second first commit

2026-09-22 08:57:00 -04:00
parent e88d7e2ff3
commit 0aef7fb2d8
4766 changed files with 1236986 additions and 0 deletions
@@ -0,0 +1,85 @@
+# CloudWatch Observability Access Manager (`oam:*`)
+
+**Protocol:** REST JSON
+**Signing name:** `oam`
+**API version:** `2022-06-10`
+
+Floci emulates the CloudWatch Observability Access Manager control plane for cross-account observability links. Sinks and links are account and Region scoped, and attached-link discovery crosses source-account storage partitions in the same way the AWS API exposes source links to a monitoring sink.
+
+## Supported operations
+
+| Operation | Notes |
+|---|---|
+| `CreateSink` | Creates the single sink allowed for the calling account and Region |
+| `GetSink` | Returns one sink by ARN |
+| `ListSinks` | Lists sinks for the calling account and Region |
+| `PutSinkPolicy` | Stores and validates the sink resource policy |
+| `GetSinkPolicy` | Returns the current policy for a sink |
+| `DeleteSink` | Rejects deletion while links remain attached |
+| `CreateLink` | Creates a source-account link after evaluating the sink policy |
+| `GetLink` | Returns one source-account link |
+| `ListLinks` | Lists links owned by the calling source account |
+| `ListAttachedLinks` | Lists links from all source accounts attached to a sink |
+| `UpdateLink` | Replaces shared resource types and optional metric/log filters |
+| `DeleteLink` | Deletes a source-account link |
+| `ListTagsForResource` | Returns tags for a sink or link |
+| `TagResource` | Adds or replaces tags on a sink or link |
+| `UntagResource` | Removes tag keys from a sink or link |
+
+## Sink policies
+
+`PutSinkPolicy` accepts IAM-style JSON policies. For `CreateLink`, Floci evaluates the policy's `Effect`, `Principal`, `Action`, `Resource`, and the `oam:ResourceTypes` condition. Individual account principals, account root ARNs, wildcard principals, exact sink ARNs, and wildcard resources are supported.
+
+Organization-based conditions are not currently resolved through AWS Organizations metadata. Policies that depend on organization condition keys should use explicit account principals when testing locally.
+
+## Resource types and filters
+
+Floci accepts the resource types modeled by the current OAM API:
+
+- `AWS::CloudWatch::Metric`
+- `AWS::Logs::LogGroup`
+- `AWS::XRay::Trace`
+- `AWS::ApplicationInsights::Application`
+- `AWS::InternetMonitor::Monitor`
+- `AWS::ApplicationSignals::Service`
+- `AWS::ApplicationSignals::ServiceLevelObjective`
+
+Metric and log-group filters are persisted with the link. Updating a filter to `*` removes that filter, matching the AWS update contract.
+
+## Quotas and validation
+
+- One sink per account per Region.
+- Up to five links per source account per Region.
+- `ListSinks` accepts `MaxResults` from 1 to 100.
+- `ListLinks` accepts `MaxResults` from 1 to 5.
+- `ListAttachedLinks` accepts `MaxResults` from 1 to 1000.
+- A sink cannot be deleted while links are attached.
+- Sinks and links support up to 50 tags.
+
+Floci resolves the account-derived label variables to the local account ID because the emulator has no AWS account email/name directory attached to OAM itself.
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `FLOCI_SERVICES_OAM_ENABLED` | `true` | Enable or disable OAM |
+
+## Example
+
+```bash
+export AWS_ENDPOINT_URL=http://localhost:4566
+export AWS_DEFAULT_REGION=us-east-1
+export AWS_ACCESS_KEY_ID=test
+export AWS_SECRET_ACCESS_KEY=test
+
+sink_arn=$(aws oam create-sink --name local-observability --query Arn --output text)
+
+aws oam put-sink-policy \
+  --sink-identifier "$sink_arn" \
+  --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"oam:CreateLink","Resource":"*"}]}'
+
+aws oam create-link \
+  --sink-identifier "$sink_arn" \
+  --label-template local-source \
+  --resource-types AWS::CloudWatch::Metric AWS::Logs::LogGroup
+```