Skip to main content
Information Security for Workload Factory

Amazon CloudWatch monitoring permissions for NetApp Workload Factory

Contributors netapp-rlithman
PDFs

Amazon CloudWatch monitoring permissions are optional in NetApp Workload Factory and apply only when you deploy the separate monitoring stack. The monitoring stack provides operational visibility by collecting file system metrics, publishing event logs, managing CloudWatch dashboards and alarms, and sending alert notifications through Amazon SNS. The stack also requires access to retrieve ONTAP credentials when needed for monitoring.

Required CloudWatch monitoring permissions

The following permissions are required for the optional monitoring stack:

Permission Purpose

fsx:Describe* / fsx:ListTagsForResource

Collect file system metrics

cloudwatch:PutMetricData / cloudwatch:PutDashboard / cloudwatch:PutMetricAlarm / cloudwatch:DescribeAlarms / cloudwatch:Delete*

Manage dashboards and alarms

logs:CreateLogGroup / logs:CreateLogStream / logs:PutLogEvents

Publish event logs

sns:Publish

Send alert notifications

secretsmanager:GetSecretValue

Retrieve ONTAP credentials for monitoring