How to set up cross-account monitoring in Cloudwatch using AWS CDK? From Cloudformation documentation on OAM it feels like we need only two resources: a Sink in a monitoring account and Links in sharing accounts. It feels that required IAM policies are created as part of OAM::Sink. But when it fails with "Invalid request provided: AWS::Oam::Sink". What could be missing?