# AWS CloudWatch integration with Elastic using Elastic Agent **URL:** \ **Category:** Beats\ **Tags:** elastic-agent, integrations\ **Created:** [June 28, 2022, 5:42am UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318 "2022-06-28T05:42:12Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![zmoog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zmoog/32/103218_2.png) [@zmoog](https://discuss.elastic.co/u/zmoog)\ **Post date:** [July 22, 2022, 2:09pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/21 "2022-07-22T14:09:56Z")
> [@JypraGroup](#): > > The support staff on other case responded that API key doesn't have sufficient Priv. What will be your advice on what it should be set to? > > POST /\_security/api\_key > { > "name": "my-api-key", > "expiration": "1d", > "role\_descriptors": { > "role-a": { > "cluster":["monitor"], > "index": [ > { > "names": ["logs-generic-default"], > "privileges": ["manage"] > } > ] > } > } > } Yeah, I see the log message is complaining about not having the required privileges to do the action. The error is: > "action [indices:admin/auto\_create] is unauthorized for API key id [v5R8FoIBh-MY92CQc0UC] of user [elastic/fleet-server] on indices [logs-generic-default], this action is granted by the index privileges [auto\_configure,create\_index,manage,all]" The message hints about the required privileges; TBH, this error is unexpected because the fleet server manages the agent's API keys. ---
**Author:** ![zmoog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zmoog/32/103218_2.png) [@zmoog](https://discuss.elastic.co/u/zmoog)\ **Post date:** [July 22, 2022, 2:39pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/22 "2022-07-22T14:39:52Z")
The message mentions the API key belongs to the user "elastic/fleet-server"; could you please check the privileges assigned to the [service account](https://www.elastic.co/guide/en/elasticsearch/reference/current/service-accounts.html) named "elastic/fleet-server"? You can do it by visiting Dev Tools \> Console and sending this request: ```nohighlight GET /_security/service/elastic/fleet-server ``` More on this at: > **[Get service accounts API | Elasticsearch Guide \[8.3\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-service-accounts.html)** ---
**Author:** ![JypraGroup](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@JypraGroup](https://discuss.elastic.co/u/JypraGroup)\ **Post date:** [July 25, 2022, 12:57am UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/23 "2022-07-25T00:57:21Z")
The support has asked to change below settings on the elastic-agent-policy.yaml on the elastic agent: From: name: AWS\_Test\_Default revision: 3 streams: - api\_sleep: 200ms data\_stream: null dataset: aws.cloudwatch\_logs ...... To: name: AWS\_Test\_Default revision: 3 streams: - api\_sleep: 200ms data\_stream: dataset: aws.cloudwatch\_logs type: logs ...... What does this help with? ---
**Author:** ![JypraGroup](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@JypraGroup](https://discuss.elastic.co/u/JypraGroup)\ **Post date:** [July 25, 2022, 12:58am UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/24 "2022-07-25T00:58:35Z")
Thanks for details. What should be the permission so we can make the required changes? Thanks, ---
**Author:** ![zmoog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zmoog/32/103218_2.png) [@zmoog](https://discuss.elastic.co/u/zmoog)\ **Post date:** [July 25, 2022, 7:40am UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/25 "2022-07-25T07:40:32Z")
> [@JypraGroup](#): > > What should be the permission so we can make the required changes? I prefer to see current settings on your cluster before thinking about any change: can you share the output of the following request? ```plaintext GET /_security/service/elastic/fleet-server ``` This response shouldn't contain private or sensible information, but please double-check it before sharing. ---
**Author:** ![zmoog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zmoog/32/103218_2.png) [@zmoog](https://discuss.elastic.co/u/zmoog)\ **Post date:** [July 25, 2022, 7:43am UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/26 "2022-07-25T07:43:40Z")
> [@JypraGroup](#): > > The support has asked to change below settings on the elastic-agent-policy.yaml on the elastic agent: > From: > > name: AWS\_Test\_Default > revision: 3 > streams: > > - api\_sleep: 200ms > data\_stream: null > dataset: aws.cloudwatch\_logs > ...... > To: > > name: AWS\_Test\_Default > revision: 3 > streams: > > - api\_sleep: 200ms > data\_stream: > dataset: aws.cloudwatch\_logs > type: logs > ...... > > What does this help with? I'm sorry, @JypraGroup, I am unfamiliar with this setting, so the support engineer is probably in a better position to answer this question. ---
**Author:** ![JypraGroup](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@JypraGroup](https://discuss.elastic.co/u/JypraGroup)\ **Post date:** [August 2, 2022, 10:50am UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/27 "2022-08-02T10:50:12Z")
Below is the response OK (706 ms) { "elastic/fleet-server": { "role\_descriptor": { "applications": [ { "application": "kibana-_", "privileges": [ "reserved\_fleet-setup" ], "resources": [ "_" ] } ], "transient\_metadata": { "enabled": true }, "run\_as": , "cluster": [ "monitor", "manage\_own\_api\_key" ], "indices": [ { "privileges": [ "write", "create\_index", "auto\_configure" ---
**Author:** ![zmoog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zmoog/32/103218_2.png) [@zmoog](https://discuss.elastic.co/u/zmoog)\ **Post date:** [August 8, 2022, 2:52pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/28 "2022-08-08T14:52:36Z")
> [@JypraGroup](#): > > Below is the response Hey @JypraGroup, the response looks truncated: can you double-check you copied and pasted the whole response? As a reference, here's what I get on my test cluster: ```json { "elastic/fleet-server" : { "role_descriptor" : { "cluster" : [ "monitor", "manage_own_api_key" ], "indices" : [ { "names" : [ "logs-*", "metrics-*", "traces-*", "synthetics-*", ".logs-endpoint.diagnostic.collection-*", ".logs-endpoint.action.responses-*" ], "privileges" : [ "write", "create_index", "auto_configure" ], "allow_restricted_indices" : false }, { "names" : [ "traces-apm.sampled-*" ], "privileges" : [ "read", "monitor", "maintenance" ], "allow_restricted_indices" : false }, { "names" : [ ".fleet-*" ], "privileges" : [ "read", "write", "monitor", "create_index", "auto_configure", "maintenance" ], "allow_restricted_indices" : true } ], "applications" : [ { "application" : "kibana-*", "privileges" : [ "reserved_fleet-setup" ], "resources" : [ "*" ] } ], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } } ``` The most interesting section is the `elastic/fleet-server.role_descriptor.indices` list: ```json { "names": [ "logs-*", "metrics-*", "traces-*", "synthetics-*", ".logs-endpoint.diagnostic.collection-*", ".logs-endpoint.action.responses-*" ], "privileges": [ "write", "create_index", "auto_configure" ], "allow_restricted_indices": false } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 5, 2022, 2:53pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318/29 "2022-09-05T14:53:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318.md?page=1)