# How to Build CloudWatch Dashboards with Cross-Account Views Using the AWS Agent Toolkit > Learn to build CloudWatch dashboards with cross-account views using AWS Observability Access Manager. Aggregate metrics from linked accounts and centralize monitoring efficiently. - Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws) - Tags: how-to-guide - Published: 2026-06-26 --- **You can build CloudWatch dashboards with cross-account views by configuring AWS Observability Access Manager (OAM) to link a central monitoring account with multiple source accounts, then deploying dashboard widgets that reference the `accountId` dimension to aggregate metrics from linked accounts.** The **aws/agent-toolkit-for-aws** repository provides the infrastructure scripts and reference documentation needed to implement cross-account observability. By leveraging CloudWatch OAM and the toolkit's dashboard generation utilities, you can create unified dashboards that display metrics, logs, and traces from distributed AWS accounts without switching contexts. ## Configure the Monitoring Account for Cross-Account Observability Before building dashboards, you must establish a **monitoring account** that will aggregate telemetry from your **source accounts**. According to the toolkit's observability documentation in [`plugins/aws-agents/skills/agents-optimize/references/observability.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-agents/skills/agents-optimize/references/observability.md), this architecture requires enabling CloudWatch Observability Access Manager (OAM) in your designated monitoring account. Enable OAM in the CloudWatch console by navigating to **Settings** → **Observability Access Manager** → **Enable**. You must activate sharing for **Metrics** and **Logs** (traces are automatically shared via X-Ray's native cross-account mechanism). This configuration is noted as a prerequisite in [`skills/core-skills/aws-observability/references/dashboards.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-observability/references/dashboards.md), which states that "CloudWatch Observability Access Manager (OAM) configured" is required for cross-account dashboard functionality. ## Link Source Accounts Using OAM With OAM enabled in the monitoring account, you must create IAM roles in each source account that authorize the monitoring account to assume them. Create a role with a trust policy that specifies your monitoring account ID as the principal: ```yaml # source-account-trust-policy.json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam:::root" }, "Action": "sts:AssumeRole" } ] } ``` Attach the `AWSObservabilityAccessManagerFullAccess` managed policy to this role, or create a custom policy granting `oam:CreateLink`, `oam:DeleteLink`, and `oam:TagResource`. Then, from the monitoring account, create the OAM link: ```bash aws oam create-link \ --resource-arn arn:aws:cloudwatch:::metric/AWS/Lambda/Invocations \ --label MonitoringLink \ --role-arn arn:aws:iam:::role/OAMSourceLinkRole ``` As documented in [`skills/core-skills/aws-observability/references/tracing.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-observability/references/tracing.md), unified cross-account viewing requires this specific OAM setup with "monitoring/source account links" to function correctly. ## Generate Cross-Account Dashboards with the Toolkit Script The **aws/agent-toolkit-for-aws** repository includes a Python utility that automates dashboard creation with cross-account support. The [`generate_dashboards.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/generate_dashboards.py) script located at [`skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py) constructs widget definitions that automatically inject the `accountId` dimension when generating CloudFormation templates. Around line 335 of this script, the widget builder code constructs metric queries that include the account identifier, allowing the dashboard to pull data from linked source accounts. Run the script to generate a dashboard template: ```bash python3 skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py \ --serverless my-cache \ --region us-east-1 \ --output cross-account-dashboard.json ``` This outputs a CloudFormation template containing widgets configured to reference metrics across account boundaries. ## Configure Dashboard Widgets with the Account Dimension When building dashboards manually or inspecting the generated template, each widget must include the `accountId` dimension to pull data from specific source accounts. The widget JSON structure follows this pattern: ```json { "type": "metric", "x": 0, "y": 0, "width": 12, "height": 6, "properties": { "metrics": [ [ "AWS/Lambda", "Invocations", "FunctionName", "my-function", "accountId", "123456789012" ] ], "period": 300, "stat": "Sum", "title": "Lambda Invocations - Account 123456789012" } } ``` The `accountId` dimension tells CloudWatch to resolve the metric from the linked source account rather than the monitoring account. The [`plugins/aws-agents/skills/agents-optimize/references/observability.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-agents/skills/agents-optimize/references/observability.md) file confirms that "no extra IAM on the agent execution roles for cross-account observability" is required, as the cross-account feature operates at the CloudWatch layer via OAM. ## Deploy the Cross-Account Dashboard Deploy the generated template using AWS CloudFormation in your monitoring account: ```bash aws cloudformation deploy \ --template-file cross-account-dashboard.json \ --stack-name cross-account-observability-dashboard \ --capabilities CAPABILITY_NAMED_IAM ``` As recommended in [`skills/specialized-skills/database-skills/amazon-elasticache/references/monitoring/cloudwatch-dashboards.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/database-skills/amazon-elasticache/references/monitoring/cloudwatch-dashboards.md), you can deploy via CloudFormation or use the generated JSON as a reference for manual dashboard creation in the CloudWatch console. Once deployed, open the dashboard in the monitoring account to verify that widgets display data from each linked source account, with account IDs appearing in widget titles. ## Summary - **AWS Observability Access Manager (OAM)** enables cross-account metric and log sharing between a central monitoring account and multiple source accounts. - **IAM trust relationships** in source accounts must authorize the monitoring account to assume roles for OAM link creation. - **The `accountId` dimension** in CloudWatch dashboard widgets specifies which linked source account to query for metrics. - **[`generate_dashboards.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/generate_dashboards.py)** automates the creation of cross-account dashboard templates with proper account dimension injection. - **No additional IAM configuration** is required on agent execution roles, as OAM handles cross-account telemetry forwarding at the service layer. ## Frequently Asked Questions ### What is the difference between a monitoring account and a source account in OAM? A **monitoring account** is the centralized AWS account where you build and view CloudWatch dashboards, while **source accounts** are the individual AWS accounts that emit telemetry (metrics, logs, traces) to be shared. The monitoring account uses OAM links to establish read-only access to telemetry from source accounts, creating a unified observability layer without requiring separate logins. ### Do I need to modify IAM roles in my source accounts to enable cross-account dashboards? Yes, you must create an IAM role in each source account with a trust policy that allows the monitoring account to assume it. This role needs permissions for OAM operations such as `oam:CreateLink`. However, you do not need to modify agent execution roles or application IAM policies, as the cross-account sharing operates at the CloudWatch service layer rather than the application layer. ### Can I use the AWS Agent Toolkit to automate dashboard generation for services other than ElastiCache? The [`generate_dashboards.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/generate_dashboards.py) script in [`skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py) specifically targets ElastiCache resources, but the pattern for injecting the `accountId` dimension around line 335 can be adapted for other AWS services. You would modify the widget construction logic to reference different metric namespaces (such as `AWS/Lambda` or `AWS/EC2`) while maintaining the same cross-account dimension structure. ### How do I verify that my cross-account dashboard is correctly linked to source accounts? Open the deployed dashboard in the CloudWatch console of your monitoring account. Each widget should display data points and include the source account ID in its title. If data appears missing, verify that the OAM link status shows **Active** in the CloudWatch Settings, and confirm that the source account IAM role includes the `oam:PublishMetrics` permission. The [`skills/core-skills/aws-observability/references/tracing.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-observability/references/tracing.md) documentation notes that active OAM links are the single source of truth for cross-account dashboard data resolution.