Link",
               "Effect": "Allow",
               "Resource": "*"
          }
      ]
  }

• 監控帳戶中的完整管理員存取權

• 下列跨帳戶許可，以及檢視您將監控之特定類型資源的許可

  {
     "Sid": "AllowReadOnly",
     "Effect": "Allow",
     "Action": [
       "oam:Get*",
       "oam:List*"
     ],
     "Resource": "*"
   }

先決條件

• 如果您要將 AWS Organizations 組織中的帳戶設定為來源帳戶 – 取得組織路徑或組織 ID。

• 如果您未將 Organizations 用於來源帳戶：請取得來源帳戶的帳戶 ID。

• 如果您要連結整個組織 – CloudWatch 提供 AWS CloudFormation 範本。

• 如果您要連結個別帳戶 – 使用 CloudWatch 提供的 AWS CloudFormation 範本或 URL。