OprivenOverview
This guide walks you through setting up an IAM Role with CloudWatch access to enable the Opriven integration.Set up in Opriven
Go to the CloudWatch integration setup in the Opriven dashboard.
Prerequisites
- An AWS account
- A user account with permissions to create cross-account IAM Roles
Setup
1
Open the CloudWatch integration page in Opriven
Navigate to Integrations > CloudWatch > Connect in the Opriven dashboard, or use the link above. Opriven generates a unique External ID for your organization automatically.
2
Deploy the CloudFormation stack
Click Deploy Stack in AWS. This opens the CloudFormation quick-create page with the External ID and Trusted Account ID pre-filled in the template parameters.
3
(Optional) Exclude specific log groups
To prevent Opriven from accessing certain log groups, paste comma-separated log group ARNs in the ExcludedLogGroups field.You can find ARNs in CloudWatch Console > Log groups > [select group] > Copy ARN.
4
Acknowledge IAM resource creation
Scroll to the bottom and check the box confirming that the stack may create IAM resources.
5
Create the stack and copy the Role ARN
Click Create stack and wait until the status shows
CREATE_COMPLETE. Then go to the Outputs tab and copy the Value next to RoleArn — this is the Role ARN you’ll paste into Opriven.6
Complete setup in Opriven
Back in the Opriven dashboard, paste the Role ARN, select your AWS region, and click Add. The External ID is pre-filled automatically.
Update an existing integration
When Opriven asks you to update your permissions, follow these steps:- Open CloudFormation in the AWS account and region where you created the Opriven stack, then select that stack.
-
Choose Update, then Replace existing template. Select Amazon S3 URL and enter:
https://opriven-cloudformation-templates.s3.amazonaws.com/opriven-cloudwatch-role.yaml - Keep your existing TrustedAccountId, RoleName, and ExcludedLogGroups values. For ExternalId, select Use existing value.
- Keep the remaining stack options, acknowledge IAM resource changes, review the proposed update, and choose Update stack.
-
Wait for
UPDATE_COMPLETE. Your Role ARN stays the same, so you do not need to reconnect the integration in Opriven.