Skip to main content
The Amazon CloudWatch integration exposes your CloudWatch metrics and logs to Traversal as native telemetry. Traversal can correlate these signals with your other data during investigations. This integration is separate from AWS Account, which provides broad AWS CLI inspection across services. Configure both when you want native CloudWatch telemetry together with wider resource and configuration context. CloudWatch access is pull-based and read-only. Traversal assumes a role in your account through AWS STS and does not require long-lived access keys.

​
What Traversal reads

  • Metrics — discover metrics, query time series and statistics, and inspect CloudWatch dashboards
  • Logs — discover log groups and streams, read and filter events, and run CloudWatch Logs Insights queries
Traversal queries only the regions configured on this integration.

​
Example prompts

  • Inspect CloudWatch metrics for anomalies around the start of this incident.
  • Search the relevant CloudWatch log groups for errors and correlate them with metric changes.
  • Compare latency, error, and saturation metrics across the configured regions.

​
Setup

1

Download the CloudFormation template

In Traversal, go to Company Knowledge > Integrations, select CloudWatch, and download the CloudFormation template. It’s pre-filled with your external ID and Traversal’s AWS account ID — no parameters required.
2

Deploy the role

Deploy the template in the AWS account whose CloudWatch data you want Traversal to read. This creates a read-only IAM role that trusts Traversal’s AWS principal, with the sts:ExternalId condition pinned to traversal:<your_org_id>.
Traversal assumes this role via STS for each request — it never receives or stores long-lived AWS access keys.
3

Copy the role ARN

Once the stack finishes, copy the role ARN from its outputs.
4

Configure in Traversal

Back in the CloudWatch integration form, enter:
  • Role ARN
  • Regions — every AWS region that hosts CloudWatch metrics or log groups you want investigated
Metrics and log groups are region-scoped, so a region not listed here won’t be queried.
To connect additional AWS accounts, repeat these steps for each account — CloudWatch supports multiple integration instances, one per account.

​
Required permissions

The CloudFormation template grants only the CloudWatch and CloudWatch Logs actions needed to discover and query telemetry. These include metric listing, data and statistics queries, dashboard reads, log group and stream discovery, event reads and filtering, and Logs Insights query operations. The policy uses Resource: "*" because these discovery and query APIs do not support narrower resource-level scoping. Traversal limits queries to the regions in the integration configuration.

​
More information