OAM cross-account dashboard: "Access denied" on CloudFront metrics in us-east-1, even though Sink/Link exist in eu-west-2

Question

I have OAM Sink (monitoring account) and Link (source account) deployed in eu-west-2 only. A dashboard widget querying AWS/CloudFront metrics with region: us-east-1 and accountId set fails with "Access denied... check that this account and the requested metric account are linked." CloudFront metrics always publish to us-east-1, but my OAM link only covers eu-west-2.

Question: Are OAM Sinks/Links strictly regional, meaning I need a separate Sink + Link pair deployed in us-east-1 specifically to authorize cross-account access to us-east-1-published metrics — regardless of where the dashboard itself lives? Is there any way around deploying a Sink/Link per region, or is that the only supported pattern? Docs confirming this would help.

Takahiro Nozaki · Answer

OAM sinks and links operate strictly on a per-Region basis.
The official AWS troubleshooting guide (Knowledge Center) "[Troubleshoot cross account observability in CloudWatch | AWS re:Post](https://repost.aws/knowledge-center/cloudwatch-cross-account-observability)" addresses a scenario exactly like yours.
> Note: Cross-account observability links are Region specific. The source account link and the monitoring account sink must be in the same Region.

Furthermore, the official documentation "[CloudWatch cross-account observability - Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html)" explicitly states the following:

> A sink is a resource that represents an attachment point in a monitoring account. Source accounts can link to the sink to share observability data. Each account can have one sink per Region.

In other words, the specification confirms your conclusion: the location of the dashboard itself is irrelevant; what matters is having a sink-link pair corresponding to the Region where the metrics are actually emitted (which is always us-east-1 for CloudFront).

There is no other way than to deploy an additional sink-link pair specifically for us-east-1.

OAM cross-account dashboard: "Access denied" on CloudFront metrics in us-east-1, even though Sink/Link exist in eu-west-2

답변 추가

관련 콘텐츠