---
sidebar_label: AWS CloudWatch
doc_id: 6f955947-7e25-4807-a34c-f534fce036f5
description: >-
  AWS CloudWatch configuration for cross-account log collection with IAM
  role-based access
keywords:
  - AWS CloudWatch
  - IAM roles
  - logs configuration
  - cross-account access
  - observability
---

# AWS CloudWatch

AWS CloudWatch configuration

**Type**: `aws-cloudwatch-logs-configuration`

**Properties**

|Name|Type|Description|Required|
|----|----|-----------|--------|
|[**setup**](#setup)|`object`|Access configuration<br/>|yes|
|[**settings**](#settings)|`object`||no|

**Additional Properties:** not allowed  
**Example**

```json
{
    "setup": {
        "reader_role_arn": "arn:aws:iam::123456789012:role/reader-role",
        "reader_role_external_id": "external-id",
        "reader_intermediate_role": "arn:aws:iam::123456789012:role/reader-role",
        "reader_intermediate_role_external_id": "external-id"
    },
    "settings": {
        "retention_in_days": 7
    }
}
```

<a name="setup"></a>
## setup: Setup

Access configuration

**Properties**

|Name|Type|Description|Required|
|----|----|-----------|--------|
|**reader\_role\_arn**<br/>(Role ARN)|`string`|Main reader IAM role ARN than nullplatform assumes to collect logs, metrics, and observability data from your AWS account.<br/>Pattern: `^arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@\-_/]+$`<br/>|yes|
|**reader\_role\_external\_id**<br/>(Role external ID)|`string`|External ID required when assuming the main reader role, providing additional security for cross-account access.<br/>Pattern: `^[a-zA-Z0-9+=,.@\-_/]+$`<br/>|no|
|**reader\_intermediate\_role**<br/>(Intermediate role ARN)|`string`|Intermediate IAM role ARN used when direct assumption of the main reader role isn't possible for CloudWatch data collection.<br/>Pattern: `^arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@\-_/]+$`<br/>|no|
|**reader\_intermediate\_role\_external\_id**<br/>(Intermediate role external ID)|`string`|External ID for the intermediate role if additional security is required for role assumption.<br/>Pattern: `^[a-zA-Z0-9+=,.@\-_/]+$`<br/>|no|

**Example**

```json
{
    "reader_role_arn": "arn:aws:iam::123456789012:role/reader-role",
    "reader_role_external_id": "external-id",
    "reader_intermediate_role": "arn:aws:iam::123456789012:role/reader-role",
    "reader_intermediate_role_external_id": "external-id"
}
```

<a name="settings"></a>
## settings: object

**Properties**

|Name|Type|Description|Required|
|----|----|-----------|--------|
|**retention\_in\_days**|`integer`|Number of days to retain CloudWatch log events. Must match one of the AWS-supported values.<br/>Default: `7`<br/>Enum: `1`, `3`, `5`, `7`, `14`, `30`, `60`, `90`, `120`, `150`, `180`, `365`, `400`, `545`, `731`, `1827`, `3653`, `0`<br/>||

**Example**

```json
{
    "retention_in_days": 7
}
```