How do I troubleshoot cross-account observability when I don’t see metrics from the source account in CloudWatch?

Short description

CloudWatch cross-account observability allows you to monitor and troubleshoot applications that span multiple accounts within an AWS Region. After you link a source account to a monitoring account, metrics from the source account don't appear in the monitoring account.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Verify the link between the source and monitoring accounts

To verify the link between the source and monitoring accounts, complete the following steps:

1. Open the CloudWatch console in the source account.
2. In the navigation pane, under Setup, choose Settings.
3. Under Source account configuration, choose View linked monitoring accounts.
4. Confirm that the list includes the monitoring account, and that the Resources column includes Metrics. If Metrics is missing, then choose Edit resources to add it.

Or, use the AWS CLI. To use the AWS CLI to verify the link between the source and monitoring accounts, run the following command in the source account:

aws oam list-links 

Confirm that a link exists with the monitoring account's sink ARN and that ResourceTypes includes AWS::CloudWatch::Metric. If AWS::CloudWatch::Metric is missing, then update the link to include Metrics through the console.

Resolve link creation errors

Insufficient permissions

The AWS Identity and Access Management (IAM) principal in the source account must have the following permissions: 

• oam:CreateLink and oam:TagResource on the link resource.
• oam:CreateLink on the monitoring account's sink resource.
• cloudwatch:Link to share metrics.

If you receive the "User is not authorized to perform: oam:CreateLink" error, then verify that the IAM policy includes all required permissions. For more information, see Necessary permissions.

Also take the following actions:

• Confirm that the monitoring account's sink policy allows the source account to link and share data with it. For more information, see View information about a monitoring account.
• Confirm that the Principal field lists the source account ID or organization ID. Also check the Condition field. If the policy uses aws:PrincipalOrgID, then only accounts within that organization can create links.
• If your organization uses service control policies (SCPs), then verify that the SCP doesn’t block oam:CreateLink and cloudwatch:Link.

Telemetry type mismatch

If the source account selects more telemetry types than the monitoring account allows, then link creation fails. Verify that the monitoring account’s sink includes Metrics as an allowed telemetry type.

Note: Cross-account observability links are Region specific. The source account link and the monitoring account sink must be in the same Region.

Troubleshoot missing metrics

If the link is active but metrics don’t appear in the monitoring account, then review the following resolutions.

Metrics require new data points

After you create the link, the monitoring account shows metrics only when the source account emits new data points. You can't view historical metric data from before you create the link.

Note: After you create an observability access manager (OAM) link, there might be a short delay before metrics begin to appear. If you don’t see metrics immediately, then wait a few minutes and check again.

Namespace filter excludes the metric

If you configured the source account to share metrics under selected namespaces, then verify that the filter includes the expected namespace. For more information, see Link the source accounts.

Tags and resource names aren’t visible 

CloudWatch cross-account observability shares telemetry data including metrics, logs, and traces. It doesn’t share resource metadata such as Amazon Elastic Compute Cloud (Amazon EC2) tags, instance names, or resource group memberships. The monitoring account sees metric dimensions such as InstanceId, but not the tags associated with those resources in the source account.

To identify source accounts, use a label when you create links. You can use a custom label or use the variables $AccountName, $AccountEmail, or $AccountEmailNoDomain to automatically populate account information.

Related information

CloudWatch cross-account observability

Link monitoring accounts with source accounts