Introduction
In this article you'll learn how to get system metrics from an existing Amazon Elastic Compute Cloud (Amazon EC2) instance and how to examine those metrics in Cloud Monitoring.
Create a Google Cloud project
Follow these steps to build a Google Cloud project:
1. Navigate to the New Project in the console.
2. Enter quickstart in the Project Name area.
3. Press Create.
Connecting your AWS account to Google Cloud
1. Select Monitoring from the Google Cloud console or press the following button:
2. To examine or change the metrics scope of a Cloud project, use the project picker in the Google Cloud console.
3. Select Settings from the Monitoring menu panel. Click the Create AWS connector project button on the Settings page.

4. Select a project by clicking on the Create a connector project step.
5. Choose New Project from the dialog's options, then finish the new project dialogue.
6. To proceed to the Authorize AWS for Monitoring step, click Next.
7. Making an Amazon IAM role:
- Log into your AWS account in a new window, choose the IAM page, and click Roles.
- Choose Create Role.
- Choose a different AWS account.
- Enter the account ID found on the Google Cloud console's Authorize AWS for Monitoring page in the Account ID text box.
- Decide on requiring an external ID.
- Enter the external ID found on the Google Cloud console's Authorize AWS for Monitoring page in the External ID text box.
- After clearing Require MFA, select Next: Permissions.
- Enter "ReadOnlyAccess" and click "ReadOnlyAccess" in the permissions search box.
- Make sure Create role without a permissions boundary is selected in the expanded Set Permission Boundary section.
- Click Next: Tags.
- Click Next: Review.
- Click Create Role after providing the role's name and description.
- To access the Summary page of the role you established, select it. The Role ARN should be copied to your clipboard.
8. Paste the AWS Role ARN into the Role ARN text box in the Google Cloud console, then click Add AWS Account.
AWS connector projects
The ID for the AWS connection project may be found in the Monitored accounts pane on the Settings page:
Your AWS account description [YOUR_AWS_ACCOUNT_NUMBER]
Connected to [CONNECTOR_PROJECT_ID]
- The account number for your AWS account is represented by
[YOUR AWS ACCOUNT NUMBER].
- The connector project with the ID [CONNECTOR PROJECT ID] is where you configure permissions for agents and other AWS apps that require access to Google Cloud, as well as where you receive logs and analytics from your AWS account.
Troubleshooting
If an error message informs you that your AWS account is already being watched, make sure these things are true:
- An AWS connector project already exists if you've linked your AWS account to Google Cloud. For the same account, you cannot build more than one AWS connector project.
- View metrics for AWS accounts offers information on how to integrate an existing AWS connector project with a Google Cloud project.
- Check that when you created your AWS Role, you included the Account ID and External ID for your current metrics scope. Each metrics scope's External ID is distinct from the others.
Authorizing AWS applications
If you want to perform any of the following actions, you must approve AWS applications:
- Start your Amazon EC2 instances' monitoring or logging agents.
- Using AWS applications, use any Google Cloud service.
You must grant access to a Google Cloud service account with the appropriate Google Cloud IAM roles in order to permit apps running on AWS to access Google Cloud services.
Several Amazon EC2 instances and apps can be authorized by a single service account in a single AWS account, or you can create numerous service accounts.