Using AWS Config for resource discovery
CloudWatch Omni uses AWS Config to find the AWS resources in your account. Omni then adds those resources to the context graph. This page lists the resource types that AWS Config records for Omni, and describes how the recorder works.
To learn how discovered resources appear in the graph, see Using Context Graph.
How the recorder works
Omni creates a service-linked configuration recorder
when you create a space. The recorder is named
AWSConfigurationRecorderForCloudWatch. You do not create
it. You do not configure it.
A service-linked recorder belongs to the service that it is linked to. That service sets the resource types to record. To learn more, see Working with the configuration recorder in the AWS Config Developer Guide.
The recorder works as follows:
-
You pay no AWS Config fee. Omni uses an internal recording scope. AWS Config does not send these records to your delivery channel, and you cannot read them in AWS Config. You can still see the recorder itself in the AWS Config console.
-
The recorder's settings are fixed. You cannot change them in AWS Config. You cannot rename the recorder, and you cannot start it or stop it. Omni sets which resource types the recorder records, and it records the same types in every account.
-
You can delete the recorder, but not while a space uses it. When you call
DeleteServiceLinkedConfigurationRecorder, AWS Config asks Omni whether it still uses the recorder. While your space has an active AWS Config integration, Omni answers yes and your call fails. To remove the recorder, delete the space first. -
Deleting the recorder stops resource discovery. Omni keeps the resources that it already found, and it adds no new ones. AWS Config keeps the records that it already made.
-
Your own recorder is separate. Omni does not change or use your customer managed recorder.
Note
Other CloudWatch features also create service-linked recorders. Your account can hold more than one recorder that is linked to CloudWatch.
Which resources become graph nodes
AWS Config records every type in the resource-type table on this page. Omni adds a graph node for only some of those types. Omni uses the other records to add detail to nodes that exist. For example, Omni reads subnet and security group records. It uses them to find the network address of a service.
A resource can appear in the graph before Omni gets telemetry from it. To learn more, see Using Context Graph.
Which Regions are recorded
Omni creates the recorder in the same Region as your space. The recorder records the resources in that Region.
To add the resources from another Region, centralize that Region's telemetry into the space's account. For more information, see Set up Omni for your organization.
AWS Config makes a record only for a type that AWS Config supports in the Region. If AWS Config does not support a type in a Region, no resource of that type appears in the graph for that Region.
Describe calls in CloudTrail
AWS Config takes an inventory of the resources in your account at regular times.
It does this for all resources, not only for the types that this page lists.
You can therefore see ConfigResourceCompositionSession and
AWSConfig-Describe calls in CloudTrail, including calls for
types that Omni does not record. This behavior keeps the AWS Config inventory
consistent.
Recorded resource types
AWS Config records the following resource types for Omni.
| Category | AWS service | Resource types |
|---|---|---|
| Compute | AWS App Runner | AWS::AppRunner::Service |
| Compute | AWS Elastic Beanstalk | AWS::ElasticBeanstalk::Environment |
| Compute | AWS Lambda | AWS::Lambda::Function |
| Compute | Amazon EC2 | AWS::EC2::Instance
AWS::EC2::LaunchTemplate |
| Compute | Amazon EC2 Auto Scaling | AWS::AutoScaling::AutoScalingGroup
AWS::AutoScaling::LaunchConfiguration |
| Compute | Amazon ECS | AWS::ECS::CapacityProvider
AWS::ECS::Cluster
AWS::ECS::Service
AWS::ECS::TaskDefinition
AWS::ECS::TaskSet |
| Compute | Amazon EKS | AWS::EKS::Cluster
AWS::EKS::FargateProfile
AWS::EKS::Nodegroup |
| Compute | Amazon WorkSpaces | AWS::WorkSpaces::Workspace |
| Networking and content delivery | AWS Global Accelerator | AWS::GlobalAccelerator::Accelerator |
| Networking and content delivery | Amazon CloudFront | AWS::CloudFront::Distribution |
| Networking and content delivery | Amazon Route 53 | AWS::Route53::HostedZone |
| Networking and content delivery | Amazon VPC | AWS::EC2::ClientVpnEndpoint
AWS::EC2::EIP
AWS::EC2::FlowLog
AWS::EC2::InternetGateway
AWS::EC2::NatGateway
AWS::EC2::NetworkInterface
AWS::EC2::RouteTable
AWS::EC2::SecurityGroup
AWS::EC2::Subnet
AWS::EC2::TransitGateway
AWS::EC2::TransitGatewayAttachment
AWS::EC2::VPC
AWS::EC2::VPCEndpoint
AWS::EC2::VPCPeeringConnection
AWS::EC2::VPNConnection
AWS::EC2::VPNGateway |
| Networking and content delivery | Elastic Load Balancing | AWS::ElasticLoadBalancing::LoadBalancer
AWS::ElasticLoadBalancingV2::Listener
AWS::ElasticLoadBalancingV2::LoadBalancer
AWS::ElasticLoadBalancingV2::TargetGroup |
| APIs | AWS AppSync | AWS::AppSync::GraphQLApi |
| APIs | Amazon API Gateway | AWS::ApiGateway::Method
AWS::ApiGateway::RestApi
AWS::ApiGateway::Stage
AWS::ApiGatewayV2::Api
AWS::ApiGatewayV2::Integration
AWS::ApiGatewayV2::Stage |
| Databases and storage | Amazon DynamoDB | AWS::DynamoDB::Table |
| Databases and storage | Amazon EFS | AWS::EFS::FileSystem |
| Databases and storage | Amazon Keyspaces | AWS::Cassandra::Keyspace |
| Databases and storage | Amazon OpenSearch Service | AWS::Elasticsearch::Domain
AWS::OpenSearch::Domain |
| Databases and storage | Amazon QLDB | AWS::QLDB::Ledger |
| Databases and storage | Amazon RDS | AWS::RDS::DBCluster
AWS::RDS::DBInstance |
| Databases and storage | Amazon Redshift | AWS::Redshift::Cluster |
| Databases and storage | Amazon S3 | AWS::S3::AccessPoint
AWS::S3::Bucket |
| Application integration | AWS IoT Core | AWS::IoT::TopicRule |
| Application integration | AWS Step Functions | AWS::StepFunctions::Activity
AWS::StepFunctions::StateMachine |
| Application integration | Amazon Data Firehose | AWS::KinesisFirehose::DeliveryStream |
| Application integration | Amazon EventBridge | AWS::Events::ApiDestination
AWS::Events::Connection
AWS::Events::EventBus
AWS::Events::Rule |
| Application integration | Amazon EventBridge Scheduler | AWS::Scheduler::ScheduleGroup |
| Application integration | Amazon Kinesis Data Streams | AWS::Kinesis::Stream |
| Application integration | Amazon MQ | AWS::AmazonMQ::Broker |
| Application integration | Amazon MSK | AWS::MSK::Cluster
AWS::MSK::ServerlessCluster |
| Application integration | Amazon SNS | AWS::SNS::Topic |
| Application integration | Amazon SQS | AWS::SQS::Queue |
| Containers and service discovery | AWS Cloud Map | AWS::ServiceDiscovery::HttpNamespace
AWS::ServiceDiscovery::PublicDnsNamespace
AWS::ServiceDiscovery::Service |
| Containers and service discovery | Amazon ECR | AWS::ECR::PublicRepository
AWS::ECR::Repository |
| Security and identity | AWS Certificate Manager | AWS::ACM::Certificate |
| Security and identity | AWS IAM | AWS::IAM::Policy
AWS::IAM::Role |
| Security and identity | AWS KMS | AWS::KMS::Key |
| Security and identity | AWS Network Firewall | AWS::NetworkFirewall::Firewall |
| Security and identity | AWS Secrets Manager | AWS::SecretsManager::Secret |
| Security and identity | AWS WAF | AWS::WAFv2::WebACL |
| Security and identity | Amazon Cognito | AWS::Cognito::IdentityPool
AWS::Cognito::UserPool |
| Management and governance | AWS CloudFormation | AWS::CloudFormation::Stack |
| Management and governance | AWS CloudTrail | AWS::CloudTrail::Trail |
| Management and governance | Amazon CloudWatch | AWS::CloudWatch::Alarm
AWS::CloudWatch::MetricStream |
| Management and governance | Amazon CloudWatch Logs | AWS::Logs::Destination |
| Machine learning | Amazon Bedrock | AWS::Bedrock::DataSource
AWS::Bedrock::Guardrail
AWS::Bedrock::KnowledgeBase
AWS::Bedrock::Prompt |
| Machine learning | Amazon Kendra | AWS::Kendra::Index |
| Machine learning | Amazon Lex | AWS::Lex::Bot
AWS::Lex::BotAlias |
| Machine learning | Amazon SageMaker AI | AWS::SageMaker::Domain
AWS::SageMaker::EndpointConfig
AWS::SageMaker::Model
AWS::SageMaker::NotebookInstance |
| Analytics | AWS Glue | AWS::Glue::Crawler
AWS::Glue::Database
AWS::Glue::Job |
| Analytics | Amazon Athena | AWS::Athena::WorkGroup |
| Analytics | Amazon QuickSight | AWS::QuickSight::DataSource |
| Developer tools and migration | AWS CodeBuild | AWS::CodeBuild::Project |
| Developer tools and migration | AWS CodeDeploy | AWS::CodeDeploy::Application
AWS::CodeDeploy::DeploymentGroup |
| Developer tools and migration | AWS CodePipeline | AWS::CodePipeline::Pipeline |
| Developer tools and migration | AWS DMS | AWS::DMS::ReplicationInstance |
| Developer tools and migration | AWS Transfer Family | AWS::Transfer::Server |
| Developer tools and migration | Amazon AppFlow | AWS::AppFlow::Flow |
Related information
-
Working with the configuration recorder in the AWS Config Developer Guide
