Using a service-linked role for CloudWatch Network Monitor - Amazon CloudWatch
AWSServiceRoleForNetworkMonitorCreate the service-linked roleEdit the service-linked roleDelete the service-linked roleSupported Regions

Using a service-linked role for CloudWatch Network Monitor

Amazon CloudWatch Network Monitor uses the following service-linked role for the permissions that it requires to call other AWS services on your behalf:

AWSServiceRoleForNetworkMonitor

CloudWatch Network Monitoring uses the service-linked role named AWSServiceRoleForNetworkMonitor to update and manage CloudWatch network monitors.

The AWSServiceRoleForNetworkMonitor service-linked role trusts the following service to assume the role:

  • networkmonitor.amazonaws.com

The CloudWatchNetworkMonitorServiceRolePolicy is attached to the service linked role and grants access for the service to access VPC and EC2 resources in your account, as well as manage the network monitors that were created.

Permission groupings

The policy is grouped into the following sets of permissions:

  • cloudwatch - This allows the service principal to publish network monitoring metrics to CloudWatch resources.

  • ec2 - This allows the service principal to describe VPCs and subnets in your account to create or update monitors and probes. This also allows the service principal to create, modify, and delete security groups, network interfaces, and their associated permissions to configure the monitor or probe to send monitoring traffic to your endpoints.

For more information about the policy, see AWS managed policies for CloudWatch Network Monitor.

The following shows the CloudWatchNetworkMonitorServiceRolePolicy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "PublishCw",
			"Effect": "Allow",
			"Action": "cloudwatch:PutMetricData",
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"cloudwatch:namespace": "AWS/NetworkMonitor"
				}
			}
		},
		{
			"Sid": "DescribeAny",
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeNetworkInterfaces",
				"ec2:DescribeNetworkInterfaceAttribute",
				"ec2:DescribeVpcs",
				"ec2:DescribeNetworkInterfacePermissions",
				"ec2:DescribeSubnets",
				"ec2:DescribeSecurityGroups"
			],
			"Resource": "*"
		},
		{
			"Sid": "DeleteModifyEc2Resources",
			"Effect": "Allow",
			"Action": [
				"ec2:AuthorizeSecurityGroupEgress",
				"ec2:CreateNetworkInterfacePermission",
				"ec2:DeleteNetworkInterfacePermission",
				"ec2:RevokeSecurityGroupEgress",
				"ec2:ModifyNetworkInterfaceAttribute",
				"ec2:DeleteNetworkInterface",
				"ec2:DeleteSecurityGroup"
			],
			"Resource": [
				"arn:aws:ec2:*:*:network-interface/*",
				"arn:aws:ec2:*:*:security-group/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceTag/ManagedByCloudWatchNetworkMonitor": "true"
				}
			}
		}
	]
}

Create the service-linked role

AWSServiceRoleForNetworkMonitor

You don't need to manually create the or AWSServiceRoleForNetworkMonitor role.

  • CloudWatch Network Monitor creates the AWSServiceRoleForNetworkMonitor role when you create your first network monitor. This role will apply to any subsequent monitors you create.

To create a service-linked role on your behalf, you must have the required permissions. For more information, see Service-Linked Role Permissions in the IAM User Guide.

Edit the service-linked role

You can edit the AWSServiceRoleForNetworkMonitor descriptions using IAM. For more information, see Editing a Service-Linked Role in the IAM User Guide.

Delete the service-linked role

If you no longer need to use CloudWatch Network Monitor, we recommend that you delete the AWSServiceRoleForNetworkMonitor role.

You can delete these service-linked roles only after you delete your network monitor. For information about deleting your network monitor, see Delete a network monitor.

You can use the IAM console, the IAM CLI, or the IAM API to delete service-linked roles. For more information, see Deleting a Service-Linked Role in the IAM User Guide.

After you delete AWSServiceRoleForNetworkMonitor CloudWatch Network Monitor will create the role again when you create a new monitor.

Supported Regions for the CloudWatch Network Monitor service-linked role

CloudWatch Network Monitor supports the service-linked role in all of AWS Regions where the service is available. For more information, see AWS endpoints in the AWS General Reference.