> For the complete documentation index, see [llms.txt](https://docs.groundcover.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.groundcover.com/integrations/data-sources/aws/ingest-cloudwatch-metrics.md).
# Ingest CloudWatch Metrics
groundcover supports ingesting CloudWatch metrics directly into our platform, allowing you to visualize them using dashboards and create monitors.
## How does it work
CloudWatch integration is done by deploying a service called `integrations-agent` which is responsible for pulling metrics from CloudWatch using periodic polling of these APIs:
* [ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html)
* [GetMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html)
* [GetMetricStatistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html)
The integration setup is done directly through the App by following these steps:
1. Navigate to the Data Sources page or follow [this link](https://app.groundcover.com/data-sources). Note that only users with Admin permissions can navigate to this page.
2. Select Amazon Web Services and follow the wizard steps. Note that in step 1 you'll need to provide an ARN, granting groundcover with permissions to poll metrics. To do that, please follow the guidelines in [this section](#setting-up-the-integration).
## Things to know
### Ingestion interval
The integration pulls data from CloudWatch according to this interval. The lower the interval, the higher the polling rate and as a result, the overall costs will be higher. The interval can be altered in the Advanced Settings in the configuration wizard.
### Data storage
Data fetched is stored in the Victoria Metrics database, meaning metrics are queried via the CloudWatch API only one time per data point.
### Metric Statistics
Each metric has a label called `stat` which denotes the [AWS statistic ](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html)used during querying. Some metrics have multiple stats which are useful for different cases.
### Supported AWS services
Click to Open
```json
/aws/sagemaker/Endpoints
/aws/sagemaker/ProcessingJobs
/aws/sagemaker/TrainingJobs
/aws/sagemaker/TransformJobs
AWS/ACMPrivateCA
AWS/AOSS
AWS/AmazonMQ
AWS/ApiGateway
AWS/AppRunner
AWS/AppStream
AWS/AppSync
AWS/ApplicationELB
AWS/Athena
AWS/AutoScaling
AWS/Backup
AWS/Bedrock
AWS/Bedrock/Agents
AWS/Bedrock/Guardrails
AWS/Billing
AWS/Cassandra
AWS/CertificateManager
AWS/ClientVPN
AWS/CloudFront
AWS/Cognito
AWS/DDoSProtection
AWS/DMS
AWS/DX
AWS/DataSync
AWS/DirectoryService
AWS/DocDB
AWS/DynamoDB
AWS/EBS
AWS/EC2
AWS/EC2Spot
AWS/ECR
AWS/ECS
AWS/EFS
AWS/EKS
AWS/ELB
AWS/EMRServerless
AWS/ES
AWS/ElastiCache
AWS/ElasticBeanstalk
AWS/ElasticMapReduce
AWS/Events
AWS/FSx
AWS/Firehose
AWS/GameLift
AWS/GatewayELB
AWS/GlobalAccelerator
AWS/IPAM
AWS/IoT
AWS/KMS
AWS/Kafka
AWS/KafkaConnect
AWS/Kinesis
AWS/KinesisAnalytics
AWS/Lambda
AWS/Logs
AWS/MWAA
AWS/MediaConnect
AWS/MediaConvert
AWS/MediaLive
AWS/MediaPackage
AWS/MediaTailor
AWS/MemoryDB
AWS/NATGateway
AWS/Neptune
AWS/Network Manager
AWS/NetworkELB
AWS/NetworkFirewall
AWS/PrivateLinkEndpoints
AWS/PrivateLinkServices
AWS/Prometheus
AWS/QuickSight
AWS/RDS
AWS/RUM
AWS/Redshift
AWS/Route53
AWS/S3
AWS/SES
AWS/SNS
AWS/SQS
AWS/SageMaker
AWS/Sagemaker/ModelBuildingPipeline
AWS/SecretsManager
AWS/States
AWS/StorageGateway
AWS/Timestream
AWS/Transfer
AWS/TransitGateway
AWS/TrustedAdvisor
AWS/Usage
AWS/VPN
AWS/WAFV2
AWS/WorkSpaces
AmazonMWAA
CWAgent
CloudWatchSynthetics
ContainerInsights
ECS/ContainerInsights
Glue
LambdaInsights
```
### Resource Discovery Methods
{% hint style="success" %}
groundcover seamlessly integrates both methods below to avoid duplicate metric fetching.
{% endhint %}
The integration uses two methods to discover the AWS resources to fetch metrics for:
1. Tagging-based discovery - this method uses the AWS tagging mechanism to discover resources across all metric namespaces.\
This method supports all AWS namespaces but only works for resources which are tagged with at least one AWS tag.
2. List-based discovery - this method uses standard AWS APIs to list the resources in each namespace. It works for all resources regardless of tags, but the coverage is limited to specific namespaces as listed below:
1. AWS/RDS
2. AWS/S3
3. AWS/SQS
4. AWS/Lambda
5. AWS/ElastiCache
6. AWS/DynamoDB
7. AWS/ELB
8. AWS/NetworkELB
9. AWS/ApplicationELB
{% hint style="info" %}
If you're not seeing metrics for a specific resource, it likely has no tags and is not in the list of services above. Contact us on Slack to help with resolving the issue.
{% endhint %}
## Create an IAM role and policy
{% hint style="info" %}
This guide assumes your BYOC backend is set up on AWS. If it's not, please follow the guidelines in this [guide](/integrations/data-sources/aws/adding-aws-integration-with-a-backend-on-another-cloud-provider.md).
{% endhint %}
Follow the below guidelines to set up a role manually, or configure it using CloudFormation using this [script](https://console.aws.amazon.com/cloudformation/home#/stacks/create/review?stackName=groundcover-integratios-agent\&templateURL=https://groundcover-public-cloudformation-templates.s3.us-east-1.amazonaws.com/integrations-agent/cloudformation.yaml).
{% hint style="info" %}
The following part requires two parameters:
* `YOUR_GROUNDCOVER_ACCOUNT_ID` - the AWS account id hosting the groundcover backend, [created during onboarding](/architecture/byoc/setup-byoc-with-aws.md#step-1-allocate-an-aws-account-to-groundcover)
* `GROUNDCOVER_SITE_ID` - the groundcover site ID as extracted from your BYOC endpoint:
* Fetch your `BYOC endpoint` from [these docs](/architecture/byoc/ingestion-endpoints.md#fetching-the-byoc-endpoint)\
It will look like `.platform.grcv.io`
* The `GROUNDCOVER_SITE_ID` is the first part marked above as ``
* For example, if your BYOC endpoint address is m234r1.platform.grcv.io, then the GROUNDCOVER\_SITE\_ID will be m234r1.
{% endhint %}
1. Go to[ Amazon IAM](https://console.aws.amazon.com/iam/)
2. Click on **Roles** in the side bar
3. Click on **Create Role**
1. Select **Custom trust policy**
2. Paste the following policy:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam:::role/groundcover-integrations-agent--sa"
},
"Action": "sts:AssumeRole"
}
]
}
```
3. Click on **Next** twice (we'll attach permissions later)
4. Provide a name for the role
5. Click on **Create Role**
4. Go to your newly created role
1. In the **Permissions** section, click on **Add permissions** and then **Create inline policy**
2. Click on **JSON** and paste the following:
```json
{
"Version": "2012-10-17",
"Id": "groundcover-integrations-agent",
"Statement": [
{
"Action": [
"tag:GetResources",
"storagegateway:ListTagsForResource",
"storagegateway:ListGateways",
"shield:ListProtections",
"iam:ListAccountAliases",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeSpotFleetRequests",
"dms:DescribeReplicationTasks",
"dms:DescribeReplicationInstances",
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:GetMetricData",
"autoscaling:DescribeAutoScalingGroups",
"aps:ListWorkspaces",
"apigateway:GET",
"s3:ListAllMyBuckets",
"s3:GetBucketLocation",
"s3:GetBucketTagging",
"sqs:ListQueues",
"sqs:GetQueueAttributes",
"rds:DescribeDBInstances",
"rds:DescribeDBClusters",
"lambda:ListFunctions",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeServerlessCaches",
"elasticloadbalancing:DescribeLoadBalancers",
"dynamodb:ListTables",
"dynamodb:ListTagsOfResource",
"dynamodb:DescribeTable",
"airflow:GetEnvironment",
"airflow:ListEnvironments",
"ecs:ListClusters",
"ecs:DescribeClusters",
"ecs:ListServices",
"ecs:DescribeServices",
"ecs:ListTasks",
"ecs:DescribeTasks",
"es:ListDomainNames",
"cloudfront:ListDistributions",
"kinesisanalytics:ListApplications",
"kinesisanalytics:ListTagsForResource"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
```
3. Click on **Next**
4. Give the policy a name
5. Click on **Create Policy**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.groundcover.com/integrations/data-sources/aws/ingest-cloudwatch-metrics.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.