Skip to content

CloudWatch Observability Access Manager (oam:*)

Protocol: REST JSON Signing name: oam API version: 2022-06-10

Floci emulates the CloudWatch Observability Access Manager control plane for cross-account observability links. Sinks and links are account and Region scoped, and attached-link discovery crosses source-account storage partitions in the same way the AWS API exposes source links to a monitoring sink.

Supported operations

Operation Notes
CreateSink Creates the single sink allowed for the calling account and Region
GetSink Returns one sink by ARN
ListSinks Lists sinks for the calling account and Region
PutSinkPolicy Stores and validates the sink resource policy
GetSinkPolicy Returns the current policy for a sink
DeleteSink Rejects deletion while links remain attached
CreateLink Creates a source-account link after evaluating the sink policy
GetLink Returns one source-account link
ListLinks Lists links owned by the calling source account
ListAttachedLinks Lists links from all source accounts attached to a sink
UpdateLink Replaces shared resource types and optional metric/log filters
DeleteLink Deletes a source-account link
ListTagsForResource Returns tags for a sink or link
TagResource Adds or replaces tags on a sink or link
UntagResource Removes tag keys from a sink or link

Sink policies

PutSinkPolicy accepts IAM-style JSON policies. For CreateLink, Floci evaluates the policy's Effect, Principal, Action, Resource, and the oam:ResourceTypes condition. Individual account principals, account root ARNs, wildcard principals, exact sink ARNs, and wildcard resources are supported.

Organization-based conditions are not currently resolved through AWS Organizations metadata. Policies that depend on organization condition keys should use explicit account principals when testing locally.

Resource types and filters

Floci accepts the resource types modeled by the current OAM API:

  • AWS::CloudWatch::Metric
  • AWS::Logs::LogGroup
  • AWS::XRay::Trace
  • AWS::ApplicationInsights::Application
  • AWS::InternetMonitor::Monitor
  • AWS::ApplicationSignals::Service
  • AWS::ApplicationSignals::ServiceLevelObjective

Metric and log-group filters are persisted with the link. Updating a filter to * removes that filter, matching the AWS update contract.

Quotas and validation

  • One sink per account per Region.
  • Up to five links per source account per Region.
  • ListSinks accepts MaxResults from 1 to 100.
  • ListLinks accepts MaxResults from 1 to 5.
  • ListAttachedLinks accepts MaxResults from 1 to 1000.
  • A sink cannot be deleted while links are attached.
  • Sinks and links support up to 50 tags.

Floci resolves the account-derived label variables to the local account ID because the emulator has no AWS account email/name directory attached to OAM itself.

Configuration

Variable Default Description
FLOCI_SERVICES_OAM_ENABLED true Enable or disable OAM

Example

export AWS_ENDPOINT_URL=http://localhost:4566
export AWS_DEFAULT_REGION=us-east-1
export AWS_ACCESS_KEY_ID=test
export AWS_SECRET_ACCESS_KEY=test

sink_arn=$(aws oam create-sink --name local-observability --query Arn --output text)

aws oam put-sink-policy \
  --sink-identifier "$sink_arn" \
  --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"oam:CreateLink","Resource":"*"}]}'

aws oam create-link \
  --sink-identifier "$sink_arn" \
  --label-template local-source \
  --resource-types AWS::CloudWatch::Metric AWS::Logs::LogGroup