Zakaria
86 lines
3.6 KiB
Markdown
86 lines
3.6 KiB
Markdown
# CloudWatch Observability Access Manager (`oam:*`)
|
|
|
|
**Protocol:** REST JSON
|
|
**Signing name:** `oam`
|
|
**API version:** `2022-06-10`
|
|
|
|
Floci emulates the CloudWatch Observability Access Manager control plane for cross-account observability links. Sinks and links are account and Region scoped, and attached-link discovery crosses source-account storage partitions in the same way the AWS API exposes source links to a monitoring sink.
|
|
|
|
## Supported operations
|
|
|
|
| Operation | Notes |
|
|
|---|---|
|
|
| `CreateSink` | Creates the single sink allowed for the calling account and Region |
|
|
| `GetSink` | Returns one sink by ARN |
|
|
| `ListSinks` | Lists sinks for the calling account and Region |
|
|
| `PutSinkPolicy` | Stores and validates the sink resource policy |
|
|
| `GetSinkPolicy` | Returns the current policy for a sink |
|
|
| `DeleteSink` | Rejects deletion while links remain attached |
|
|
| `CreateLink` | Creates a source-account link after evaluating the sink policy |
|
|
| `GetLink` | Returns one source-account link |
|
|
| `ListLinks` | Lists links owned by the calling source account |
|
|
| `ListAttachedLinks` | Lists links from all source accounts attached to a sink |
|
|
| `UpdateLink` | Replaces shared resource types and optional metric/log filters |
|
|
| `DeleteLink` | Deletes a source-account link |
|
|
| `ListTagsForResource` | Returns tags for a sink or link |
|
|
| `TagResource` | Adds or replaces tags on a sink or link |
|
|
| `UntagResource` | Removes tag keys from a sink or link |
|
|
|
|
## Sink policies
|
|
|
|
`PutSinkPolicy` accepts IAM-style JSON policies. For `CreateLink`, Floci evaluates the policy's `Effect`, `Principal`, `Action`, `Resource`, and the `oam:ResourceTypes` condition. Individual account principals, account root ARNs, wildcard principals, exact sink ARNs, and wildcard resources are supported.
|
|
|
|
Organization-based conditions are not currently resolved through AWS Organizations metadata. Policies that depend on organization condition keys should use explicit account principals when testing locally.
|
|
|
|
## Resource types and filters
|
|
|
|
Floci accepts the resource types modeled by the current OAM API:
|
|
|
|
- `AWS::CloudWatch::Metric`
|
|
- `AWS::Logs::LogGroup`
|
|
- `AWS::XRay::Trace`
|
|
- `AWS::ApplicationInsights::Application`
|
|
- `AWS::InternetMonitor::Monitor`
|
|
- `AWS::ApplicationSignals::Service`
|
|
- `AWS::ApplicationSignals::ServiceLevelObjective`
|
|
|
|
Metric and log-group filters are persisted with the link. Updating a filter to `*` removes that filter, matching the AWS update contract.
|
|
|
|
## Quotas and validation
|
|
|
|
- One sink per account per Region.
|
|
- Up to five links per source account per Region.
|
|
- `ListSinks` accepts `MaxResults` from 1 to 100.
|
|
- `ListLinks` accepts `MaxResults` from 1 to 5.
|
|
- `ListAttachedLinks` accepts `MaxResults` from 1 to 1000.
|
|
- A sink cannot be deleted while links are attached.
|
|
- Sinks and links support up to 50 tags.
|
|
|
|
Floci resolves the account-derived label variables to the local account ID because the emulator has no AWS account email/name directory attached to OAM itself.
|
|
|
|
## Configuration
|
|
|
|
| Variable | Default | Description |
|
|
|---|---|---|
|
|
| `FLOCI_SERVICES_OAM_ENABLED` | `true` | Enable or disable OAM |
|
|
|
|
## Example
|
|
|
|
```bash
|
|
export AWS_ENDPOINT_URL=http://localhost:4566
|
|
export AWS_DEFAULT_REGION=us-east-1
|
|
export AWS_ACCESS_KEY_ID=test
|
|
export AWS_SECRET_ACCESS_KEY=test
|
|
|
|
sink_arn=$(aws oam create-sink --name local-observability --query Arn --output text)
|
|
|
|
aws oam put-sink-policy \
|
|
--sink-identifier "$sink_arn" \
|
|
--policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"oam:CreateLink","Resource":"*"}]}'
|
|
|
|
aws oam create-link \
|
|
--sink-identifier "$sink_arn" \
|
|
--label-template local-source \
|
|
--resource-types AWS::CloudWatch::Metric AWS::Logs::LogGroup
|
|
```
|