Connect CloudWatch
Connect AWS CloudWatch so Adduce reads the alarms that are firing and the errors that keep repeating in your log groups.
Adduce reads the CloudWatch alarms that are firing right now, and the error messages that keep repeating in the log groups you name.
Beta
This connector works, but it has not been proven against a real customer account yet, so Adduce badges it Beta wherever it appears. Tell us at hello@adducehq.com if what you see does not match this page.
Before you begin
- Role: project Editor or Lead. A workspace Admin is a lead on every project.
- In AWS: permission to create an IAM user and attach a read-only policy.
- To hand: the region, a long-lived access key pair, and the names of the log groups worth scanning.
- Time: fifteen minutes, most of it in the AWS console.
What Adduce reads
| Surface | What it becomes |
|---|---|
| Alarms in the ALARM state | Evidence naming the alarm, the reason it fired, and the metric it watches |
| Repeating error messages | Evidence quoting the message, with how many times it occurred in the last day |
Both are pain points, and both are a snapshot rather than a history: every sync re-reads the current alarms and a trailing twenty-four hours of logs, and refreshes what it already holds. An alarm that recovers keeps its evidence, because the problem was real.
Permissions the key needs
| Action | Why |
|---|---|
cloudwatch:DescribeAlarms | list the alarms that are firing |
logs:DescribeLogGroups | confirm the log groups you named exist |
logs:StartQuery | start the query that groups repeating errors |
logs:GetQueryResults | read that query's results |
logs:StopQuery | stop it cleanly |
That is the whole policy, on Resource: *. Nothing is written, and no other AWS service is touched.
Steps
In AWS, create an IAM user for Adduce and attach a policy with the five read-only actions above.
Create a long-lived access key for that user. It starts AKIA. A temporary ASIA… session key expires and cannot drive a daily sync.
Note the region your log groups live in, and the exact log group names — for example /aws/lambda/checkout.
In Adduce, open the project, choose Sources, then Add source, and choose the CloudWatch tile.
On Connection details, name the source, enter the region, paste the key pair, and list the log groups, separated by commas. Standard regions only; GovCloud is not supported.
Check the help under Secret access key if you are writing the IAM policy as you go — it lists the same five actions.
Choose Continue. Adduce makes one signed call per log group, which proves the key pair, the region, the policy and that each group exists, before anything is saved.
First sync and cadence
There is no backfill. Every sync reads the alarms that are firing at that moment and one query across the last twenty-four hours of your log groups, taking the hundred most common error patterns. The first sync and the hundredth read the same window. Adduce syncs once a day at 03:00 UTC, and Sync now runs one immediately.
Alarms and logs are read separately, so a failure on one still lets the other through. If AWS names a log group it cannot find, that group is dropped for the run and the rest are still read.
Disconnect or replace credentials
Delete the source from its page and type its name to confirm. Deleting removes the evidence it produced. To rotate the key pair, or to change the log groups, delete the source and add it again; the next sync reads the same trailing day, so nothing is lost.
If it did not work
Why were the credentials rejected?
AWS refused the signature or the identity. The usual causes are a key pair from a different account, a key that has been deactivated, and a policy without logs:DescribeLogGroups. Check the key starts AKIA rather than ASIA.
Why does it say a log group was not found?
The name has to match exactly, including the leading slash, and the group has to be in the region you entered. The message names the group that failed.
Why is there an alarm but no log evidence?
Nothing in those groups matched in the last day. The query looks for lines mentioning an error, an exception, a fatal or a panic, so logs that word failures differently produce no evidence even while the service is unhappy.
What's next
Connect PagerDuty
Connect PagerDuty so Adduce reads the incidents your team declared, how long each one lasted, and how many people it pulled in.
Connect Azure Application Insights
Connect Application Insights so Adduce reads the alert rules that fired this week and the exceptions your app throws most often.