CloudWatch Omni opens incident investigation to staff without AWS console access
AWS's CloudWatch Omni, generally available since September 23, lets Okta and Entra ID users investigate incidents without AWS console access. CloudWatch dashboard sharing has let outsiders view prebuilt graphs since 2020, so what Omni adds is the investigation itself, one of the reasons teams paid for third-party platforms.
The Engineer · Build desk
What happened
- Each organization gets its own Omni URL, and accounts in Okta, Entra ID or a similar provider sign in through AWS IAM Identity Center.
- Existing alarms, dashboards, APIs and console workflows keep working, and nobody moves to Omni until they opt in with the "Try CloudWatch Omni" button.
- For AI agents, Omni captures end-to-end traces, scores correctness, coherence, retrieval and tool selection, and builds test datasets from production traffic.
- CloudWatch now recommends OpenTelemetry Metrics over its Classic model, a split that began with native OpenTelemetry support in June 2026, and Omni is built on OpenTelemetry.
Why it matters
- What's now possible capability Database engineers and managers outside the AWS account can query logs, metrics and traces in natural language during an incident, so the person who spots an anomaly can also chase it.
- What it limits constraint Omni leaves the setup work in place: cross-account and cross-Region data still has to be routed with CloudWatch centralization rules before an Omni space shows it.
- What it limits constraint A mixed AWS and Azure estate gets Azure application and agent telemetry today, with deeper multicloud support still to come, so broad multicloud coverage remains an argument for a third-party platform.
- Who has to decide decision A team that bought a third-party tool mainly so non-console staff could investigate now has an AWS option to trial before its next renewal.
Next story · Build · Sep 22
CloudWatch Omni swaps threshold tuning for availability and latency targets you declareConfirmed2 publishers
CloudWatch has shown data to people outside an AWS account since September 2020, through dashboard sharing [8]. It offered three routes: specific email addresses, a public link, or a third-party single sign-on provider [8]. That makes it six years older than Omni [20]. A shared viewer gets a prebuilt dashboard and can report that a graph looks wrong, a contribution that is usually accurate and always brief [9]. Rewriting a query, following a trace or digging into logs is outside what the feature was designed for, according to the dev.to comparison [9].
The permissions underneath were the harder problem. Sharing needs metric retrieval and EC2 tag lookups that cannot be scoped down [10]. Anyone holding a shared dashboard can therefore query every metric in the account and read the names and tags of every EC2 instance [10]. The SSO route shares every dashboard in the account at once [11]. Logs Insights widgets stay hidden from shared users until someone adds permissions to the sharing IAM role [11]. Giving an outside responder one service's logs meant widening a role that already exposed the whole account's metrics [10][11].
Omni ties access to a signed-in person instead of a shared dashboard [2]. The investigator arrives with an account from the company's own directory, brokered by IAM Identity Center. Where no identity provider exists, they use an IAM user or role [2][4]. The AWS News Blog says SREs, developers, database engineers and managers then share the same data and investigation context [7]. Neither source describes how permissions are scoped inside an Omni space. So this evidence does not show whether Omni closes the account-wide metric exposure that came with dashboard sharing [10].
The agent features address a separate gap. According to InfoQ, Daniel Abib, an AWS senior specialist solutions architect, said: "Agent behavior is non-deterministic: a prompt change can degrade response quality even when standard metrics show no errors." [15] Omni uses OpenInference and AWS Distro for OpenTelemetry, and supports frameworks including LangChain, LangGraph, CrewAI and Strands [17]. It also accepts third-party evaluators such as Braintrust, DeepEval and Ragas [17]. InfoQ also lists agent-focused platforms that combine tracing, evaluation, prompt experimentation and datasets, among them LangSmith, LangFuse and Arize AI Phoenix [18].
I think the sign-in design is the right call. Identity stays in the directory the company already manages, and the investigator never needs the AWS Management Console [2][3]. The dev.to comparison claims only that Omni narrows the gap with third-party observability platforms. It ties that claim to teams that chose one so people without console access could help investigate [19].
What to watch
- AWS documentation of permission scoping inside an Omni space, to see whether outside responders inherit the account-wide metric reach that dashboard sharing granted.
- The deeper multicloud support AWS has promised beyond today's Azure application and agent telemetry.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Amazon CloudWatch Omni became generally available on September 23, 2026.
- [2]
Each organization gets its own Omni URL; accounts managed in Okta, Microsoft Entra ID and similar identity providers connect to Omni sign-in through AWS IAM Identity Center.
- [3]
With identity-provider sign-in set up, the people using Omni do not need access to the AWS Management Console.
- [4]
Without an identity provider, members sign in to Omni with IAM users or IAM roles.
- [5]
CloudWatch documentation describes two metrics models, OpenTelemetry Metrics (recommended) and CloudWatch Metrics (Classic); the split came with native OpenTelemetry metrics support in June 2026, and Omni is built on OpenTelemetry.
- [6]
Omni supports AI-powered investigations that let users query logs, metrics and traces in natural language to identify topology issues and pinpoint root causes.
- [7]
The AWS News Blog says SREs, developers, database engineers and managers share the same data and investigation context in Omni.
- [8]
CloudWatch dashboard sharing launched in September 2020 and lets you share dashboards with people who have no direct access to your AWS account, via specific email addresses, a public link, or a third-party SSO provider.
- [9]
Dashboard sharing hands over a view of a prebuilt dashboard; rewriting queries, following traces or digging into logs is not what it is designed for, and during an incident viewers can usually only say a graph looks wrong.
- [10]
Per the documentation cited by dev.to, dashboard sharing permissions include metric retrieval and EC2 tag lookups that cannot be scoped down, so anyone a dashboard is shared with can query all metrics in the account and see names and tags of all EC2 instances.
- [11]
The SSO sharing option shares every dashboard in the account; Logs Insights widgets are not shown to shared users by default and showing them requires adding permissions to the sharing IAM role.
- [12]
According to the Omni documentation, centralizing data across accounts and Regions still happens through CloudWatch centralization rules, and the centralized data then appears in an Omni space.
- [13]
Existing CloudWatch alarms, dashboards, APIs and console workflows keep working; existing users are not moved to Omni automatically and opt in with the 'Try CloudWatch Omni' button in the CloudWatch console.
- [14]
According to the AWS Cloud Operations Blog, application and agent telemetry from Azure environments can be ingested into Omni today, with deeper multicloud support coming.
- [15]
"Agent behavior is non-deterministic: a prompt change can degrade response quality even when standard metrics show no errors."
- [16]
Omni captures end-to-end traces, evaluates correctness, coherence, retrieval and tool selection, and lets users compare prompts, build test datasets from production traffic, run experiments and detect regressions.
- [17]
Omni supports agent frameworks including LangChain, LangGraph, CrewAI, OpenAI SDK, Strands and Vercel AI SDK, uses OpenInference and AWS Distro for OpenTelemetry, integrates with Amazon Bedrock AgentCore, and supports third-party evaluators such as Braintrust, DeepEval and Ragas.
- [18]
InfoQ lists other tools that combine tracing, evaluation, prompt experimentation and datasets with a focus on agentic applications, including LangChain LangSmith, LangFuse and Arize AI Phoenix.
- [19]
The dev.to post argues CloudWatch Omni narrows the gap with third-party observability platforms, and says the change is directly relevant if one reason a team chose its monitoring tool was wanting people without console access to help investigate incidents.
- [20]
Dashboard sharing predates Omni's general availability by six years.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toHow CloudWatch Omni Narrows the Gap with Third-Party Observability Platforms
1 article · October 1, 2026
- infoq.comAmazon CloudWatch Omni Extends CloudWatch into the Agent Era
1 article · September 29, 2026
Topics and entities
Topics
- Identity federation
- Observability
- AI Agent Observability