> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traversal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CloudWatch

> Connect Amazon CloudWatch to query metrics and logs via a cross-account IAM role during investigations.

Connecting CloudWatch lets Traversal query your AWS CloudWatch metrics and logs during investigations, using a cross-account IAM role rather than long-lived AWS credentials, so it can correlate infrastructure signals and surface anomalies alongside your other telemetry.

## What Traversal reads

* **Metrics** — time-series data via `GetMetricData`
* **Logs** — log group events via CloudWatch Logs

## Setup

<Steps>
  <Step title="Download the CloudFormation template">
    In Traversal, go to **Company Knowledge > Integrations**, select CloudWatch, and download the CloudFormation template. It's pre-filled with your external ID and Traversal's AWS account ID — no parameters required.
  </Step>

  <Step title="Deploy the role">
    Deploy the template in the AWS account whose CloudWatch data you want Traversal to read. This creates a read-only IAM role that trusts Traversal's AWS principal, with the `sts:ExternalId` condition pinned to `traversal:<your_org_id>`.

    <Note>
      Traversal assumes this role via STS for each request — it never receives or stores long-lived AWS access keys.
    </Note>
  </Step>

  <Step title="Copy the role ARN">
    Once the stack finishes, copy the role ARN from its outputs.
  </Step>

  <Step title="Configure in Traversal">
    Back in the CloudWatch integration form, enter:

    * **Role ARN**
    * **Regions** — every AWS region that hosts CloudWatch metrics or log groups you want investigated

    <Note>
      Metrics and log groups are region-scoped, so a region not listed here won't be queried.
    </Note>
  </Step>
</Steps>

<Tip>
  To connect additional AWS accounts, repeat these steps for each account — CloudWatch supports multiple integration instances, one per account.
</Tip>

## More information

* [IAM roles with external ID conditions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html)