Skip to main content
Connecting CloudWatch lets Traversal query your AWS CloudWatch metrics and logs during investigations, using a cross-account IAM role rather than long-lived AWS credentials, so it can correlate infrastructure signals and surface anomalies alongside your other telemetry.

​
What Traversal reads

  • Metrics — time-series data via GetMetricData
  • Logs — log group events via CloudWatch Logs

​
Setup

1

Download the CloudFormation template

In Traversal, go to Company Knowledge > Integrations, select CloudWatch, and download the CloudFormation template. It’s pre-filled with your external ID and Traversal’s AWS account ID — no parameters required.
2

Deploy the role

Deploy the template in the AWS account whose CloudWatch data you want Traversal to read. This creates a read-only IAM role that trusts Traversal’s AWS principal, with the sts:ExternalId condition pinned to traversal:<your_org_id>.
Traversal assumes this role via STS for each request — it never receives or stores long-lived AWS access keys.
3

Copy the role ARN

Once the stack finishes, copy the role ARN from its outputs.
4

Configure in Traversal

Back in the CloudWatch integration form, enter:
  • Role ARN
  • Regions — every AWS region that hosts CloudWatch metrics or log groups you want investigated
Metrics and log groups are region-scoped, so a region not listed here won’t be queried.
To connect additional AWS accounts, repeat these steps for each account — CloudWatch supports multiple integration instances, one per account.

​
More information