Skip to main content
The CloudWatch connector reads CloudWatch Logs and CloudWatch Metrics in one region. It never writes. Setup, the cross-account role and the IAM policy are on the AWS page.

​
Tools

Times take ISO 8601 (2026-09-26T10:00:00Z) or a relative duration back from now: 15m, 2h, 1d.

​
Safety

  • No write tools, and the recommended policy grants reads only.
  • Filter Log Events and Get Recent Errors page through at most 20 pages per call and stop at the timeout; a cut result says so.
  • Logs Insights bills per GB scanned. Keep the window short and filter early in the query.

​
Example prompts

  • “Pull the last 50 errors from /aws/lambda/checkout in the past hour and tell me which one dominates.”
  • “Run a Logs Insights query over /app/checkout counting card_declined by merchant for the last 6 hours.”
  • “Which CloudWatch alarms are firing right now, and since when?”
  • “Show p99 Duration for the checkout function over the last 3 hours in 5 minute buckets.”