# AWS CloudWatch

> Connect CloudWatch as a datasource for anomaly detection

Rocketgraph reads from your existing CloudWatch — no SDK changes needed.

## Setup

```bash
export ROCKETGRAPH_API_KEY=rg_live_xxxxxx
npx @rgraph/otel-node init
```

Or connect manually at [rocketgraph.app/settings](https://rocketgraph.app/settings):

1. **AWS Access Key ID** — from a read-only IAM user
2. **AWS Secret Access Key**
3. **Region** — e.g. `us-east-1`
4. **Log Group** — e.g. `/aws/lambda/my-function`

### IAM policy (minimum permissions)

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}
```

Once connected, Rocketgraph pulls your CloudWatch logs for ML anomaly detection and deploy regression analysis.