PutSinkPolicy

Creates or updates the resource policy that grants permissions to source accounts to link to the monitoring account sink. When you create a sink policy, you can grant permissions to all accounts in an organization or to individual accounts.

You can also use a sink policy to limit the types of data that is shared. The three types that you can allow or deny are:

See the examples in this section to see how to specify permitted source accounts and data types.

Request Syntax

POST /PutSinkPolicy HTTP/1.1
Content-type: application/json

{
   "Policy": "string",
   "SinkIdentifier": "string"
}

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in JSON format.

Response Syntax

HTTP/1.1 200
Content-type: application/json

{
   "Policy": "string",
   "SinkArn": "string",
   "SinkId": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

Errors

For information about the errors that are common to all actions, see Common Errors.

Examples

Permission for all accounts in an organization

The following example grants permission for all accounts in the organization o-xxxxxxxxxxx to be linked to this sink.

Sample Request

{
    "SinkIdentifier": "arn:aws:oam:us-west-1:111111111111:sink/abcd1234-a123-456a-a12b-a123b456c789",
    "Policy": "{ \"Version\": \"2012-10-17\", \"Statement\": [{ \"Action\": [\"oam:CreateLink\", \"oam:UpdateLink\"], \"Effect\": \"Allow\", \"Resource\": \"*\", \"Principal\": \"*\", \"Condition\": { \"StringEquals\": { \"aws:PrincipalOrgID\": \"o-xxxxxxxxxxx\" } } }]}" }

Permission for individual accounts, allowing all resource types

The following example grants permission for two specified accounts to be linked to this sink.

Sample Request

{
    "SinkIdentifier": "arn:aws:oam:us-west-1:111111111111:sink/abcd1234-a123-456a-a12b-a123b456c789",
    "Policy": "{\"Version\": \"2012-10-17\",  \"Statement\": [{ \"Action\": [\"oam:CreateLink\", \"oam:UpdateLink\"], \"Effect\": \"Allow\", \"Resource\": \"*\", \"Principal\": { \"AWS\": [\"1111111111111\", \"222222222222\"]} }]  }"}

Permission for individual accounts, allowing only metrics and logs to be shared

The following example grants permission for two specified accounts to be linked to this sink. The link allows metrics and logs to be shared, but not traces.

Sample Request

{
    "SinkIdentifier": "arn:aws:oam:us-west-1:111111111111:sink/abcd1234-a123-456a-a12b-a123b456c789",
    "Policy": "{ \"Version\": \"2012-10-17\", \"Statement\": [{ \"Action\": [\"oam:CreateLink\", \"oam:UpdateLink\"], \"Effect\": \"Allow\",  \"Resource\": \"*\", \"Principal\": { \"AWS\": [\"1111111111111\", \"222222222222\"]}, \"Condition\": { \"ForAllValues:StringEquals\": { \"oam:ResourceTypes\": [ \"AWS::CloudWatch::Metric\", \"AWS::Logs::LogGroup\" ] }  }  }] }"
}

Human-readable policy example- not for copying

The following example will not work if used, but is included to show a human-readable version of a sink policy. This is the same policy as the previous example, and grants permission for two specified accounts to be linked to this sink. The link allows metrics and logs to be shared, but not traces.

Sample Request

{
    "SinkIdentifier": "arn:aws:oam:us-west-1:111111111111:sink/abcd1234-a123-456a-a12b-a123b456c789",
    "Policy": {
        "Version": "2012-10-17",
        "Statement": [{
            "Action": ["oam:CreateLink", "oam:UpdateLink"],
            "Effect": "Allow",
            "Resource": "*",
            "Principal": {
                "AWS": ["1111111111111", "222222222222"]
            },
            "Condition": {
                "ForAllValues:StringEquals": {
                    "oam:ResourceTypes": [
                        "AWS::CloudWatch::Metric",
                        "AWS::Logs::LogGroup"
                    ]
                }
            }
        }]
    }
}

Permissions for full usage of Application Insights

The following example policy will allow full usage of Application Insights. Full usage requires sharing of logs, metrics, traces, and Application Insights applications.

Sample Request

{
    "SinkIdentifier": "arn:aws:oam:us-west-1:111111111111:sink/abcd1234-a123-456a-a12b-a123b456c789",
    "Policy": {
        "Version": "2012-10-17",
        "Statement": [{
            "Action": ["oam:CreateLink", "oam:UpdateLink"],
            "Effect": "Allow",
            "Resource": "*",
            "Principal": {
                "AWS": ["1111111111111", "222222222222"]
            },
            "Condition": {
                "ForAllValues:StringEquals": {
                    "oam:ResourceTypes": [
                        "AWS::CloudWatch::Metric",
                        "AWS::Logs::LogGroup",
                        "AWS::XRay::Trace",
                        "AWS::ApplicationInsights::Application"
                    ]
                }
            }
        }]
    }
}

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: