Overview
This guide walks you through setting up an IAM Role with CloudWatch access to enable the Opriven integration.
Set up in Opriven
Go to the CloudWatch integration setup in the Opriven dashboard.
Prerequisites
An AWS account
A user account with permissions to create cross-account IAM Roles
Setup
1
Open the CloudWatch integration page in Opriven
Navigate to
Integrations > CloudWatch > Connect
in the Opriven dashboard, or use the link above. Opriven generates a unique External ID for your organization automatically.
2
Deploy the CloudFormation stack
Click
Deploy Stack in AWS
. This opens the
CloudFormation quick-create page
with the External ID and Trusted Account ID pre-filled in the template parameters.
3
(Optional) Exclude specific log groups
To prevent Opriven from accessing certain log groups, paste comma-separated log group ARNs in the
ExcludedLogGroups
field.
You can find ARNs in
CloudWatch Console > Log groups > [select group] > Copy ARN
.
4
Acknowledge IAM resource creation
Scroll to the bottom and check the box confirming that the stack may create IAM resources.
5
Create the stack and copy the Role ARN
Click
Create stack
and wait until the status shows
CREATE_COMPLETE
. Then go to the
Outputs
tab and copy the
Value
next to
RoleArn
— this is the Role ARN you’ll paste into Opriven.
6
Complete setup in Opriven
Back in the Opriven dashboard, paste the Role ARN, select your AWS region, and click
Add
. The External ID is pre-filled automatically.
Update an existing integration
When Opriven asks you to update your permissions, follow these steps:
Open
CloudFormation
in the AWS account and region where you created the Opriven stack, then select that stack.
Choose
Update
, then
Replace existing template
. Select
Amazon S3 URL
and enter:
https://opriven-cloudformation-templates.s3.amazonaws.com/opriven-cloudwatch-role.yaml
Keep your existing
TrustedAccountId
,
RoleName
, and
ExcludedLogGroups
values. For
ExternalId
, select
Use existing value
.
Keep the remaining stack options, acknowledge IAM resource changes, review the proposed update, and choose
Update stack
.
Wait for
UPDATE_COMPLETE
. Your Role ARN stays the same, so you do not need to reconnect the integration in Opriven.
Resources
Video walkthrough
Permissions and Access
Opriven uses a read-only cross-account IAM Role provisioned via CloudFormation. No write operations are performed in your AWS environment.