Skip to content

AWS.OAM reference

Section titled “Link”

Source: src/AWS/OAM/Link.ts

A CloudWatch cross-account observability link — created in a source account, it attaches to a monitoring-account Sink and shares the selected telemetry types (metrics, log groups, traces, Application Signals) with that account.

The sink must live in a different account and its sink policy must authorize this account to link.

Section titled “Link: Creating a Link”

Share metrics and logs with a monitoring account

import * as OAM from "alchemy/AWS/OAM";


const link = yield* OAM.Link("ToMonitoring", {
  labelTemplate: "$AccountName",
  resourceTypes: ["AWS::CloudWatch::Metric", "AWS::Logs::LogGroup"],
  sinkIdentifier:
    "arn:aws:oam:us-west-2:111122223333:sink/1c72e9ec-4d4a-4e...",
});

Filter what is shared

const link = yield* OAM.Link("FilteredLink", {
  labelTemplate: "$AccountName",
  resourceTypes: ["AWS::CloudWatch::Metric", "AWS::Logs::LogGroup"],
  sinkIdentifier: sinkArn,
  linkConfiguration: {
    logGroupConfiguration: { filter: "LogGroupName LIKE 'aws/lambda/%'" },
    metricConfiguration: { filter: "Namespace NOT LIKE 'AWS/%'" },
  },
});
Section titled “ListAttachedLinks”

Source: src/AWS/OAM/ListAttachedLinks.ts

Runtime binding for oam:ListAttachedLinks — enumerate the source-account links attached to the bound monitoring-account Sink (each item carries the link’s ARN, resolved label, and shared resource types). The sink’s ARN is injected automatically.

Provide AWS.OAM.ListAttachedLinksHttp on the hosting Lambda Function to satisfy the requirement.

Section titled “ListAttachedLinks: Listing Attached Links”
// init — grants oam:ListAttachedLinks on the sink
const listAttachedLinks = yield* AWS.OAM.ListAttachedLinks(sink);


// runtime
const { Items } = yield* listAttachedLinks();
for (const item of Items) {
  yield* Effect.log(`${item.Label} shares ${item.ResourceTypes?.join(", ")}`);
}

Sink

Section titled “Sink”

Source: src/AWS/OAM/Sink.ts

A CloudWatch cross-account observability sink — the attachment point in a monitoring account that source accounts link to in order to share metrics, logs, traces, and Application Signals data.

Each account can contain one sink per region. After creating a sink, attach a sink policy (the policy prop) that authorizes source accounts (or an entire organization) to create links to it.

Sink: Creating a Sink

Section titled “Sink: Creating a Sink”

Basic Sink

import * as OAM from "alchemy/AWS/OAM";


const sink = yield* OAM.Sink("MonitoringSink");

Sink with a policy authorizing source accounts

const sink = yield* OAM.Sink("MonitoringSink", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: ["111122223333"] },
        Action: ["oam:CreateLink", "oam:UpdateLink"],
        Resource: "*",
        Condition: {
          "ForAllValues:StringEquals": {
            "oam:ResourceTypes": [
              "AWS::CloudWatch::Metric",
              "AWS::Logs::LogGroup",
            ],
          },
        },
      },
    ],
  },
});

Authorize an entire organization

const sink = yield* OAM.Sink("OrgSink", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: "*",
        Action: ["oam:CreateLink", "oam:UpdateLink"],
        Resource: "*",
        Condition: {
          "ForAnyValue:StringEquals": { "aws:PrincipalOrgID": "o-xxxxxxxxxx" },
        },
      },
    ],
  },
});