Sink

Source: src/AWS/OAM/Sink.ts

A CloudWatch cross-account observability sink — the attachment point in a monitoring account that source accounts link to in order to share metrics, logs, traces, and Application Signals data.

Each account can contain one sink per region. After creating a sink, attach a sink policy (the policy prop) that authorizes source accounts (or an entire organization) to create links to it.

Creating a Sink

Basic Sink

import * as OAM from "alchemy/AWS/OAM";

const sink = yield* OAM.Sink("MonitoringSink");

Sink with a policy authorizing source accounts

const sink = yield* OAM.Sink("MonitoringSink", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: ["111122223333"] },
        Action: ["oam:CreateLink", "oam:UpdateLink"],
        Resource: "*",
        Condition: {
          "ForAllValues:StringEquals": {
            "oam:ResourceTypes": [
              "AWS::CloudWatch::Metric",
              "AWS::Logs::LogGroup",
            ],
          },
        },
      },
    ],
  },
});

Authorize an entire organization

const sink = yield* OAM.Sink("OrgSink", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: "*",
        Action: ["oam:CreateLink", "oam:UpdateLink"],
        Resource: "*",
        Condition: {
          "ForAnyValue:StringEquals": { "aws:PrincipalOrgID": "o-xxxxxxxxxx" },
        },
      },
    ],
  },
});