Telemetry enablement rules

You can create telemetry enablement rules to automatically configure telemetry collection for your AWS resources. Rules help you standardize telemetry collection across your organization or accounts and ensure consistent monitoring coverage.

How rules work

Telemetry configuration follows specific patterns when evaluating and applying rules.

Rule evaluation hierarchy

Enablement rules are evaluated according to a hierarchical pattern. Organizational rules are evaluated first, then rules that apply to organizational units (OUs), and finally rules that apply to individual accounts. Rules at the organizational level provide the baseline required telemetry for your organization. Rules at the OU and account level can collect additional telemetry data, but they cannot collect less telemetry data. If such a rule is created, it will create a rule conflict.

Within each scope (organization, OU, or account), rules must maintain uniqueness based on their resource type, telemetry type, and destination configuration. Duplicate rules trigger a conflict exception. If the same rule exists in different scopes, such as an organization level rule for Amazon VPC Flow logs to CloudWatch and an OU level rule for Amazon VPC Flow logs, the rule higher in the hierarchy is applied. However, if there are multiple conflicting rules, none of the rules are applied.

When multiple rules apply to the same resource, telemetry configuration resolves conflicts using these priorities:

Rule behavior on updates

If you update an enablement rule, only new resources that match the rule adopt the updated configuration. The existing telemetry settings remain unchanged for existing resources. If a resource becomes non-compliant with an existing rule due to manual deletion of telemetry data, the new enablement rule is adopted once the resource is brought back into compliance.

For Amazon VPC Flow logs, telemetry config only creates new flow logs for resources that match the rule scope. It does not delete or impact previously established Amazon VPC Flow logs, even if they differ from current rule parameters. For CloudWatch Logs, existing log groups are maintained provided they match the resource pattern.

Integration with AWS Config

CloudWatch telemetry auditing and configuration integrates with AWS Config to automatically discover resources that match your enablement rule and apply it to your telemetry data collection. When you create an enablement rule, the telemetry configuration creates a corresponding AWS Config recorder. This recorder includes configuration items for the specific resource types you define in the enablement rule.

Amazon CloudWatch uses AWS Config Internal service linked recorder. You are not charged for CIs that CloudWatch uses as part of the Internal Service Linked Recorders.

Telemetry config uses AWS Config to:

Rules across Regions

When you create a rule with target Regions, the current Region becomes the home Region for that rule. The rule is automatically replicated to the spoke Regions you select.

Key concepts for multi-Region rules:

When a replicated rule is created, updated, or deleted in a spoke Region, AWS CloudTrail records an AwsServiceEvent in the spoke Region. These events are logged with observabilityadmin.amazonaws.com as the invoking service and include the rule ARN in the spoke Region. You can use these events to audit multi-Region rule replication activity.

The following is an example AWS CloudTrail event recorded when a replicated rule is created in a spoke Region:

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "123456789012",
        "invokedBy": "observabilityadmin.amazonaws.com"
    },
    "eventTime": "2026-04-06T19:50:37Z",
    "eventSource": "observabilityadmin.amazonaws.com",
    "eventName": "CreateTelemetryRule",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "observabilityadmin.amazonaws.com",
    "userAgent": "observabilityadmin.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "435d6da2-d099-4775-8944-1e039418de6f",
    "readOnly": false,
    "resources": [
        {
            "accountId": "123456789012",
            "type": "AWS::ObservabilityAdmin::TelemetryRule",
            "ARN": "arn:aws:observabilityadmin:us-east-1:123456789012:telemetry-rule/my-multi-region-rule"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management"
}

The eventName field reflects the operation performed on the replicated rule: CreateTelemetryRule, UpdateTelemetryRule, or DeleteTelemetryRule. The eventType is always AwsServiceEvent because the operation is performed by the ObservabilityAdmin service on behalf of the customer, not by a direct customer API call.

Creating a telemetry enablement rule

When you create a telemetry enablement rule, you specify:

Managing telemetry rules

After creating rules, you can edit or delete them. You can also view which resources each rule affects and monitor rule compliance.

Managing replicated rules

When you view a replicated rule in a spoke Region, the console displays an informational alert indicating that the rule was replicated from another Region. The Edit rule and Delete actions are disabled for replicated rules in spoke Regions.

To edit or delete a replicated rule, navigate to the home Region where the rule was originally created. The home Region is displayed in the informational alert.

You can add or modify tags on replicated rules in spoke Regions. Tag changes made in spoke Regions apply only to the local copy of the rule and are not replicated back to the home Region.

Encrypting log groups with customer managed keys

You can encrypt log groups created by telemetry enablement rules using a customer managed AWS KMS key. Encrypting log groups with a customer managed key gives you control over key rotation and helps meet compliance requirements. When you specify a AWS KMS key ARN in your rule's destination configuration, CloudWatch automatically associates the key with each log group created during remediation.

Requirements for KMS keys

Required KMS key policy

Your AWS KMS key policy must allow the CloudWatch Logs service to use the key for encryption. Add the following statement to your key policy:

{
    "Sid": "AllowCloudWatchLogsToUseKey",
    "Effect": "Allow",
    "Principal": { "Service": "logs.amazonaws.com" },
    "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
    ],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "aws:SourceOrgID": "your-organization-id"
        },
        "ArnLike": {
            "kms:EncryptionContext:aws:logs:arn": "arn:aws:logs:*:*:log-group:*"
        }
    }
}

Replace your-organization-id with your AWS Organizations organization ID. The aws:SourceOrgID condition ensures that only accounts in your organization can use the key for log group encryption.

Service-linked role permissions for encryption

The telemetry rules service-linked role requires additional permissions to support AWS KMS key encryption. The following permissions are automatically added to the service-linked role when you use AWS KMS encryption with telemetry rules:

How multi-Region keys work with telemetry rules

Multi-Region AWS KMS keys share the same key ID across Regions. When a telemetry rule with a AWS KMS key is applied in multiple Regions, the service automatically resolves the key ARN to the target Region. For example, if you provide the key ARN arn:aws:kms:us-east-1:123456789012:key/mrk-1234abcd and the rule creates a log group in eu-west-1, the service uses arn:aws:kms:eu-west-1:123456789012:key/mrk-1234abcd for encryption in that Region.

You must ensure that the multi-Region key is replicated to all Regions where the rule applies. If the key has not been replicated to a target Region, remediation for resources in that Region fails, and the service retries the operation.

Updating encryption settings

When you update a rule to add a AWS KMS key, the service applies the key only to log groups that the rule creates after the update. The service does not retroactively encrypt log groups that the rule created before you added the key.

When you remove the AWS KMS key ARN from a rule, the service changes the encryption configuration that it previously applied to the rule's managed log groups.

Supported data sources

The following data sources are supported by telemetry enablement rules. Each data source has specific behavior and configuration considerations.