---
title: "How to Install and Set Up an AWS CloudWatch Agent"
description: "CloudWatch is an AWS service that centrally manages all of logs. Learn how to set up the CloudWatch agent for Windows in this tutorial."
canonical: "https://adamtheautomator.com/cloudwatch-agent/"
---

# How to Install and Set Up an AWS CloudWatch Agent

> CloudWatch is an AWS service that centrally manages all of logs. Learn how to set up the CloudWatch agent for Windows in this tutorial.

Source: https://adamtheautomator.com/cloudwatch-agent/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![How to Install and Set Up an AWS CloudWatch Agent](https://adamtheautomator.com/wp-content/uploads/2021/03/How-to-Install-and-Set-Up-and-AWS-CloudWatch-Windows-Agent.jpg)

# How to Install and Set Up an AWS CloudWatch Agent

[![](https://secure.gravatar.com/avatar/4122a8cb07a9edbf3d2bc5b54fe7d21ed3e9a68acb4d978973fa8899c236c06b?s=192&d=mm&r=g)Justin Sylvester](https://adamtheautomator.com/author/justin-s/)2 April 20219 min. read

Categories: [Cloud](/category/cloud/), [Information Security](/category/infosec/)

Tags:[AWS](/tag/aws/)[AWS Cloudwatch](/tag/aws-cloudwatch/)

Table of Contents

*   [Prerequisites](#h-prerequisites)
*   [Creating an IAM Role](#h-creating-an-iam-role)
*   [Attaching an IAM Role](#h-attaching-an-iam-role)
*   [Downloading the CloudWatch Agent](#h-downloading-the-cloudwatch-agent)
*   [Installing the CloudWatch Agent](#h-installing-the-cloudwatch-agent)
*   [Configuring & Activating the CloudWatch Agent](#h-configuring-activating-the-cloudwatch-agent)
*   [Next Steps](#h-next-steps)

If you need one place to store and manage your AWS logs, look no further than [Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html). CloudWatch is a handy feature that helps with event correlation and is critical in maintaining visibility within your technical infrastructure.

Not a reader? Watch this related video tutorial!

**_Not seeing the video? Make sure your ad blocker is disabled._**

Since [Elastic Compute Cloud (EC2) Instances](https://aws.amazon.com/ec2/getting-started/) commonly run critical workloads, log visibility is vital, and it makes complete sense to integrate EC2 with CloudWatch.

In this tutorial, you’re going to learn how to set up one component of CloudWatch on your AWS EC2 instances, the [CloudWatch Agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html). Once configured, the agent will then send select logs to AWS CloudWatch for further investigation.

## Prerequisites

This article will be a tutorial. If you plan on following along step-by-step, you will need the following:

*   An [AWS Account](https://aws.amazon.com/free/?all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc)
    
*   An IAM User with:
    
    *   [AWS Management Console](https://aws.amazon.com/console/) access
    *   The [IAM permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html) required to perform IAM, EC2, and CloudWatch activities.

> _IAM policy creation and AWS Application Programming Interface (API) permissions are outside this article’s scope. Always adhere to the [principle of least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege) when authorizing accounts to perform actions._

*   Administrative access to an EC2 Instance running a [supported operating system](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html). This tutorial will be using an EC2 Instance running Windows Server 2019.

## Creating an IAM Role

Before CloudWatch will work with an EC2 instance, it must have an [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html). An IAM role, if properly configured for least privilege, allows CloudWatch to work correctly but without unnecessary permissions.

Let’s start this tutorial by creating an IAM role for CloudWatch in the [AWS Management Console](https://aws.amazon.com/console/) that leverages an [AWS Managed Policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html). This policy will authorize your EC2 Instance to make calls to CloudWatch.

To create an IAM role that will allow your EC2 Instance to communicate with CloudWatch:

1\. Open a web browser.

2\. Navigate to the [AWS Management Console](https://console.aws.amazon.com/) and [sign in to your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/console.html) by supplying your AWS (root) or IAM account credentials.

3\. Click **Services** on the upper left-hand corner of your screen.

![AWS Management Console showing services drop-down menu.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T144353.307.png)

AWS Management Console showing services drop-down menu.

4\. Next, click **IAM** from the **Services** drop-down menu located under the **Security, Identity, & Compliance** category. This option will take you to the IAM console.

![AWS Management Console showing services drop-down menu and IAM selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T144500.773.png)

AWS Management Console showing services drop-down menu and IAM selection.

5\. Now, click **Roles** from the menu on the screen’s left-hand side located under the **Access Management** category.

![IAM console showing Roles selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T144610.951.png)

IAM console showing Roles selection.

6\. From the **Roles** screen, select **Create Role**, located at the top of your screen.

> You _may see a message at the top of your screen that describes what an IAM role is. If that is the case, the **Create Role** option is located underneath the message._

![Roles section of the IAM console showing Create Role selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T144705.648.png)

Roles section of the IAM console showing Create Role selection.

7\. On the **Create Role** page, designate the **[Type of Trusted Entity](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role)** as **AWS Service.** AWS Service roles allow AWS services to interact with other resources (e.g. CloudWatch) on your behalf.

![Create Role menu showing AWS Service selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T144814.619.png)

Create Role menu showing AWS Service selection.

8\. Select the **EC2** option from the list of use cases since the CloudWatch Agent will be installed on an EC2 Instance and will communicate with CloudWatch.

![Create Role menu showing EC2 selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T144930.564.png)

Create Role menu showing EC2 selection.

9\. From the list of use cases, select the **EC2** option and then select **Next: Permissions**.

![Create Role menu showing EC2 and Next: Permissions selections.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145017.596.png)

Create Role menu showing EC2 and Next: Permissions selections.

10\. On the permissions page, enter “CloudWatchAgentServerPolicy” into the search bar and then check the box to the left of the CloudWatchAgentServerPolicy’s **Policy Name**. After checking the box, select **Next: Tags**.

![Attach permissions and policy menu showing CloudWatchAgentServerPolicy and Next: Tags selections.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145314.877.png)

Attach permissions and policy menu showing CloudWatchAgentServerPolicy and Next: Tags selections.

> _The CloudWatchAgentServerPolicy contains a set of list, read, and write permissions that allow your EC2 Instance to collect and send metrics and logs to CloudWatch. The policy’s JavaScript Object Notation (JSON) is shown below. For more information on JSON policy elements, reference [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html)._

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:PutMetricData",
                "ec2:DescribeVolumes",
                "ec2:DescribeTags",
                "logs:PutLogEvents",
                "logs:DescribeLogStreams",
                "logs:DescribeLogGroups",
                "logs:CreateLogStream",
                "logs:CreateLogGroup"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter"
            ],
            "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"
        }
    ]
}
```

11\. This tutorial will forego assigning tags to this role, leaving the **Key** and **Value** boxes blank, and hit **Next: Review**. [Tags](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html) are optional key/value pairings that help manage and organize resources within AWS.

![Tags menu showing Next: Review selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145420.303.png)

Tags menu showing Next: Review selection.

12\. Assign your role a unique name and select **Create Role**. In the following screenshot, this tutorial’s **Role name** is **EC2CloudWatchAgentRole.**

![Review menu showing Role Name and Create Role selections](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145516.462.png)

Review menu showing Role Name and Create Role selections

13\. Now check for the success message at the top of your screen. You should see a message that identifies the IAM role’s name, as shown below.

![Success message showing successful role creation.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145604.534.png)

Success message showing successful role creation.

Great work! Your EC2 Instance will leverage the IAM role you created to communicate with the CloudWatch and CloudWatch Log services!

## Attaching an IAM Role

Now that you’ve created an IAM role and attached the appropriate IAM policy, it’s time to attach the role to your EC2 Instance. To secure the IAM role to your EC2 Instance:

1\. Assuming you’re still in the AWS Management Console, click **Services** in the upper left-hand corner of your screen.

![AWS Management Console showing services drop-down menu.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145804.281.png)

AWS Management Console showing services drop-down menu.

2\. Now click **EC2** under **All services**. This option will take you to the EC2 console.

![AWS Management Console showing services drop-down menu and EC2 selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145849.003.png)

AWS Management Console showing services drop-down menu and EC2 selection.

3\. Select **Instances** from the menu on the left-hand side of the screen under the **Instances** category.

![EC2 Console showing Instances selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T145935.329.png)

EC2 Console showing Instances selection.

4\. Within the **Instances** window, check the box to the left of the EC2 Instance that you will be installing the CloudWatch Agent on.

![EC2 Instances window showing EC2 Instance selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T150022.854.png)

EC2 Instances window showing EC2 Instance selection.

5\. Select **Actions** —> **Security** —> **Modify IAM Role.** The **Modify IAM Role** option brings you to a menu that allows you to select and attach the IAM role created earlier in this tutorial.

![EC2 console showing Modify IAM Role selection.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T150104.936.png)

EC2 console showing Modify IAM Role selection.

6\. Now, select the role you created earlier in this tutorial (_EC2CloudWatchAgentRole_) from the drop-down menu and then click **Save**.

![IAM Role Modification menu showing IAM Role and Save selections.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T150202.116.png)

IAM Role Modification menu showing IAM Role and Save selections.

7\. Verify the role is attached to your EC2 Instance by viewing the success message on the top of your screen. The success message contains the IAM role name and the EC2 instance’s Instance ID. In the following screenshot, this tutorial’s IAM Role name _EC2CloudWatchAgentRole_ and Instance ID _i-0eae2dd63c30c94c2_ are shown.

![Success message showing successful IAM Role attachment.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T150250.660.png)

Success message showing successful IAM Role attachment.

Fantastic work! With the IAM role attached to your EC2 Instance, it can now communicate with the necessary CloudWatch services.

## Downloading the CloudWatch Agent

Now it’s time to transfer the CloudWatch Agent from Amazon’s [Simple Storage Service (S3)](https://aws.amazon.com/s3/getting-started/) to your EC2 Instance. You can download the CloudWatch agent via a web browser, but this tutorial will be using PowerShell.

To download the agent with PowerShell:

1\. Connect to an EC2 Instance using Remote Desktop or [Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with.html).

2\. Once you can see the Windows desktop, open a Windows PowerShell console session.

3\. Next, download the CloudWatch Agent installation package invoking PowerShell’s [`Invoke-WebRequest`](https://adamtheautomator.com/invoke-webrequest/ "Invoke-WebRequest") cmdlet. This cmdlet will download the _amazon-cloudwatch-agent.msi_ installation package to your desktop.

Related:[Invoke-WebRequest: PowerShell’s Web Swiss Army Knife](https://adamtheautomator.com/invoke-webrequest/)

```powershell
#Download the CloudWatch Agent installation package to the user's desktop.
 Invoke-WebRequest -Uri https://s3.amazonaws.com/amazoncloudwatch-agent/windows/amd64/latest/amazon-cloudwatch-agent.msi -OutFile $env:USERPROFILE\Desktop\amazon-cloudwatch-agent.msi
```

4\. Verify the _amazon-cloudwatch-agent.msi_ installation package exists using PowerShell’s [`Test-Path`](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-path?view=powershell-7.2&viewFallbackFrom=powershell-7.1) cmdlet.

Related:[How to Use the PowerShell Test-Path Cmdlet](https://adamtheautomator.com/powershell-test-path/)

```powershell
#Verify Amazone CloudWatch Agent was successful.
 Test-Path -Path $env:USERPROFILE\Desktop\amazon-cloudwatch-agent.msi
```

The returned value of `True` indicates that your download was successful!

Great work! You downloaded Amazon’s CloudWatch Agent to your desktop.

## Installing the CloudWatch Agent

In the last section, you downloaded the CloudWatch Agent, _amazon-cloudwatch-agent.msi_, to your desktop. Let’s now install the CloudWatch agent on your EC2 instance.

While still on the EC2 instance’s console, to install the agent:

1\. Open a PowerShell console session as an Administrator.

Related:[How to Run PowerShell as Administrator](https://adamtheautomator.com/powershell-run-as-administrator/)

2\. Next, run the CloudWatch Agent MSI installer using _msiexec_. _msiexec_ is a Windows-native executable that installs MSI packages. The command below uses _msiexec_ with the install (`/i`) switch to install _amazon-cloudwatch-agent.msi_ from your desktop.

```powershell
#Install the CloudWatch Agent
 msiexec /i $env:USERPROFILE\Desktop\amazon-cloudwatch-agent.msi
```

3\. Once you execute the command, a window will appear that displays a progress bar. The installation process only takes a few seconds. Allow it to complete before moving to the next section.

![Windows Installer window showing installation progress.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T150803.539.png)

Windows Installer window showing installation progress.

Quick and easy! The CloudWatch agent is now installed.

## Configuring & Activating the CloudWatch Agent

Now that the CloudWatch Agent is installed, you must tell the agent what to collect and where to send the collected data. This configuration is defined within the JSON-based [CloudWatch Agent Configuration File](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file.html). To build the configuration file, the CloudWatch agent comes with a configuration wizard to accomplish this task.

> _The CloudWatch agent configuration wizard is not the only way to create and edit the CloudWatch agent configuration file. You can also [create or edit the configuration file manually](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html)._

To trigger the wizard and configure the CloudWatch agent:

1\. Open a PowerShell console session as an Administrator.

2\. Launch _amazon-cloudwatch-agent-config-wizard.exe_ by running the following code snippet. The executable program is menu-driven and will provide configurable options within your PowerShell console session.

```powershell
#Launch the amazon-cloudwatch-agent-config-wizard.exe executable
 & $env:ProgramFiles\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-config-wizard.exe
```

3\. Next, choose the options that you would like to apply to the configuration file. The chosen options in this tutorial keep the metric collection settings in their default state and customize the Windows event log option to collect send Security events.

> _When prompted with **Do you want to store the config in the SSM parameter store?** be sure to deviate from the default configuration and set it to 2. The value of 2 tells the configuration wizard that you do not want to store the config in Parameter Store._ _Using the Parameter Store is outside the scope of this tutorial._

*   On which OS are you planning to use the agent? (**Default**: Windows)
*   Are you using EC2 or On-Premises hosts? (**Default**: EC2)
*   Do you want to turn on StatsD daemon? (**Default**: yes)
*   Which port do you want StatsD daemon to listen to? (**Default**: 8125)
*   What is the collect interval for StatsD daemon? (**Default**: 10s)
*   What is the aggregation interval for metrics collected by StatsD daemon? (**Default**: 60s)
*   Do you have any existing CloudWatch Log Agent configuration file to import for migration? (**Default**: no)
*   Do you want to monitor any host metrics? e.g. CPU, memory, etc. (**Default**: yes)
*   Do you want to monitor cpu metrics per core? Additional CloudWatch charges may apply. (**Default**: yes)
*   Do you want to add ec2 dimensions (ImageId, InstanceId, InstanceType, AutoScalingGroupName)
*   into all of your metrics if the info is available? (**Default**: yes)
*   Would you like to collect your metrics at high resolution? This enables sub-minute resolution for all metrics, but you can customize for specific metrics in the output json file. (**Default** 60s)
*   Which default metrics config do you want? (**Default**: Basic)
*   Are you satisfied with the above config? Note: it can be manually customized after the wizard
*   completes to add additional items. (**Default**: yes)
*   Do you want to monitor any customized log files? (**Customized**: 2 (no))
*   Do you want to monitor any Windows event log? (**Default**: yes)
*   Windows event log name: (**Customized**: Security)
*   Do you want to monitor VERBOSE level events for Windows event log Security? (**Default**: yes)
*   Do you want to monitor INFORMATION level events for Windows event log Security? (**Default**: yes)
*   Do you want to monitor WARNING level events for Windows event log Security? (**Default**: yes)
*   Do you want to monitor ERROR level events for Windows event log Security? (**Default**: yes)
*   Do you want to monitor CRITICAL level events for Windows event log Security? (**Default**: yes)
*   Log group name: (**Default**: Security)
*   Log stream name: (**Default**: \[{instance\_id}\])
*   In which format do you want to store windows event to CloudWatch Logs?
*   (**Default**: XML: XML format in Windows Event Viewer)
*   Do you want to specify any additional Windows event log to monitor? (**Customized**: 2 (no)
*   Do you want to store the config in the SSM parameter store? (**Customized**: 2 (no))

4\. Now, apply the CloudWatch agent configuration using the included _amazon-cloudwatch-agent-ctl.ps1_ PowerShell script. The following code snippet applies the agent configuration by telling the CloudWatch Agent to fetch the config from _$env:ProgramFiles\\Amazon\\AmazonCloudWatchAgent\\config.json_.

```powershell
#Apply CloudWatch Agent Configuration
 & $env:ProgramFiles\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1 -a fetch-config -m ec2 -c file:$env:ProgramFiles\Amazon\AmazonCloudWatchAgent\config.json -s
```

The expected output of the command is shown below. In the following screenshot, you will see that the agent successfully fetched the config and validated the configuration. After the script validates the configuration, the script restarts the agent.

![Command output showing the CloudWatch Agent configuration was successfully applied.](https://adamtheautomator.com/wp-content/uploads/2021/03/Untitled-2021-03-30T151144.508.png)

Command output showing the CloudWatch Agent configuration was successfully applied.

Great work! The CloudWatch agent is now installed and configured on your EC2 Instance! If you followed along, metrics and log data are now being sent to the CloudWatch service!

## Next Steps

In this tutorial, you used the command line to install and configure Amazon’s CloudWatch agent on an EC2 Instance running a Windows operating system. You should be able to now view the [metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/working_with_metrics.html) and [logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_GettingStarted.html) produced by your EC2 Instance in the CloudWatch console.

As a next step, try to manually edit the CloudWatch agent _config.json_ file to force Windows Application logs into CloudWatch. When you’re done experimenting, uninstall the CloudWatch Agent to avoid unnecessary charges!

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fcloudwatch-agent%2F&text=How%20to%20Install%20and%20Set%20Up%20an%20AWS%20CloudWatch%20Agent)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fcloudwatch-agent%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fcloudwatch-agent%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image-1.webp)

### [Survive the Senior Cloud Engineer AWS Interview Loop](/senior-cloud-engineer-interview-loop/)

Prepare for a senior cloud engineer interview with AWS EKS and Control Tower system design reasoning, Terraform locking, and salary negotiation tactics.

![](https://adamtheautomator.com/wp-content/uploads/2026/06/26987-cloud-security-engineer-guide-salary-certs-roadmap-codex.webp)

### [Cloud Security Engineer Guide: Salary, Certs, Roadmap (2026)](/cloud-security-engineer-guide-salary-certs-roadmap/)

Learn how to become a cloud security engineer, compare 2026 salary ranges, choose certs, and build a 12-month roadmap to hiring-ready proof.

![](https://adamtheautomator.com/wp-content/uploads/2026/02/featured_image-1-scaled.jpg)

### [Transition from SysAdmin to Cloud Engineer](/transition-sysadmin-cloud-engineer/)

System administrators already have the networking, Linux, and operational expertise that cloud engineering demands. This guide maps the philosophy shift, technical domains, certifications, and portfolio steps to make the transition.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)