Not able to create OAM link for CrossAccount Monitoring

Question

Hello guys,
I want to register one account in my organization as my Monitoring account with cross account-cross region enabled. I already deployed the necessary IAM role to all my target accounts and are able to view the accounts in the CloudWatch dropdown menu and also see the resources running in these accounts but without any metric data.

I followed the steps to link the source accounts with the CloudFormation template provided by the Monitoring account which I wanted to deploy as a StackSet to all accounts. The error I am encountering is this:

*An error occurred (AccessDeniedException) when calling the CreateLink operation: User: arn:aws:sts::345123345676:assumed-role/ is not authorized to perform: oam:CreateLink on resource: arn:aws:oam:eu-central-1:123456789:sink/0464f55a-c911-00000000 with an explicit deny*
 
I tried to create the link for one account via the AWS CloudShell with my Administrator user but also got that error.

What am I missing?

BR,
Mark

re:Post Agent · Accepted Answer

It appears that you're encountering an issue with creating an OAM (Observability Access Manager) link for cross-account monitoring in CloudWatch. The error message suggests that there's an explicit deny preventing the creation of the link. Here are a few things to check and consider:

1. Sink Policy: Ensure that the sink policy in your monitoring account allows the creation of links. The sink policy should explicitly allow the "oam:CreateLink" action for the source accounts or the organization.

2. IAM Permissions: Verify that the IAM role or user you're using has the necessary permissions to create OAM links. You might need the OAMFullAccess policy or a custom policy that includes the "oam:CreateLink" permission.

3. Organization ID: If you're using organization-based access, make sure the organization ID in the sink policy matches your actual AWS Organizations ID.

4. Resource Types: Check that the resource types you're trying to share (like CloudWatch metrics) are correctly specified in the sink policy.

5. Account Numbers: Confirm that the account numbers for both the source and monitoring accounts are correct in your configuration.

6. Region: Ensure you're operating in the correct AWS region where you've set up the sink.

To troubleshoot further:

1. In the monitoring account, use the AWS CLI to list the sinks:
   aws oam list-sinks

2. Then, list the attached links for the specific sink:
   aws oam list-attached-links --sink-identifier

These commands will help you verify the current setup and potentially identify any misconfigurations.

If the issue persists after checking these points, you may need to review the sink policy in detail to ensure it's correctly set up to allow link creation from your source accounts.  
**Sources**  
[Identity and access management for Amazon CloudWatch - Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html)  
[CloudWatch Observability Access Monitor examples using AWS CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_oam_code_examples.html)  
[AWS::Oam::Sink - AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-oam-sink.html)  
[Troubleshoot cross account observability in CloudWatch | AWS re:Post](https://repost.aws/knowledge-center/cloudwatch-cross-account-observability)

Riku_Kobayashi · Answer

Hello.

Judging from the error message, it appears that the IAM policy set for the IAM role created in the target account is set to explicitly deny the operation.  
Check the configured IAM policy and make sure that the "Deny" action is not set.  
Also, please make sure that not only the IAM policy but also "Permissions boundaries" are not set.  
If any "Permissions boundaries" are set, please delete them once.

Not able to create OAM link for CrossAccount Monitoring

Add your answer

Relevant content