AWS.ObservabilityAdmin reference

GetTelemetryEnrichmentStatus

Source: src/AWS/ObservabilityAdmin/GetTelemetryEnrichmentStatus.ts

Runtime binding for observabilityadmin:GetTelemetryEnrichmentStatus — reads the status of the account’s telemetry enrichment feature (resource tags added to telemetry). Fails with a typed ResourceNotFoundException when the account has never onboarded to enrichment.

Provide AWS.ObservabilityAdmin.GetTelemetryEnrichmentStatusHttp on the hosting Lambda Function to satisfy the requirement.

GetTelemetryEnrichmentStatus: Reading Enrichment Status

// init — grants observabilityadmin:GetTelemetryEnrichmentStatus
const getEnrichmentStatus = yield* AWS.ObservabilityAdmin.GetTelemetryEnrichmentStatus();

// runtime
const status = yield* getEnrichmentStatus().pipe(
  Effect.map((r) => r.Status ?? "Stopped"),
  Effect.catchTag("ResourceNotFoundException", () =>
    Effect.succeed("NotOnboarded"),
  ),
);

GetTelemetryEvaluationStatus

Source: src/AWS/ObservabilityAdmin/GetTelemetryEvaluationStatus.ts

Runtime binding for observabilityadmin:GetTelemetryEvaluationStatus — reads the account’s telemetry config onboarding status (RUNNING, STOPPED, NOT_STARTED, …), e.g. for a compliance function that verifies telemetry auditing stays enabled.

Provide AWS.ObservabilityAdmin.GetTelemetryEvaluationStatusHttp on the hosting Lambda Function to satisfy the requirement.

GetTelemetryEvaluationStatus: Reading Onboarding Status

// init — grants observabilityadmin:GetTelemetryEvaluationStatus
const getEvaluationStatus = yield* AWS.ObservabilityAdmin.GetTelemetryEvaluationStatus();

// runtime
const { Status } = yield* getEvaluationStatus();
if (Status !== "RUNNING") {
  yield* Effect.logWarning("telemetry auditing is off");
}

GetTelemetryRule

Source: src/AWS/ObservabilityAdmin/GetTelemetryRule.ts

Runtime binding for observabilityadmin:GetTelemetryRule — reads the full configuration and per-region status of the bound TelemetryRule. The rule’s name is injected automatically and the IAM grant is scoped to the rule’s ARN.

Provide AWS.ObservabilityAdmin.GetTelemetryRuleHttp on the hosting Lambda Function to satisfy the requirement.

GetTelemetryRule: Reading a Telemetry Rule

// init — grants observabilityadmin:GetTelemetryRule on the rule
const getTelemetryRule = yield* AWS.ObservabilityAdmin.GetTelemetryRule(rule);

// runtime
const { TelemetryRule: config, RegionStatuses } = yield* getTelemetryRule();

ListResourceTelemetry

Source: src/AWS/ObservabilityAdmin/ListResourceTelemetry.ts

Runtime binding for observabilityadmin:ListResourceTelemetry — audits which AWS resources (VPCs, Lambda functions, …) have telemetry such as flow logs configured, and in what state. The account-level telemetry config data plane; requires the account to be onboarded (see ObservabilityAdmin.TelemetryConfig).

Provide AWS.ObservabilityAdmin.ListResourceTelemetryHttp on the hosting Lambda Function to satisfy the requirement.

Known platform quirk (observed 2026-07): the service’s authorization for this action can reject callers whose grant comes from an inline role policy (even observabilityadmin:* on Resource: "*") with a typed AccessDeniedException, while principals with managed policies succeed. Handle the typed tag until AWS fixes the action’s auth integration.

ListResourceTelemetry: Auditing Resource Telemetry

// init — grants observabilityadmin:ListResourceTelemetry
const listResourceTelemetry = yield* AWS.ObservabilityAdmin.ListResourceTelemetry();

// runtime
const { TelemetryConfigurations } = yield* listResourceTelemetry({
  ResourceTypes: ["AWS::EC2::VPC"],
  TelemetryConfigurationState: { Logs: "NotEnabled" },
});

ListTelemetryRules

Source: src/AWS/ObservabilityAdmin/ListTelemetryRules.ts

Runtime binding for observabilityadmin:ListTelemetryRules — enumerates the account’s telemetry rules (name, ARN, telemetry type, source types), e.g. for an audit function that reports which auto-enable rules exist.

Provide AWS.ObservabilityAdmin.ListTelemetryRulesHttp on the hosting Lambda Function to satisfy the requirement.

ListTelemetryRules: Listing Telemetry Rules

// init — grants observabilityadmin:ListTelemetryRules
const listTelemetryRules = yield* AWS.ObservabilityAdmin.ListTelemetryRules();

// runtime
const { TelemetryRuleSummaries } = yield* listTelemetryRules();
for (const rule of TelemetryRuleSummaries ?? []) {
  yield* Effect.log(`${rule.RuleName}: ${rule.TelemetryType}`);
}

TelemetryConfig

Source: src/AWS/ObservabilityAdmin/TelemetryConfig.ts

Account-level CloudWatch telemetry config (Observability Admin telemetry evaluation) — an account singleton that audits which AWS resources (VPCs, Lambda functions, …) have telemetry such as flow logs enabled.

This is an always-present account setting, not a discrete resource: deploying it onboards the account, and destroying it restores whatever onboarding state the account had before the stack first managed it.

TelemetryConfig: Managing telemetry config

Onboard the account

import * as ObservabilityAdmin from "alchemy/AWS/ObservabilityAdmin";

const telemetry = yield* ObservabilityAdmin.TelemetryConfig("Telemetry");

Keep the resource but switch the feature off

const telemetry = yield* ObservabilityAdmin.TelemetryConfig("Telemetry", {
  enabled: false,
});

TelemetryRule

Source: src/AWS/ObservabilityAdmin/TelemetryRule.ts

A CloudWatch telemetry rule (Observability Admin) — automatically enables telemetry (such as VPC flow logs) for AWS resources in your account that match the rule’s criteria.

The account must be onboarded to CloudWatch telemetry config (see ObservabilityAdmin.TelemetryConfig) before rules can be created.

TelemetryRule: Creating a Telemetry Rule

Enable VPC flow logs for the account’s VPCs

import * as ObservabilityAdmin from "alchemy/AWS/ObservabilityAdmin";

// Onboard the account to telemetry config first.
const telemetry = yield* ObservabilityAdmin.TelemetryConfig("Telemetry");

const rule = yield* ObservabilityAdmin.TelemetryRule("FlowLogs", {
  resourceType: "AWS::EC2::VPC",
  telemetryType: "Logs",
  telemetrySourceTypes: ["VPC_FLOW_LOGS"],
  destinationConfiguration: {
    DestinationType: "cloud-watch-logs",
    Retention: "30 days",
  },
});

Custom flow-log parameters

const rule = yield* ObservabilityAdmin.TelemetryRule("FlowLogs", {
  resourceType: "AWS::EC2::VPC",
  telemetryType: "Logs",
  telemetrySourceTypes: ["VPC_FLOW_LOGS"],
  destinationConfiguration: {
    DestinationType: "cloud-watch-logs",
    Retention: "90 days",
    VPCFlowLogParameters: {
      TrafficType: "REJECT",
      MaxAggregationInterval: 600,
    },
  },
});