CloudWatch does not allow cross-account sharing
cloudwatch_cross_account_sharing_disabled
Amazon CloudWatch cross-account sharing via the CloudWatch-CrossAccountSharingRole allows other AWS accounts to view your metrics, dashboards, and alarms. The presence of this role indicates that sharing is active.
Risk
Granting other accounts visibility into observability data reduces confidentiality and enables reconnaissance. Adversaries or over-privileged partners can map architectures, profile workloads, and spot alerting gaps, increasing chances of lateral movement and evasion.
prowler aws --checks cloudwatch_cross_account_sharing_disabled
Recommendation
Disable cross-account sharing unless strictly required. If needed, restrict access to specific trusted accounts, scope read-only permissions to only necessary resources, and use a dedicated monitoring account. Apply least privilege and separation of duties, and regularly audit role trust and access patterns.
Remediation
aws cloudformation delete-stack --stack-name CloudWatch-CrossAccountSharingRole
- Sign in to the AWS Management Console and open IAM
- Go to Roles
- Find and select the role named "CloudWatch-CrossAccountSharingRole"
- Click Delete and confirm
- If deletion is blocked because it is managed by CloudFormation: open CloudFormation, select the stack named "CloudWatch-CrossAccountSharingRole", and click Delete
Source Code
Resource Type
AwsIamRole