How to Build CloudWatch Dashboards with Cross-Account Views Using the AWS Agent Toolkit

You can build CloudWatch dashboards with cross-account views by configuring AWS Observability Access Manager (OAM) to link a central monitoring account with multiple source accounts, then deploying dashboard widgets that reference the accountId dimension to aggregate metrics from linked accounts.

The aws/agent-toolkit-for-aws repository provides the infrastructure scripts and reference documentation needed to implement cross-account observability. By leveraging CloudWatch OAM and the toolkit's dashboard generation utilities, you can create unified dashboards that display metrics, logs, and traces from distributed AWS accounts without switching contexts.

Configure the Monitoring Account for Cross-Account Observability

Before building dashboards, you must establish a monitoring account that will aggregate telemetry from your source accounts. According to the toolkit's observability documentation in plugins/aws-agents/skills/agents-optimize/references/observability.md, this architecture requires enabling CloudWatch Observability Access Manager (OAM) in your designated monitoring account.

Enable OAM in the CloudWatch console by navigating to Settings → Observability Access Manager → Enable. You must activate sharing for Metrics and Logs (traces are automatically shared via X-Ray's native cross-account mechanism). This configuration is noted as a prerequisite in skills/core-skills/aws-observability/references/dashboards.md, which states that "CloudWatch Observability Access Manager (OAM) configured" is required for cross-account dashboard functionality.

Link Source Accounts Using OAM

With OAM enabled in the monitoring account, you must create IAM roles in each source account that authorize the monitoring account to assume them. Create a role with a trust policy that specifies your monitoring account ID as the principal:

# source-account-trust-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<MONITORING_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Attach the AWSObservabilityAccessManagerFullAccess managed policy to this role, or create a custom policy granting oam:CreateLink, oam:DeleteLink, and oam:TagResource. Then, from the monitoring account, create the OAM link:

aws oam create-link \
  --resource-arn arn:aws:cloudwatch::<SOURCE_ACCOUNT_ID>:metric/AWS/Lambda/Invocations \
  --label MonitoringLink \
  --role-arn arn:aws:iam::<SOURCE_ACCOUNT_ID>:role/OAMSourceLinkRole

As documented in skills/core-skills/aws-observability/references/tracing.md, unified cross-account viewing requires this specific OAM setup with "monitoring/source account links" to function correctly.

Generate Cross-Account Dashboards with the Toolkit Script

The aws/agent-toolkit-for-aws repository includes a Python utility that automates dashboard creation with cross-account support. The generate_dashboards.py script located at skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py constructs widget definitions that automatically inject the accountId dimension when generating CloudFormation templates.

Around line 335 of this script, the widget builder code constructs metric queries that include the account identifier, allowing the dashboard to pull data from linked source accounts. Run the script to generate a dashboard template:

python3 skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py \
  --serverless my-cache \
  --region us-east-1 \
  --output cross-account-dashboard.json

This outputs a CloudFormation template containing widgets configured to reference metrics across account boundaries.

Configure Dashboard Widgets with the Account Dimension

When building dashboards manually or inspecting the generated template, each widget must include the accountId dimension to pull data from specific source accounts. The widget JSON structure follows this pattern:

{
  "type": "metric",
  "x": 0,
  "y": 0,
  "width": 12,
  "height": 6,
  "properties": {
    "metrics": [
      [
        "AWS/Lambda",
        "Invocations",
        "FunctionName",
        "my-function",
        "accountId",
        "123456789012"
      ]
    ],
    "period": 300,
    "stat": "Sum",
    "title": "Lambda Invocations - Account 123456789012"
  }
}

The accountId dimension tells CloudWatch to resolve the metric from the linked source account rather than the monitoring account. The plugins/aws-agents/skills/agents-optimize/references/observability.md file confirms that "no extra IAM on the agent execution roles for cross-account observability" is required, as the cross-account feature operates at the CloudWatch layer via OAM.

Deploy the Cross-Account Dashboard

Deploy the generated template using AWS CloudFormation in your monitoring account:

aws cloudformation deploy \
  --template-file cross-account-dashboard.json \
  --stack-name cross-account-observability-dashboard \
  --capabilities CAPABILITY_NAMED_IAM

As recommended in skills/specialized-skills/database-skills/amazon-elasticache/references/monitoring/cloudwatch-dashboards.md, you can deploy via CloudFormation or use the generated JSON as a reference for manual dashboard creation in the CloudWatch console. Once deployed, open the dashboard in the monitoring account to verify that widgets display data from each linked source account, with account IDs appearing in widget titles.

Summary

• AWS Observability Access Manager (OAM) enables cross-account metric and log sharing between a central monitoring account and multiple source accounts.
• IAM trust relationships in source accounts must authorize the monitoring account to assume roles for OAM link creation.
• The accountId dimension in CloudWatch dashboard widgets specifies which linked source account to query for metrics.
• generate_dashboards.py automates the creation of cross-account dashboard templates with proper account dimension injection.
• No additional IAM configuration is required on agent execution roles, as OAM handles cross-account telemetry forwarding at the service layer.

Frequently Asked Questions

What is the difference between a monitoring account and a source account in OAM?

A monitoring account is the centralized AWS account where you build and view CloudWatch dashboards, while source accounts are the individual AWS accounts that emit telemetry (metrics, logs, traces) to be shared. The monitoring account uses OAM links to establish read-only access to telemetry from source accounts, creating a unified observability layer without requiring separate logins.

Do I need to modify IAM roles in my source accounts to enable cross-account dashboards?

Yes, you must create an IAM role in each source account with a trust policy that allows the monitoring account to assume it. This role needs permissions for OAM operations such as oam:CreateLink. However, you do not need to modify agent execution roles or application IAM policies, as the cross-account sharing operates at the CloudWatch service layer rather than the application layer.

Can I use the AWS Agent Toolkit to automate dashboard generation for services other than ElastiCache?

The generate_dashboards.py script in skills/specialized-skills/database-skills/amazon-elasticache/scripts/generate_dashboards.py specifically targets ElastiCache resources, but the pattern for injecting the accountId dimension around line 335 can be adapted for other AWS services. You would modify the widget construction logic to reference different metric namespaces (such as AWS/Lambda or AWS/EC2) while maintaining the same cross-account dimension structure.

How do I verify that my cross-account dashboard is correctly linked to source accounts?

Open the deployed dashboard in the CloudWatch console of your monitoring account. Each widget should display data points and include the source account ID in its title. If data appears missing, verify that the OAM link status shows Active in the CloudWatch Settings, and confirm that the source account IAM role includes the oam:PublishMetrics permission. The skills/core-skills/aws-observability/references/tracing.md documentation notes that active OAM links are the single source of truth for cross-account dashboard data resolution.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}