stackgate.ai
All integrations

AWS CloudWatch

Explore CloudWatch log groups, filter log events, run Logs Insights queries, and read metrics and alarms via MCP.

Manual setup 9 tools

Overview

Connect AWS CloudWatch so AI clients can explore log groups and streams, filter or tail log events, run Logs Insights queries, and read metrics and alarms.

This integration uses the Amazon CloudWatch Logs and CloudWatch Metrics APIs with IAM access keys stored encrypted in stackgate.ai. Usage is billed to your AWS account.

For CodeBuild build logs when you already have a build_id, use the AWS CodeBuild integration (get_build_logs) instead.

Prerequisites

  • An AWS account with CloudWatch Logs and/or Metrics you want AI clients to access
  • A stackgate.ai account

Getting credentials

  1. In the AWS IAM console, create an IAM user (or use an existing automation user) with programmatic access.
  2. Attach a least-privilege policy. Example for read-only Logs and Metrics:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:FilterLogEvents",
                "logs:GetLogEvents",
                "logs:StartQuery",
                "logs:GetQueryResults",
                "logs:StopQuery"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricData",
                "cloudwatch:DescribeAlarms"
            ],
            "Resource": "*"
        }
    ]
}

Tighten logs:* resources to specific log group ARNs when possible (e.g. arn:aws:logs:YOUR-REGION:YOUR-ACCOUNT-ID:log-group:/aws/codebuild/*).

  1. Create an access key and copy the key ID and secret.
  2. In stackgate.ai, open My Integrations → AWS CloudWatch.
  3. Click Activate and enter access key ID, secret access key, AWS region, and optionally a default log group (e.g. /aws/codebuild/CypressEnvironmentV2).

You can reuse the same IAM user as Amazon S3 or AWS CodeBuild with a merged policy.

Using with AI clients

  • Dedicated endpoint: POST /mcp/cloudwatch with a Sanctum bearer token
  • Private gateway: one config for all integrations — use cloudwatch__* namespaced tools

Typical workflow:

  1. list_log_groups — discover groups (prefix: /aws/lambda/ or /aws/codebuild/)
  2. list_log_streams — find the latest stream (order_by: LastEventTime, descending: true)
  3. filter_log_events — search with filter_pattern (ERROR, Cypress, etc.)
  4. get_log_events — tail a stream without a filter
  5. start_logs_insights_query + get_logs_insights_results — run Logs Insights QL and poll until status is Complete
  6. list_metrics → get_metric_data — chart Lambda, ECS, or custom metrics
  7. describe_alarms — check alarm states during triage

See Documentation for HTTP authentication and private gateway setup.

Troubleshooting

  • 422 integration not configured — complete all required credential fields in My Integrations.
  • 403 / AccessDenied from AWS — verify IAM policy includes Logs and Metrics read actions for the target resources.
  • log_group is required — pass log_group or set a default log group in My Integrations.
  • ThrottlingException / RateExceeded — CloudWatch Logs read APIs have hard per-region TPS limits (e.g. 5 TPS for FilterLogEvents in eu-central-1). Paginate with next_token and avoid rapid polling loops.
  • Insights query still Running — poll get_logs_insights_results until status is Complete or Failed.
  • Empty metrics — confirm namespace, metric_name, dimensions, and time range match the metric's publishing interval.

Available tools

  • list_log_groups

    List CloudWatch log groups in the connected AWS account.

  • list_log_streams

    List log streams in a CloudWatch log group.

  • filter_log_events

    Search log events in a log group with an optional filter pattern.

  • get_log_events

    Tail log events from a specific log stream without a filter pattern.

  • start_logs_insights_query

    Start a CloudWatch Logs Insights query across one or more log groups.

  • get_logs_insights_results

    Poll results for a CloudWatch Logs Insights query started with start_logs_insights_query.

  • list_metrics

    List CloudWatch metrics, optionally filtered by namespace, name, or dimensions.

  • get_metric_data

    Fetch CloudWatch metric datapoints for one or more metric queries.

  • describe_alarms

    List CloudWatch metric alarms and their current state.

MCP endpoint: https://stackgate.ai/mcp/cloudwatch (HTTP) or via the private gateway.

Related workflows

Multi-integration playbooks that use AWS CloudWatch to solve concrete business outcomes.

Create account Documentation