feat(scripts): Add GCP onboarding support by MarcoDN · Pull Request #2269 · aws/amazon-cloudwatch-agent

MarcoDN · 2026-09-03T11:11:30Z

Description of the issue

The onboarding setup scripts cover AWS and Azure platforms. The agent now supports GCE (auto-detected host mode) and GKE (RUN_IN_GKE via the Helm chart), but there is no scripted onboarding for GCP workloads.

Description of changes

Extends the onboarding scripts to GCE VMs (gcp_gce) and GKE clusters (gcp_gke), mirroring the Azure split:

aws/setup.sh: gcp_gce trust federates the IAM role directly with accounts.google.com (no OIDC provider resource; Google is a built-in web-identity provider), pinning all three Google condition keys: the service account unique ID (:sub), the sts.amazonaws.com audience (:oaud), and the authorized party (:aud, the unique ID again on service-account tokens) - the trust policy form recommended for Google-issued tokens (AWS Security Blog). The audience condition matches the audience the agent requests for its identity tokens and rejects tokens minted for other services being replayed against STS, mirroring how the Azure trust policies pin their requested audience. gcp_gke registers the cluster's OIDC issuer as an IAM OIDC provider and trusts the amazon-cloudwatch/cloudwatch-agent service account.
gcp/setup.sh: new GCP-side script with the two-mode design keyed on CWAGENT_AWS_ROLE_ARN. Identity discovery is read-only: the VM's service account unique ID, or the cluster's OIDC issuer URL (constructed under
locations/ for zonal and regional clusters alike). A VM install pushes install.sh over gcloud compute ssh behind a reachability probe, printing the command when SSH cannot reach the VM. A GKE install runs the CloudWatch Observability Helm chart with k8sMode=GKE when helm, kubectl, and gke-gcloud-auth-plugin are present, printing the commands otherwise.
install.sh: accepts CWAGENT_CLOUD=gcp through the same web-identity branch as azure (set-env CWAGENT_ROLE_ARN and AWS_REGION, then fetch-config -m auto).
setup.sh: dispatcher chain gcp/setup.sh (identity) -> aws/setup.sh (trust) -> gcp/setup.sh (install), with the same cross-shell resume flow as Azure.
README.md: documents the new platforms and flow.

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

sh -n and shellcheck clean on all touched scripts; make fmt-sh clean.

GCE Tests

gcp/setup.sh Windows VM

{USER}@cloudshell:~ ({GCP_PROJECT})$ curl -fsSL https://raw.githubusercontent.com/aws/amazon-cloudwatch-agent/main/scripts/gcp/setup.sh | CWAGENT_PLATFORM=gcp_gce CWAGENT_GCP_LOCATION=us-east1-b CWAGENT_GCP_INSTANCE_NAME=windows-test CWAGENT_AWS_REGION=us-east-1 CWAGENT_AWS_ROLE_ARN={CWAGENT_AWS_ROLE_ARN} sh
  ✓ GCP account: {GCP_ACCOUNT}
  ✓ GCP project: {GCP_PROJECT}

Reading GCE VM identity...
  ✓ Service account: {SA_EMAIL}
  ✓ Service account unique ID (for the AWS setup): {SA_UNIQUE_ID}

Checking SSH connectivity to windows-test...
  ✓ SSH connection established

Installing agent on windows-test...
  + Running install via gcloud compute ssh
Downloading https://amazoncloudwatch-agent.s3.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi
Installing package...
Set CWAGENT_ROLE_ARN
Set AWS_REGION
****** processing amazon-cloudwatch-agent ******
Starting config-downloader, this will map back to a call to amazon-cloudwatch-agent
Executing C:\Program Files\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.exe with arguments: [config-downloader -output-dir C:\ProgramData\Amazon\AmazonCloudWatchAgent\Configs -config C:\ProgramData\Amazon\AmazonCloudWatchAgent\common-config.toml -multi-config default -mode auto -download-source default:otel]D! [EC2] Found active network interface
I! imds retry client will retry 1 timesD! could not get hostname without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch hostname from EC2 metadata fail: RequestCanceled: EC2 IMDS access disabled via AWS_EC2_METADATA_DISABLED env var
D! could not get instance document without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch identity document from EC2 metadata fail: EC2MetadataRequestError: failed to get EC2 instance identity document
caused by: RequestCanceled: EC2 IMDS access disabled via AWS_EC2_METADATA_DISABLED env var
I! Detected the instance is GCE
Start configuration validation...
Starting config-translator, this will map back to a call to amazon-cloudwatch-agent
Executing C:\Program Files\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.exe with arguments: [config-translator -mode auto -config C:\ProgramData\Amazon\AmazonCloudWatchAgent\common-config.toml -multi-config default -input C:\ProgramData\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.json -input-dir C:\ProgramData\Amazon\AmazonCloudWatchAgent\Configs -output C:\ProgramData\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.toml]D! [EC2] Found active network interface
I! imds retry client will retry 1 timesD! could not get hostname without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch hostname from EC2 metadata fail: RequestCanceled: EC2 IMDS access disabled via AWS_EC2_METADATA_DISABLED env var
D! could not get instance document without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch identity document from EC2 metadata fail: EC2MetadataRequestError: failed to get EC2 instance identity document
caused by: RequestCanceled: EC2 IMDS access disabled via AWS_EC2_METADATA_DISABLED env var
I! Detected the instance is GCE
2026/09/21 20:17:23 Reading json config file path: C:\ProgramData\Amazon\AmazonCloudWatchAgent\Configs\default_otel.tmp ...
2026/09/21 20:17:23 I! Valid Json input schema.
2026/09/21 20:17:23 Configuration validation first phase succeeded
Configuration validation second phase succeeded
Configuration validation succeeded
AmazonCloudWatchAgent has been stopped
AmazonCloudWatchAgent has been started
Amazon CloudWatch Agent installed and running.
{
  "status": "running",
  "starttime": "",
  "configstatus": "configured",
  "version": "1.300073.1b1859"
}
  ✓ Agent installed on 'windows-test'
  ✓ Service account unique ID (for the AWS setup): {SA_UNIQUE_ID}

gcp/setup.sh Linux VM

{USER}@cloudshell:~ ({GCP_PROJECT})$ curl -fsSL https://raw.githubusercontent.com/aws/amazon-cloudwatch-agent/main/scripts/gcp/setup.sh | CWAGENT_PLATFORM=gcp_gce CWAGENT_GCP_LOCATION=us-east1-b CWAGENT_GCP_INSTANCE_NAME=linux-test CWAGENT_AWS_REGION=us-east-1 CWAGENT_AWS_ROLE_ARN={CWAGENT_AWS_ROLE_ARN} sh
  ✓ GCP account: {GCP_ACCOUNT}
  ✓ GCP project: {GCP_PROJECT}

Reading GCE VM identity...
  ✓ Service account: {SA_EMAIL}
  ✓ Service account unique ID (for the AWS setup): {SA_UNIQUE_ID}

Checking SSH connectivity to linux-test...
  ✓ SSH connection established

Installing agent on linux-test...
  + Running install via gcloud compute ssh
Downloading https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
Installing package...
(Reading database ... 66852 files and directories currently installed.)
Preparing to unpack .../amazon-cloudwatch-agent.deb ...

****** processing amazon-cloudwatch-agent ******
Unpacking amazon-cloudwatch-agent (1.300073.0b1828-1) over (1.300073.0b1828-1) ...
Setting up amazon-cloudwatch-agent (1.300073.0b1828-1) ...

Set CWAGENT_ROLE_ARN

Set AWS_REGION
****** processing amazon-cloudwatch-agent ******
2026/09/21 20:36:26 I! WARN: failed to get session token, falling back to IMDSv1: 405 Method Not Allowed: Method Not Allowed
        status code: 405, request id: 
caused by: EC2MetadataError: failed to make EC2Metadata request
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 405 (Method Not Allowed)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>405.</b> <ins>That’s an error.</ins>
  <p>The request method <code>PUT</code> is inappropriate for the URL <code>/latest/api/token</code>.  <ins>That’s all we know.</ins>

        status code: 405, request id: 
Starting config-downloader, this will map back to a call to amazon-cloudwatch-agent
Executing /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent with arguments: [config-downloader -config /opt/aws/amazon-cloudwatch-agent/etc/common-config.toml -multi-config default -mode auto -download-source default:otel -output-dir /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d]D! [EC2] Found active network interface
I! imds retry client will retry 1 timesD! could not get hostname without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch hostname from EC2 metadata fail: EC2MetadataError: failed to make EC2Metadata request
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>404.</b> <ins>That’s an error.</ins>
  <p>The requested URL <code>/latest/meta-data/hostname</code> was not found on this server.  <ins>That’s all we know.</ins>

        status code: 404, request id: 
D! could not get instance document without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch identity document from EC2 metadata fail: EC2MetadataRequestError: failed to get EC2 instance identity document
caused by: EC2MetadataError: failed to make EC2Metadata request
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>404.</b> <ins>That’s an error.</ins>
  <p>The requested URL <code>/latest/dynamic/instance-identity/document</code> was not found on this server.  <ins>That’s all we know.</ins>

        status code: 404, request id: 
I! Detected the instance is GCE
Start configuration validation...
2026/09/21 20:36:27 I! WARN: failed to get session token, falling back to IMDSv1: 405 Method Not Allowed: Method Not Allowed
        status code: 405, request id: 
caused by: EC2MetadataError: failed to make EC2Metadata request
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 405 (Method Not Allowed)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>405.</b> <ins>That’s an error.</ins>
  <p>The request method <code>PUT</code> is inappropriate for the URL <code>/latest/api/token</code>.  <ins>That’s all we know.</ins>

        status code: 405, request id: 
2026/09/21 20:36:27 Reading json config file path: /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/default_otel.tmp ...
2026/09/21 20:36:27 I! Valid Json input schema.
2026/09/21 20:36:27 Configuration validation first phase succeeded
Starting config-translator, this will map back to a call to amazon-cloudwatch-agent
Executing /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent with arguments: [config-translator -input /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json -input-dir /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d -output /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.toml -mode auto -config /opt/aws/amazon-cloudwatch-agent/etc/common-config.toml -multi-config default]D! [EC2] Found active network interface
I! imds retry client will retry 1 timesD! could not get hostname without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch hostname from EC2 metadata fail: EC2MetadataError: failed to make EC2Metadata request
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>404.</b> <ins>That’s an error.</ins>
  <p>The requested URL <code>/latest/meta-data/hostname</code> was not found on this server.  <ins>That’s all we know.</ins>

        status code: 404, request id: 
D! could not get instance document without imds v1 fallback enable thus enable fallback
E! [EC2] Fetch identity document from EC2 metadata fail: EC2MetadataRequestError: failed to get EC2 instance identity document
caused by: EC2MetadataError: failed to make EC2Metadata request
<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>404.</b> <ins>That’s an error.</ins>
  <p>The requested URL <code>/latest/dynamic/instance-identity/document</code> was not found on this server.  <ins>That’s all we know.</ins>

        status code: 404, request id: 
I! Detected the instance is GCE
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent -schematest -config /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.toml
Configuration validation second phase succeeded
Configuration validation succeeded
Amazon CloudWatch Agent installed and running.
{
  "status": "running",
  "starttime": "2026-09-21T20:36:29+00:00",
  "configstatus": "configured",
  "version": "1.300073.0b1828"
}
  ✓ Agent installed on 'linux-test'
  ✓ Service account unique ID (for the AWS setup): {SA_UNIQUE_ID}

aws/setup.sh GCE

~ $ curl -fsSL https://raw.githubusercontent.com/aws/amazon-cloudwatch-agent/main/scripts/aws/setup.sh | CWAGENT_PLATFORM=gcp_gce CWAGENT_AWS_REGION=us-east-1 CWAGENT_GCP_SA_UNIQUE_ID={CWAGENT_GCP_SA_UNIQUE_ID}sh
  ✓ AWS account: {AWS_ACCOUNT} ({AWS_ACCOUNT_ALIAS})
  ✓ AWS identity: {AWS_ASSUMED_ROLE}

Configuring AWS trust...
  + Merging trust statement into 'CloudWatchAgentServerRole'
  ✓ Managed policy CloudWatchAgentServerPolicy attached
  ✓ Role ARN: arn:aws:iam::{AWS_ACCOUNT}:role/CloudWatchAgentServerRole
  ✓ Trust configured. Install runs on the GCP side (gcp/setup.sh) with the role ARN above.

GKE Tests

gcp/setup.sh GKE

{USER}@cloudshell:~ ({GCP_PROJECT})$ curl -fsSL https://raw.githubusercontent.com/aws/amazon-cloudwatch-agent/main/scripts/gcp/setup.sh | CWAGENT_PLATFORM=gcp_gke CWAGENT_GCP_LOCATION=us-east1-b CWAGENT_K8S_CLUSTER_NAME=gke-test CWAGENT_AWS_REGION=us-east-1 CWAGENT_AWS_ROLE_ARN={CWAGENT_AWS_ROLE_ARN} sh
  ✓ GCP account: {GCP_ACCOUNT}
  ✓ GCP project: {GCP_PROJECT}

Reading GKE cluster identity...

Installing CloudWatch Observability Helm chart on gke-test...
  + Configuring kubeconfig for 'gke-test'
Fetching cluster endpoint and auth data.
kubeconfig entry generated for gke-test.
  + Installing via Helm
"aws-observability" has been added to your repositories
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "aws-observability" chart repository
Update Complete. ⎈Happy Helming!⎈
Release "amazon-cloudwatch-observability" has been upgraded. Happy Helming!
NAME: amazon-cloudwatch-observability
LAST DEPLOYED: Mon Sep 21 21:05:31 2026
NAMESPACE: amazon-cloudwatch
STATUS: deployed
REVISION: 5
DESCRIPTION: Upgrade complete
TEST SUITE: None
  ✓ Chart installed on 'gke-test'
  ✓ OIDC issuer (for the AWS setup): https://container.googleapis.com/v1/projects/{GCP_PROJECT}/locations/us-east1-b/clusters/gke-test

aws/setup.sh GKE

~ $   curl -fsSL https://raw.githubusercontent.com/aws/amazon-cloudwatch-agent/main/scripts/aws/setup.sh | CWAGENT_PLATFORM=gcp_gke CWAGENT_AWS_REGION=us-east-1 CWAGENT_GCP_OIDC_ISSUER=https://container.googleapis.com/v1/projects/{GCP_PROJECT}/locations/us-east1-b/clusters/gke-test CWAGENT_AWS_ROLE_NAME=CloudWatchAgentServerRole sh
  ✓ AWS account: {AWS_ACCOUNT} ({AWS_ACCOUNT_ALIAS})
  ✓ AWS identity: {AWS_ASSUMED_ROLE}

Configuring AWS trust...
  ✓ OIDC provider exists
  ✓ IAM role 'CloudWatchAgentServerRole' trust policy up to date
  ✓ Managed policy CloudWatchAgentServerPolicy attached
  ✓ Role ARN: arn:aws:iam::{AWS_ACCOUNT}:role/CloudWatchAgentServerRole
  ✓ Trust configured. Install runs on the GCP side (gcp/setup.sh) with the role ARN above.

Requirements

make fmt-sh run
shellcheck clean

Extends the onboarding scripts to GCE instances (gcp_gce) and GKE clusters (gcp_gke): aws/setup.sh gains the two trust branches (gcp_gce federates accounts.google.com directly, pinning the aud, sub, and oaud condition keys; gcp_gke registers the cluster's OIDC issuer as an IAM OIDC provider), gcp/setup.sh discovers the GCP-side identity and pushes the install, install.sh accepts CWAGENT_CLOUD=gcp, and the dispatcher and README cover the new platforms.

github-actions · 2026-09-21T21:29:45Z

Binary Size Report

linux/amd64

Binary	PR	vs `main` (`863f768`)	vs `v1.300073.0`
amazon-cloudwatch-agent	194.8 MB	+0 B	+0 B
amazon-cloudwatch-agent-config-wizard	2.0 MB	+0 B	+0 B
config-downloader	2.0 MB	+0 B	+0 B
config-translator	2.0 MB	+0 B	+0 B
start-amazon-cloudwatch-agent	2.5 MB	+0 B	+0 B
workload-discovery	3.0 MB	+0 B	+0 B
Total	206.4 MB	+0 B	+0 B

linux/amd64 amazon-cloudwatch-agent (last 9 main commits + this PR)

 196 ┤                                        
     ┤                                        
     ┤                                        
     ┤                                        
     ┤▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ 
     ┤███ ███ ███ ███ ███ ███ ███ ███ ███ ███ 
     ┤███ ███ ███ ███ ███ ███ ███ ███ ███ ███ 
     ┤███ ███ ███ ███ ███ ███ ███ ███ ███ ███ 
 194 ┤███ ███ ███ ███ ███ ███ ███ ███ ███ ███ 
 MB  └────────────────────────────────────────
      c99afc5         v1.300073.0         PR

linux/arm64

Binary	PR	vs `main` (`863f768`)	vs `v1.300073.0`
amazon-cloudwatch-agent	178.6 MB	+0 B	+0 B
amazon-cloudwatch-agent-config-wizard	2.0 MB	+0 B	+0 B
config-downloader	2.0 MB	+0 B	+0 B
config-translator	2.0 MB	+0 B	+0 B
start-amazon-cloudwatch-agent	2.4 MB	+0 B	+0 B
workload-discovery	2.9 MB	+0 B	+0 B
Total	189.9 MB	+0 B	+0 B

windows/amd64

Binary	PR	vs `main` (`863f768`)	vs `v1.300073.0`
amazon-cloudwatch-agent.exe	197.6 MB	${\color{red}▲}$ +6.7 KB (+0.0%)	${\color{red}▲}$ +6.7 KB (+0.0%)
amazon-cloudwatch-agent-config-wizard.exe	2.1 MB	+0 B	+0 B
config-downloader.exe	2.1 MB	+0 B	+0 B
config-translator.exe	2.1 MB	+0 B	+0 B
start-amazon-cloudwatch-agent.exe	2.3 MB	+0 B	+0 B
workload-discovery.exe	2.9 MB	+0 B	+0 B
Total	209.3 MB	${\color{red}▲}$ +6.7 KB (+0.0%)	${\color{red}▲}$ +6.7 KB (+0.0%)

Investigating size changes

Use go-size-analyzer to compare binaries:

GOEXPERIMENT=jsonv2 go install github.com/Zxilly/go-size-analyzer/cmd/gsa@latest
gsa diff --old <baseline-binary> --new <new-binary>

jefchien reviewed Sep 3, 2026

View reviewed changes

Comment thread scripts/aws/setup.sh Outdated

jefchien reviewed Sep 4, 2026

View reviewed changes

Comment thread scripts/gcp/setup.sh Outdated

Comment thread scripts/gcp/setup.sh Outdated

Comment thread scripts/gcp/setup.sh Outdated

Comment thread scripts/gcp/setup.sh Outdated

MarcoDN force-pushed the gcp-setup-scripts branch from 1aba4de to c1e1849 Compare September 11, 2026 09:43

MarcoDN changed the title ~~Add GCP onboarding setup scripts~~ feat(scripts): Add GCP onboarding support Sep 11, 2026

MarcoDN assigned EduVencovsky and jefchien Sep 11, 2026

jefchien reviewed Sep 15, 2026

View reviewed changes

Comment thread scripts/aws/setup.sh Outdated

Comment thread scripts/aws/setup.sh

Comment thread scripts/gcp/setup.sh

Comment thread scripts/gcp/setup.sh

MarcoDN force-pushed the gcp-setup-scripts branch 4 times, most recently from 3b2cb9b to c4a337c Compare September 21, 2026 15:19

MarcoDN force-pushed the gcp-setup-scripts branch from c4a337c to 0c2b1d2 Compare September 21, 2026 15:36

jefchien added 2 commits September 21, 2026 19:17

Disable EC2 IMDS attempts during installation in non-AWS environments

0d4c469

Support installation over SSH for Windows

b43ec9a

jefchien marked this pull request as ready for review September 21, 2026 20:23

jefchien requested a review from a team as a code owner September 21, 2026 20:23

jefchien added the skip testing label Sep 21, 2026

Improve logging

67749e2

jefchien force-pushed the gcp-setup-scripts branch from 1fe54ca to 67749e2 Compare September 21, 2026 20:28

Add setup script tests to PR-build

aaa9d71

EduVencovsky approved these changes Sep 21, 2026

View reviewed changes

sky333999 approved these changes Sep 21, 2026

View reviewed changes

jefchien merged commit 4b9f5ec into main Sep 21, 2026
34 of 36 checks passed

jefchien deleted the gcp-setup-scripts branch September 21, 2026 21:32

Navigation Menu

feat(scripts): Add GCP onboarding support - #2269

feat(scripts): Add GCP onboarding support#2269
jefchien merged 5 commits into
mainfrom
gcp-setup-scripts

MarcoDN commented Sep 3, 2026 •

edited by jefchien

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

MarcoDN commented Sep 3, 2026 • edited by jefchien Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of the issue

Description of changes

License

Tests

GCE Tests

GKE Tests

Requirements

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026

Binary Size Report

linux/amd64

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MarcoDN commented Sep 3, 2026 •

edited by jefchien

Loading