Check ID: cloudwatch_cross_account_sharing_disabled
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: trust-boundaries, identity-access
Resource type: AwsIamRole

​
What this check verifies

Amazon CloudWatch cross-account sharing via the CloudWatch-CrossAccountSharingRole allows other AWS accounts to view your metrics, dashboards, and alarms. The presence of this role indicates that sharing is active.

​
Risk

Granting other accounts visibility into observability data reduces confidentiality and enables reconnaissance. Adversaries or over-privileged partners can map architectures, profile workloads, and spot alerting gaps, increasing chances of lateral movement and evasion.

​
Recommendation

Disable cross-account sharing unless strictly required. If needed, restrict access to specific trusted accounts, scope read-only permissions to only necessary resources, and use a dedicated monitoring account. Apply least privilege and separation of duties, and regularly audit role trust and access patterns.

​
Remediation

aws cloudformation delete-stack —stack-name CloudWatch-CrossAccountSharingRole

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_cross_account_sharing_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks