The problem

Multi-cloud estates usually mean three monitoring tools, three alerting rule sets and no single view during an incident. Standardizing on OpenTelemetry and a managed Prometheus/Grafana backend fixes the tooling. Keyless federation fixes the security problem of shipping credentials to other clouds.

What you’ll build

• An Amazon Managed Prometheus workspace with recording rules and HostDown/HighCpu alerts
• An Amazon Managed Grafana workspace (SSO) with Prometheus, CloudWatch and X-Ray data sources
• Keyless federation: GCP service accounts via Google identity tokens, Azure managed identities via Entra ID OIDC
• One OpenTelemetry collector config that runs unchanged on AWS, Azure and GCP and labels everything with cloud_provider
• A CloudWatch cross-account sink (OAM) for multi-account AWS telemetry

Architecture

 AWS (EC2/ECS/EKS)          Azure VMs                     GCP VMs
 ADOT collector             otelcol + Entra ID token      otelcol + Google ID token
     │ IAM role                 │ OIDC → STS                  │ web identity → STS     (no stored AWS keys)
     └──────────────┬──────────┴─────────────┬──────────────┘
                    ▼                        ▼
      Amazon Managed Prometheus      X-Ray / CloudWatch Logs
      (recording + alert rules)              │
                    └──────────┬─────────────┘
                               ▼
                 Amazon Managed Grafana (SSO)  ◀── CloudWatch cross-account (OAM sink)

AWS services used

How it works

1. CollectThe same otel collector config runs everywhere: host metrics, OTLP app telemetry and Prometheus scrapes.
2. AuthenticateCollectors exchange their native cloud identity token for 1-hour AWS credentials, so nothing secret sits on disk.
3. StoreMetrics go to AMP over SigV4, traces to X-Ray and logs to CloudWatch Logs.
4. Visualize & alertGrafana dashboards compare clouds side by side, and AMP rules fire alerts.

Key design decisions

• Open standards (OTel, PromQL) keep the backend swappable.
• Trust policies pin both the token audience and the exact service account or identity.
• Every feature is optional, so the stack deploys cleanly for AWS-only teams too.

Deploy it

npm install
npx cdk deploy \
  -c gcpServiceAccountUniqueId=123456789012345678901 \
  -c azureTenantId=<tenant-guid> -c azureAppId=<app-registration-client-id> -c azurePrincipalId=<managed-identity-object-id> \
  -c sourceAccountIds=111111111111,222222222222

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Start collectors on one VM per cloud, then run count by (cloud_provider) (up) in Grafana and see aws, azure and gcp on one graph. Stop a VM and HostDown fires within five minutes.

Skills this demonstrates