# AWS CloudWatch Metrics

> AWS CloudWatch Metric Streams enable customers to send their CloudWatch metrics to Last9.

Source: https://last9.io/docs/integrations/observability/aws-cloudwatch-metrics/

## Pre-requisites

Obtain the following and copy it to your clipboard from the [Home > Integrations > CloudWatch](https://app.last9.io/integrations?category=cloudwatch) section.

1. `HTTP Endpoint URL`
2. `Username`
3. `Password`

![CloudWatch integration settings](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/cloudwatch-integration-settings.png)

## Setting up required IAM policy

:::note
Ensuring your AWS Identity and Access Management (IAM) user
account has access permissions is crucial. The following access policy is specifically crafted to
enable actions related to creating Amazon Data Firehose streams and CloudWatch Metric Streams.
:::

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudWatchMetricStreams",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:StartMetricStreams",
        "cloudwatch:PutMetricStream",
        "cloudwatch:GetMetricStream",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "cloudwatch:ListMetricStreams"
      ],
      "Resource": ["*"]
    },
    {
      "Sid": "Firehose",
      "Effect": "Allow",
      "Action": [
        "firehose:PutRecord",
        "firehose:CreateDeliveryStream",
        "firehose:DescribeDeliveryStream",
        "firehose:PutRecordBatch",
        "firehose:UpdateDestination",
        "firehose:ListDeliveryStreams",
        "firehose:TagDeliveryStream"
      ],
      "Resource": ["*"]
    },
    {
      "Sid": "S3BackupBucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:CreateBucket",
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:PutObject"
      ],
      "Resource": ["arn:aws:s3:::*"]
    },
    {
      "Sid": "IamRoleManagementInline",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:GetRole",
        "iam:PutRolePolicy",
        "iam:DeleteRolePolicy"
      ],
      "Resource": "arn:aws:iam::<account_id>:role/l9-cwstream-*"
    },
    {
      "Sid": "IamPassRoleToStreamingServices",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::<account_id>:role/l9-cwstream-*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "streams.metrics.cloudwatch.amazonaws.com",
            "firehose.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "Logs",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": [
        "arn:aws:logs:<region>:<account_id>:log-group:*:log-stream:*"
      ]
    }
  ]
}
```

## Creating an Amazon Data Firehose stream

Amazon Data Firehose was formerly Kinesis Data Firehose. The AWS Console now uses **Firehose stream** for the resource you create.

1. Open [Amazon Data Firehose](https://console.aws.amazon.com/firehose/home) in the AWS Console.

2. Go to **Firehose streams** and click **Create Firehose stream**.

3. In **Choose source and destination**, set:

   - **Source:** `Direct PUT`
   - **Destination:** `HTTP endpoint`
   - **Firehose stream name:** `last9-$your_organization_name`

   ![Create Firehose stream with Direct PUT and HTTP endpoint](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/amazon-data-firehose-create-stream.png)

4. Set **HTTP endpoint URL** to the copied Last9 CloudWatch metric stream endpoint.

5. Under **Authentication**, select **Use access key** and leave **Access key** empty.

6. Set **Content encoding** to `GZIP`.

7. Set **Retry duration** to `300` seconds.

8. Under **Parameters**, add:

   | Key        | Value                         |
   | ---------- | ----------------------------- |
   | `username` | Last9 username copied earlier |
   | `password` | Last9 password copied earlier |

   ![Configure Firehose HTTP endpoint authentication and parameters](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/amazon-data-firehose-http-endpoint-settings.png)

9. Under **Backup settings**, set **Source record backup in Amazon S3** to **Failed data only**.

10. Choose or create an S3 backup bucket to store records the Firehose stream fails to deliver.

    ![Configure Firehose backup settings for failed data](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/amazon-data-firehose-backup-settings.png)

11. Click **Create Firehose stream**.

## Sending data from CloudWatch to the Firehose stream

1. Open the CloudWatch console and click on `Metrics -> Streams`

   ![CloudWatch console](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/cf1a9fb-image.png)

2. Click on `Create metric stream`

   ![Create metric stream](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/8524a92-image.png)

3. Choose `All metrics` to send all CloudWatch metrics. Optionally, you can also select the metrics you want to stream. You can include or exclude specific namespaces and metrics you want to send by using `Select metrics` option.

   ![Select metrics](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/cloudwatch-stream-settings-select-metrics.png)

4. Ensure that you use the Firehose stream created in the earlier step and that the output format is `OpenTelemetry 0.7`.

   ![Firehose stream settings](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/cloudwatch-stream-settings-format.png)

5. Enter the Custom Metric stream name as `last9-$your_organization_name` and then click on `Create metric stream`

   ![Create metric stream](../../../../../../assets/content/docs/integrations/observability/metrics/aws-cloudwatch-metrics/ad88fa1-image.png)

## Verification

Once the CloudWatch metric stream is enabled, it sends metrics with the `amazonaws_com_AWS` prefix. Metrics usually appear within 2-3 minutes in [Metrics Explorer](https://app.last9.io/metrics).

---

## Troubleshooting

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you
have any questions.