Amazon CloudWatch

Technical Preview

Overview

A client-mode connector for a curated observability / ITSM slice of Amazon CloudWatch and CloudWatch Logs:

Catalog connector event	Entity / path	Notes
POST PutMetricData	`POST /` on `monitoring.{region}.amazonaws.com`	JSON + `X-Amz-Target: GraniteServiceVersion20100801.PutMetricData`; SigV4 service `monitoring`; expect 200
GetMetricData	`POST /` (same host)	Catalog said GET; official JSON protocol is POST `GetMetricData`; preferred auth smoke → 200
POST PutLogEvents	`POST /` on `logs.{region}.amazonaws.com`	`Content-Type: application/x-amz-json-1.1`; `X-Amz-Target: Logs_20140328.PutLogEvents`; SigV4 service `logs`
CreateLogStream	`POST /` (logs host)	Helper so PutLogEvents is usable
SNS alarm notification	inbound HTTPS	ENABLE_SERVER companion (docs only — not in this client `.lot`)

Default BASE_ADDRESS is https://monitoring.eu-west-1.amazonaws.com. Topics use itsm/amazon-cloudwatch/<object>/<verb>. Switch BASE to https://logs.{region}.amazonaws.com for Logs events.

Prefer Hub secrets for AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION used by an upstream SigV4 signer. Pass Authorization, x-amz-date, and x-amz-content-sha256 on each MQTT payload — this is not Bearer auth. This template has not been verified against a live AWS account. Status remains blocked until an authenticated live smoke succeeds.

Basic Syntax

# Coreflux REST_API template — Amazon CloudWatch (metrics + logs)
# Auth: SigV4 headers from MQTT payload (NOT Bearer)
# BASE_ADDRESS: https://monitoring.eu-west-1.amazonaws.com

DEFINE ROUTE AmazonCloudWatchRestApi WITH TYPE REST_API
    ADD REST_API_CONFIG
        WITH BASE_ADDRESS "https://monitoring.eu-west-1.amazonaws.com"
        WITH ENABLE_CLIENT "true"
        WITH USE_SSL "true"
        WITH REQUEST_TIMEOUT '60'
        WITH DEFAULT_CONTENT_TYPE "application/json"
    ADD EVENT Putmetricdata
        WITH SOURCE_TOPIC "itsm/amazon-cloudwatch/metric/put"
        WITH DESTINATION_TOPIC "itsm/amazon-cloudwatch/metric/put/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Content-Encoding" "amz-1.0"
            ADD "X-Amz-Target" "GraniteServiceVersion20100801.PutMetricData"
            ADD "Authorization" "{value.json.authorization}"
            ADD "x-amz-date" "{value.json.x_amz_date}"
            ADD "x-amz-content-sha256" "{value.json.x_amz_content_sha256}"
        WITH BODY "{payload}"
    ADD EVENT Getmetricdata
        WITH SOURCE_TOPIC "itsm/amazon-cloudwatch/metric/get"
        WITH DESTINATION_TOPIC "itsm/amazon-cloudwatch/metric/get/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Content-Encoding" "amz-1.0"
            ADD "X-Amz-Target" "GraniteServiceVersion20100801.GetMetricData"
            ADD "Authorization" "{value.json.authorization}"
            ADD "x-amz-date" "{value.json.x_amz_date}"
            ADD "x-amz-content-sha256" "{value.json.x_amz_content_sha256}"
        WITH BODY "{payload}"
    ADD EVENT Putlogevents
        WITH SOURCE_TOPIC "itsm/amazon-cloudwatch/log/put"
        WITH DESTINATION_TOPIC "itsm/amazon-cloudwatch/log/put/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/x-amz-json-1.1"
            ADD "X-Amz-Target" "Logs_20140328.PutLogEvents"
            ADD "Authorization" "{value.json.authorization}"
            ADD "x-amz-date" "{value.json.x_amz_date}"
            ADD "x-amz-content-sha256" "{value.json.x_amz_content_sha256}"
        WITH BODY "{payload}"
    ADD EVENT Createlogstream
        WITH SOURCE_TOPIC "itsm/amazon-cloudwatch/log/create-stream"
        WITH DESTINATION_TOPIC "itsm/amazon-cloudwatch/log/create-stream/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/x-amz-json-1.1"
            ADD "X-Amz-Target" "Logs_20140328.CreateLogStream"
            ADD "Authorization" "{value.json.authorization}"
            ADD "x-amz-date" "{value.json.x_amz_date}"
            ADD "x-amz-content-sha256" "{value.json.x_amz_content_sha256}"
        WITH BODY "{payload}"

Authentication

Mode	Header	Notes
AWS Signature Version 4	`Authorization: {value.json.authorization}` (+ `x-amz-date`, `x-amz-content-sha256`)	Default in this template — not Bearer

Sign with service name monitoring (metrics host) or logs (Logs host). Store AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION (optional AWS_SESSION_TOKEN) in Hub secrets and resolve via an upstream signer + GET SECRET — never commit credentials.

MQTT examples

PutMetricData (BASE = monitoring):

{
  "Namespace": "Coreflux/Plant",
  "MetricData": [
    {
      "MetricName": "vibration_rms",
      "Value": 12.4,
      "Unit": "None",
      "Dimensions": [{ "Name": "line", "Value": "a" }]
    }
  ]
}

Publish with SigV4 headers. Expect HTTP 200. GetMetricData (auth smoke; BASE = monitoring):

{
  "StartTime": "2026-10-04T16:00:00Z",
  "EndTime": "2026-10-04T17:00:00Z",
  "MetricDataQueries": [
    {
      "Id": "m1",
      "MetricStat": {
        "Metric": {
          "Namespace": "AWS/EC2",
          "MetricName": "CPUUtilization",
          "Dimensions": [{ "Name": "InstanceId", "Value": "i-0123456789abcdef0" }]
        },
        "Period": 300,
        "Stat": "Average"
      }
    }
  ]
}

Expect HTTP 200. PutLogEvents (BASE = logs.{region}.amazonaws.com):

{
  "logGroupName": "coreflux/plant",
  "logStreamName": "line-a",
  "logEvents": [
    { "timestamp": 1728057600000, "message": "vibration_rms=12.4" }
  ]
}

Expect HTTP 200 with nextSequenceToken. Create the stream first via Createlogstream if needed.

ENABLE_SERVER companion

CloudWatch Alarms → SNS → HTTPS subscription can POST notification JSON to an inbound endpoint. Package that as a separate ENABLE_SERVER connector — not included in the client .lot.

Quick Start

Coreflux MQTT Broker

LoT Language

Coreflux HUB

VS Code - LoT Notebooks

Coreflux Portal

Using AI with Coreflux

Product Updates

Overview

Basic Syntax

Authentication

MQTT examples

ENABLE_SERVER companion

Sources

​Overview

​Basic Syntax

​Authentication

​MQTT examples

​ENABLE_SERVER companion

​Sources

​Related

Overview

Basic Syntax

Authentication

MQTT examples

ENABLE_SERVER companion

Sources

Related