Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

OAM cross-account dashboard: "Access denied" on CloudFront metrics in us-east-1, even though Sink/Link exist in eu-west-2

0

I have OAM Sink (monitoring account) and Link (source account) deployed in eu-west-2 only. A dashboard widget querying AWS/CloudFront metrics with region: us-east-1 and accountId set fails with "Access denied... check that this account and the requested metric account are linked." CloudFront metrics always publish to us-east-1, but my OAM link only covers eu-west-2.

Question: Are OAM Sinks/Links strictly regional, meaning I need a separate Sink + Link pair deployed in us-east-1 specifically to authorize cross-account access to us-east-1-published metrics — regardless of where the dashboard itself lives? Is there any way around deploying a Sink/Link per region, or is that the only supported pattern? Docs confirming this would help.

Topics
Management & GovernanceNetworking & Content Delivery
Tags
Amazon CloudWatchAmazon CloudFront
Language
English

asked 22 days ago27 views

1 Answer
0

OAM sinks and links operate strictly on a per-Region basis. The official AWS troubleshooting guide (Knowledge Center) "Troubleshoot cross account observability in CloudWatch | AWS re:Post" addresses a scenario exactly like yours.

Note: Cross-account observability links are Region specific. The source account link and the monitoring account sink must be in the same Region.

Furthermore, the official documentation "CloudWatch cross-account observability - Amazon CloudWatch" explicitly states the following:

A sink is a resource that represents an attachment point in a monitoring account. Source accounts can link to the sink to share observability data. Each account can have one sink per Region.

In other words, the specification confirms your conclusion: the location of the dashboard itself is irrelevant; what matters is having a sink-link pair corresponding to the Region where the metrics are actually emitted (which is always us-east-1 for CloudFront).

There is no other way than to deploy an additional sink-link pair specifically for us-east-1.

answered 22 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content