Amazon CloudWatch - CA (Central) & Slack Integration

Amazon CloudWatch - CA (Central)

Description Permissions Security & Compliance

Amazon CloudWatch Omni is an AI-powered observability experience in Amazon CloudWatch, purpose-built for monitoring your applications and your AI agents in one place. It correlates your logs, metrics, and traces so you can follow a problem from a service map into its traces and on into the logs behind it — or debug an AI agent's decisions step by step.This integration brings CloudWatch into the channels where your team already responds to issues. Connect your CloudWatch Omni space to Slack to investigate incidents by talking to the CloudWatch agent, and to receive alert notifications — all without leaving Slack.:mag: Investigate from Slack. Mention the Amazon CloudWatch bot in a channel to ask about your systems in plain language. The agent investigates using your space's telemetry — metrics, logs, traces, and topology — and streams its answer back into the thread, updating in place as it reasons. Each Slack thread maps to a persistent investigation you can continue with full context.:bell: Get alerted where your team works. Route CloudWatch alerts to the Slack channels you choose. When an alert changes state (for example OK → CRITICAL), a richly formatted notification is posted to the channel, and you are notified again when it recovers.:lock: Authorized by your access grants. Both the agent and alerts can only post to the integrations and channels your CloudWatch access grants permit — checked when you configure them and again at delivery, so revoking a grant immediately stops future messages.Amazon CloudWatch uses generative AI. Responses can be wrong — the agent shows its queries and evidence so you can verify before you act.

Amazon CloudWatch - CA (Central) will be able to view:

Amazon CloudWatch - CA (Central) will be able to do:

Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.

General

Privacy & data governance

Data retention policy

You can find information on data retention in the AWS Customer Agreement (https://aws.amazon.com/agreement/). If you have specific questions about data retention, contact your AWS account manager or AWS Support (https://aws.amazon.com/contact-us/). Amazon CloudWatch stores the Slack workspace ID and name for each integration. It does not read or store the message history of a channel. When a user mentions the app, the message and the app's reply are stored as a conversation thread in the customer's CloudWatch Omni space. They are kept until the customer deletes the thread or the space. Conversation memory used for agent context expires after 90 days. Alert history (state changes, configuration changes and delivery results) is kept for 90 days and contains no Slack message content. When the Slack app is uninstalled, Amazon CloudWatch invalidates the stored Slack credential and stops all calls to the workspace. The integration record stays in the customer's AWS account until the customer deletes it

Data archiving and removal policy

You can find information on data archival in the AWS Customer Agreement (https://aws.amazon.com/agreement/). Amazon CloudWatch does not archive Slack data to a separate store. When a customer deletes the Slack integration in the Amazon CloudWatch Omni console, CloudWatch immediately deletes the stored Slack installation and stops receiving events from and posting to the workspace. The encrypted Slack token is deleted automatically within 30 days. A copy of the integration metadata, which contains no tokens, is deleted automatically after 90 days. Conversation threads are deleted when the customer deletes the thread or the CloudWatch Omni space.

Data storage policy

You can find information on data storage in the AWS Customer Agreement (https://aws.amazon.com/agreement/). If you have specific questions about data storage, contact your AWS account manager or AWS Support (https://aws.amazon.com/contact-us/). Integration records, OAuth credentials and conversation threads are stored in the AWS Region of the customer's CloudWatch Omni space, and they are encrypted with AWS KMS. Each AWS Region has its own Amazon CloudWatch Slack app. When the customer deletes the Slack integration, CloudWatch deletes the stored Slack installation immediately. It deletes the remaining stored data automatically, as described in the data archival and removal policy.

Data hosting company

AWS

App/service has sub-processors

App/service uses large language models (LLM)

yes

LLM model(s) used

Amazon Bedrock (Anthropic Claude foundation models)

LLM retention settings

Bedrock does not use prompts or responses to train models. Invocation logs hold metadata only, not prompt text. Conversation memory expires after 90 days. Conversation threads are kept until the customer deletes the thread or space.

LLM data tenancy policy

Inference uses Amazon Bedrock. Customer data is logically isolated per AWS account and CloudWatch Omni space, and agent actions use credentials scoped to that space. AWS does not use customer data to train models.

LLM data residency policy

Data is stored in the AWS Region of the customer's CloudWatch Omni space. Bedrock processes inference within the customer's geography, except in Singapore, Sao Paulo and Mumbai, where any commercial AWS Region may be used.

Certifications & compliance

Security