elastic / elastic/beats

[AWS CloudWatch] `cloud.account.name` shows wrong value for cross-account metrics (uses CloudWatch label instead of IAM alias)

Open Beginner friendly
#49,690 2 comments 0 reactions 0 assignees View on GitHub
needs_team
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

When collecting CloudWatch metrics from a linked AWS account using role_arn, cloud.account.name is populated with the CloudWatch cross-account observability label (typically the AWS Organizations account name) instead of the IAM account alias.

Root cause: At startup, the code correctly resolves the IAM alias via `ListAccountAliases` and stores it in `MonitoringAccountName`. However, `createEvents()` in `cloudwatch.go` ignores this value and uses the raw `${PROP('AccountLabel')}` from the CloudWatch `GetMetricData` response, which resolves to the AWS Organizations account name, not the IAM alias.

Contributor guide

Open the contributing guide

Research direction

Start in cloudwatch.go, especially createEvents(), and trace how MonitoringAccountName is populated by ListAccountAliases during startup. Compare that value with the raw AccountLabel from the GetMetricData response for role_arn cross-account collection. Done means cloud.account.name uses the IAM alias rather than the CloudWatch observability label.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
cloud, observability-sre
Issue type
Bug
Difficulty
2/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.