能否通过Terraform启用AWS CloudWatch集中监控账户？

一、监控账户（观测器账户）配置 #

1. 创建CloudWatch观测器（OAM Sink） #

resource "aws_oam_sink" "central_monitor" {
  name = "central-cloudwatch-monitor-sink"
}

# 输出观测器ARN，用于被监控账户配置
output "oam_sink_arn" {
  value = aws_oam_sink.central_monitor.arn
}

2. 配置观测器访问策略 #

授权指定被监控账户创建链接：

resource "aws_oam_sink_policy" "central_monitor_policy" {
  sink_arn = aws_oam_sink.central_monitor.arn
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = [
            "arn:aws:iam::<被监控账户ID1>:root",
            "arn:aws:iam::<被监控账户ID2>:root"
          ]
        }
        Action = [
          "oam:CreateLink",
          "oam:UpdateLink"
        ]
        Resource = "*"
      }
    ]
  })
}

二、被监控账户（源账户）配置 #

1. 创建源链接关联监控账户 #

resource "aws_oam_link" "monitor_link" {
  name             = "cloudwatch-monitor-link"
  sink_arn         = "<监控账户输出的oam_sink_arn>"
  resource_types   = ["AWS::CloudWatch::Metric", "AWS::Logs::LogGroup", "AWS::XRay::Trace"]
}

2. 可选：配置Metric Stream推送细粒度指标 #

如果需要精准推送特定指标到监控账户，可创建CloudWatch Metric Stream：

resource "aws_cloudwatch_metric_stream" "central_monitor_stream" {
  name          = "central-monitor-metric-stream"
  role_arn      = aws_iam_role.metric_stream_role.arn
  output_format = "json"
  firehose_arn  = "<监控账户中的Kinesis Firehose ARN>"

  # 指定要推送的指标命名空间
  include_filter {
    namespace = "AWS/EC2"
  }

  include_filter {
    namespace = "AWS/S3"
  }
}

# 对应Metric Stream所需IAM角色
resource "aws_iam_role" "metric_stream_role" {
  name = "cloudwatch-metric-stream-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "streams.metrics.cloudwatch.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "metric_stream_policy" {
  name = "cloudwatch-metric-stream-policy"
  role = aws_iam_role.metric_stream_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "firehose:PutRecord",
          "firehose:PutRecordBatch"
        ]
        Effect   = "Allow"
        Resource = "<监控账户中的Kinesis Firehose ARN>"
      }
    ]
  })
}

三、验证配置 #

1. 登录监控账户的CloudWatch控制台，进入观测页面，确认已成功关联被监控账户
2. 查看CloudWatch指标、日志面板，验证是否能正常获取被监控账户的资源数据

内容的提问来源于stack exchange，提问作者Marco Ferrara