If you are deploying the CloudWatch agent in an on-premises environment, you should also install the Systems Manager Agent.

When deploying the CloudWatch agent in an on-premises environment, it is recommended to install the Systems Manager Agent as well. CloudWatch Agent gathers metrics, logs, and traces from various instances and servers, allowing monitoring through Amazon CloudWatch. This agent can view metrics like memory usage, CPU usage, and network traffic.

The Systems Manager Agent is necessary for configuring authentication to CloudWatch agent without using long-term access keys. Doing so prevents risks associated with potential AWS environment compromise due to exposed access keys. Instead, the SSM Agent assumes the IAM role associated via hybrid activation to use temporary credentials. This enables uploading logs from an on-premises environment when an IAM policy granting such permission is attached.

To install both agents, first set up a hybrid activation for registering the on-premises device as a managed node. Create a trust policy JSON file and an IAM role with necessary permissions. Attach the AmazonSSMManagedInstanceCore IAM policy for basic SSM functionality and CloudWatchAgentServerPolicy for CloudWatch agent metrics and logs.

Next, create the hybrid activation, specifying an instance name, IAM role name, registration limit, region, and expiration date. Finally, download the SSM Agent and register it as a managed node in AWS Systems Manager.