cloudwatch output uses ListMetricData

[adamchainz]

Bug report

When starting the Cloudwatch output plugin, it tries to list some metrics, even though this isn't needed for normal operation:

telegraf/plugins/outputs/cloudwatch/cloudwatch.go

Line 62 in ac1fa05

func (c *CloudWatch) Connect() error {

. Thus the AWS credentials in use need access to ListMetricData even though when in use the plugin only needs PutMetricData.

The required permissions aren't even documented for the plugin.

Relevant telegraf.conf:

[[outputs.cloudwatch]]
region = "us-east-1"
namespace = "foo"

System info:

Latest telegraf

Steps to reproduce:

1. Create an AWS IAM user/role with only PutMetricData rights
2. Configure cloudwatch output in telegraf, start it

Expected behavior:

Successful start

Actual behavior:

It fails

Additional info:

AWS STS GetSessionToken can be used to test connection without needing any specific permissions: https://docs.aws.amazon.com/sdk-for-go/api/service/sts/#STS.GetSessionToken

[danielnelson]

Thanks for the report, I agree on all points. Is this something you would be able to work on?

[adamchainz]

Never used this language before but I’ll give it a... Go