Back to Checks
aws

CloudWatch does not allow cross-account sharing

cloudwatch_cross_account_sharing_disabled
Service: cloudwatchSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundariesidentity-access
Resource Type:AwsIamRole

Amazon CloudWatch cross-account sharing via the CloudWatch-CrossAccountSharingRole allows other AWS accounts to view your metrics, dashboards, and alarms. The presence of this role indicates that sharing is active.

Prowler logoProwlerprowler-provider-aws

Risk

Granting other accounts visibility into observability data reduces confidentiality and enables reconnaissance. Adversaries or over-privileged partners can map architectures, profile workloads, and spot alerting gaps, increasing chances of lateral movement and evasion.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudwatch_cross_account_sharing_disabled

Recommendation

Disable cross-account sharing unless strictly required. If needed, restrict access to specific trusted accounts, scope read-only permissions to only necessary resources, and use a dedicated monitoring account. Apply least privilege and separation of duties, and regularly audit role trust and access patterns.

Remediation

CLI

aws cloudformation delete-stack --stack-name CloudWatch-CrossAccountSharingRole

Other

1Sign in to the AWS Management Console and open IAM
2Go to Roles
3Find and select the role named "CloudWatch-CrossAccountSharingRole"
4Click Delete and confirm
5If deletion is blocked because it is managed by CloudFormation: open CloudFormation, select the stack named "CloudWatch-CrossAccountSharingRole", and click Delete

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class cloudwatch_cross_account_sharing_disabled(Check):
    def execute(self):
        findings = []
        if iam_client.roles is not None:
            report = Check_Report_AWS(metadata=self.metadata(), resource={})
            report.status = "PASS"
            report.status_extended = "CloudWatch doesn't allow cross-account sharing."
            report.region = iam_client.region
            report.resource_arn = iam_client.role_arn_template
            report.resource_id = iam_client.audited_account
            for role in iam_client.roles:
                if role.name == "CloudWatch-CrossAccountSharingRole":
                    report = Check_Report_AWS(metadata=self.metadata(), resource=role)
                    report.region = iam_client.region
                    report.status = "FAIL"
                    report.status_extended = (
                        "CloudWatch has allowed cross-account sharing."
                    )
            findings.append(report)
        return findings

References