CloudWatch

Use the CloudWatch integration to give a workbench read-only access to the metrics, logs, dashboards, and alarms in one AWS region of your account. After you configure the connection once, you can attach it to one or more workbenches and investigate CloudWatch data with natural-language prompts.

This guide uses the Plural Console UI. For the complete list of integrations and general tool behavior, see Workbench tools.

Prerequisites

Before you begin, make sure you have:

• An AWS account whose CloudWatch metrics and CloudWatch Logs contain the data you want the workbench to query.
• The AWS region to query, such as us-east-1. Each CloudWatch tool queries a single region.
• An AWS identity with CloudWatch read access. You can use an IAM role that Plural assumes, static access keys, or both. See Choose how Plural authenticates.
• Permission in Plural Console to create a configured tool and edit the target workbench.
• An existing workbench, or permission to create one. See Setting up a workbench.

Choose how Plural authenticates

Plural supports these credential setups:

• Assume a role (preferred). Enter a Role ARN. Plural calls sts:AssumeRole on that role, optionally with an External ID and Role session name. The identity that assumes the role is either the static access keys you enter or, if you leave them empty, the default AWS credentials of Plural's query service (for example, its workload identity in a self-hosted install).
• Static access keys. Enter an Access key ID and Secret access key for a dedicated IAM user. You must set both or neither.

For cross-account access, the role's trust policy must allow the calling identity to perform sts:AssumeRole. If you configure an external ID on the trust policy, enter the same value in External ID.