Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. cloudwatchomni
  6. Space
Viewing docs for AWS v7.51.1
published on Friday, Oct 16, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.cloudwatchomni.Space

aws logo aws logo
Viewing docs for AWS v7.51.1
published on Friday, Oct 16, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages a CloudWatch Omni Space. A space is the container that holds your observability data within a CloudWatch Omni domain.

    NOTE: CloudWatch Omni allows only one space per AWS account per region. Creating a second space in the same region returns ConflictException. A space in a different region is permitted, and a space does not have to be in the same region as its domain.

    NOTE: CloudWatch Omni is not available in every region. In unsupported regions the API returns AccessDeniedException.

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.iam.Role("example", {
    name: "cloudwatch-omni-data-access",
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "cloudwatch.amazonaws.com",
            },
        }],
    }),
});
const exampleDomain = new aws.cloudwatchomni.Domain("example", {
    name: "example",
    identityProviders: ["IAM"],
});
const exampleSpace = new aws.cloudwatchomni.Space("example", {
    name: "example",
    domainId: exampleDomain.domainId,
    dataAccessRoleArn: example.arn,
});

    import pulumi
import json
import pulumi_aws as aws

example = aws.iam.Role("example",
    name="cloudwatch-omni-data-access",
    assume_role_policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [{
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudwatch.amazonaws.com",
            },
        }],
    }))
example_domain = aws.cloudwatchomni.Domain("example",
    name="example",
    identity_providers=["IAM"])
example_space = aws.cloudwatchomni.Space("example",
    name="example",
    domain_id=example_domain.domain_id,
    data_access_role_arn=example.arn)

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudwatchomni"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"Version": "2012-10-17",
			"Statement": []map[string]interface{}{
				map[string]interface{}{
					"Action": "sts:AssumeRole",
					"Effect": "Allow",
					"Principal": map[string]string{
						"Service": "cloudwatch.amazonaws.com",
					},
				},
			},
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		example, err := iam.NewRole(ctx, "example", &iam.RoleArgs{
			Name:             pulumi.String("cloudwatch-omni-data-access"),
			AssumeRolePolicy: pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		exampleDomain, err := cloudwatchomni.NewDomain(ctx, "example", &cloudwatchomni.DomainArgs{
			Name: pulumi.String("example"),
			IdentityProviders: pulumi.StringArray{
				pulumi.String("IAM"),
			},
		})
		if err != nil {
			return err
		}
		_, err = cloudwatchomni.NewSpace(ctx, "example", &cloudwatchomni.SpaceArgs{
			Name:              pulumi.String("example"),
			DomainId:          exampleDomain.DomainId,
			DataAccessRoleArn: example.Arn,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Iam.Role("example", new()
    {
        Name = "cloudwatch-omni-data-access",
        AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["Version"] = "2012-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["Action"] = "sts:AssumeRole",
                    ["Effect"] = "Allow",
                    ["Principal"] = new Dictionary<string, object?>
                    {
                        ["Service"] = "cloudwatch.amazonaws.com",
                    },
                },
            },
        }),
    });

    var exampleDomain = new Aws.CloudWatchOmni.Domain("example", new()
    {
        Name = "example",
        IdentityProviders = new[]
        {
            "IAM",
        },
    });

    var exampleSpace = new Aws.CloudWatchOmni.Space("example", new()
    {
        Name = "example",
        DomainId = exampleDomain.DomainId,
        DataAccessRoleArn = example.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.cloudwatchomni.Domain;
import com.pulumi.aws.cloudwatchomni.DomainArgs;
import com.pulumi.aws.cloudwatchomni.Space;
import com.pulumi.aws.cloudwatchomni.SpaceArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Role("example", RoleArgs.builder()
            .name("cloudwatch-omni-data-access")
            .assumeRolePolicy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Action", "sts:AssumeRole"),
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "cloudwatch.amazonaws.com")
                        ))
                    )))
                )))
            .build());

        var exampleDomain = new Domain("exampleDomain", DomainArgs.builder()
            .name("example")
            .identityProviders("IAM")
            .build());

        var exampleSpace = new Space("exampleSpace", SpaceArgs.builder()
            .name("example")
            .domainId(exampleDomain.domainId())
            .dataAccessRoleArn(example.arn())
            .build());

    }
}

    resources:
  example:
    type: aws:iam:Role
    properties:
      name: cloudwatch-omni-data-access
      assumeRolePolicy:
        fn::toJSON:
          Version: 2012-10-17
          Statement:
            - Action: sts:AssumeRole
              Effect: Allow
              Principal:
                Service: cloudwatch.amazonaws.com
  exampleDomain:
    type: aws:cloudwatchomni:Domain
    name: example
    properties:
      name: example
      identityProviders:
        - IAM
  exampleSpace:
    type: aws:cloudwatchomni:Space
    name: example
    properties:
      name: example
      domainId: ${exampleDomain.domainId}
      dataAccessRoleArn: ${example.arn}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_iam_role" "example" {
  name = "cloudwatch-omni-data-access"
  assume_role_policy = jsonencode({
    "Version" = "2012-10-17"
    "Statement" = [{
      "Action" = "sts:AssumeRole"
      "Effect" = "Allow"
      "Principal" = {
        "Service" = "cloudwatch.amazonaws.com"
      }
    }]
  })
}
resource "aws_cloudwatchomni_domain" "example" {
  name               = "example"
  identity_providers = ["IAM"]
}
resource "aws_cloudwatchomni_space" "example" {
  name                 = "example"
  domain_id            = aws_cloudwatchomni_domain.example.domain_id
  data_access_role_arn = aws_iam_role.example.arn
}

    AgentCore Online Evaluation

    Supply agentCoreEvaluationRoleArn to let the space run AgentCore online evaluation.

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.cloudwatchomni.Space("example", {
    name: "example",
    domainId: exampleAwsCloudwatchomniDomain.domainId,
    dataAccessRoleArn: dataAccess.arn,
    agentCoreEvaluationRoleArn: agentCore.arn,
});

    import pulumi
import pulumi_aws as aws

example = aws.cloudwatchomni.Space("example",
    name="example",
    domain_id=example_aws_cloudwatchomni_domain["domainId"],
    data_access_role_arn=data_access["arn"],
    agent_core_evaluation_role_arn=agent_core["arn"])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudwatchomni"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudwatchomni.NewSpace(ctx, "example", &cloudwatchomni.SpaceArgs{
			Name:                       pulumi.String("example"),
			DomainId:                   pulumi.Any(exampleAwsCloudwatchomniDomain.DomainId),
			DataAccessRoleArn:          pulumi.Any(dataAccess.Arn),
			AgentCoreEvaluationRoleArn: pulumi.Any(agentCore.Arn),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.CloudWatchOmni.Space("example", new()
    {
        Name = "example",
        DomainId = exampleAwsCloudwatchomniDomain.DomainId,
        DataAccessRoleArn = dataAccess.Arn,
        AgentCoreEvaluationRoleArn = agentCore.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cloudwatchomni.Space;
import com.pulumi.aws.cloudwatchomni.SpaceArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Space("example", SpaceArgs.builder()
            .name("example")
            .domainId(exampleAwsCloudwatchomniDomain.domainId())
            .dataAccessRoleArn(dataAccess.arn())
            .agentCoreEvaluationRoleArn(agentCore.arn())
            .build());

    }
}

    resources:
  example:
    type: aws:cloudwatchomni:Space
    properties:
      name: example
      domainId: ${exampleAwsCloudwatchomniDomain.domainId}
      dataAccessRoleArn: ${dataAccess.arn}
      agentCoreEvaluationRoleArn: ${agentCore.arn}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_cloudwatchomni_space" "example" {
  name                           = "example"
  domain_id                      = exampleAwsCloudwatchomniDomain.domainId
  data_access_role_arn           = dataAccess.arn
  agent_core_evaluation_role_arn = agentCore.arn
}

    Customer Managed Encryption

    Omitting encryptionConfiguration leaves the space encrypted with an AWS owned key. To use a customer managed key, the key policy must grant the cloudwatch.amazonaws.com service principal permission to use it, otherwise CreateSpace fails with AccessDeniedException.

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const example = new aws.kms.Key("example", {
    description: "CloudWatch Omni Space encryption",
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Sid: "EnableIAMUserPermissions",
                Effect: "Allow",
                Principal: {
                    AWS: current.then(current => `arn:aws:iam::${current.accountId}:root`),
                },
                Action: "kms:*",
                Resource: "*",
            },
            {
                Sid: "AllowCloudWatchOmni",
                Effect: "Allow",
                Principal: {
                    Service: "cloudwatch.amazonaws.com",
                },
                Action: [
                    "kms:Decrypt",
                    "kms:DescribeKey",
                    "kms:Encrypt",
                    "kms:GenerateDataKey*",
                    "kms:ReEncrypt*",
                ],
                Resource: "*",
            },
        ],
    }),
});
const exampleSpace = new aws.cloudwatchomni.Space("example", {
    encryptionConfiguration: {
        encryptionStrategy: "CUSTOMER_MANAGED",
        kmsKeyArn: example.arn,
    },
    name: "example",
    domainId: exampleAwsCloudwatchomniDomain.domainId,
    dataAccessRoleArn: exampleAwsIamRole.arn,
});

    import pulumi
import json
import pulumi_aws as aws

current = aws.get_caller_identity()
example = aws.kms.Key("example",
    description="CloudWatch Omni Space encryption",
    policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "EnableIAMUserPermissions",
                "Effect": "Allow",
                "Principal": {
                    "AWS": f"arn:aws:iam::{current.account_id}:root",
                },
                "Action": "kms:*",
                "Resource": "*",
            },
            {
                "Sid": "AllowCloudWatchOmni",
                "Effect": "Allow",
                "Principal": {
                    "Service": "cloudwatch.amazonaws.com",
                },
                "Action": [
                    "kms:Decrypt",
                    "kms:DescribeKey",
                    "kms:Encrypt",
                    "kms:GenerateDataKey*",
                    "kms:ReEncrypt*",
                ],
                "Resource": "*",
            },
        ],
    }))
example_space = aws.cloudwatchomni.Space("example",
    encryption_configuration={
        "encryption_strategy": "CUSTOMER_MANAGED",
        "kms_key_arn": example.arn,
    },
    name="example",
    domain_id=example_aws_cloudwatchomni_domain["domainId"],
    data_access_role_arn=example_aws_iam_role["arn"])

    package main

import (
	"encoding/json"
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudwatchomni"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"Version": "2012-10-17",
			"Statement": []interface{}{
				map[string]interface{}{
					"Sid":    "EnableIAMUserPermissions",
					"Effect": "Allow",
					"Principal": map[string]string{
						"AWS": fmt.Sprintf("arn:aws:iam::%v:root", current.AccountId),
					},
					"Action":   "kms:*",
					"Resource": "*",
				},
				map[string]interface{}{
					"Sid":    "AllowCloudWatchOmni",
					"Effect": "Allow",
					"Principal": map[string]string{
						"Service": "cloudwatch.amazonaws.com",
					},
					"Action": []string{
						"kms:Decrypt",
						"kms:DescribeKey",
						"kms:Encrypt",
						"kms:GenerateDataKey*",
						"kms:ReEncrypt*",
					},
					"Resource": "*",
				},
			},
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		example, err := kms.NewKey(ctx, "example", &kms.KeyArgs{
			Description: pulumi.String("CloudWatch Omni Space encryption"),
			Policy:      json0,
		})
		if err != nil {
			return err
		}
		_, err = cloudwatchomni.NewSpace(ctx, "example", &cloudwatchomni.SpaceArgs{
			EncryptionConfiguration: &cloudwatchomni.SpaceEncryptionConfigurationArgs{
				EncryptionStrategy: pulumi.String("CUSTOMER_MANAGED"),
				KmsKeyArn:          example.Arn,
			},
			Name:              pulumi.String("example"),
			DomainId:          pulumi.Any(exampleAwsCloudwatchomniDomain.DomainId),
			DataAccessRoleArn: pulumi.Any(exampleAwsIamRole.Arn),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var current = Aws.GetCallerIdentity.Invoke();

    var example = new Aws.Kms.Key("example", new()
    {
        Description = "CloudWatch Omni Space encryption",
        Policy = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["Version"] = "2012-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["Sid"] = "EnableIAMUserPermissions",
                    ["Effect"] = "Allow",
                    ["Principal"] = new Dictionary<string, object?>
                    {
                        ["AWS"] = $"arn:aws:iam::{current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId)}:root",
                    },
                    ["Action"] = "kms:*",
                    ["Resource"] = "*",
                },
                new Dictionary<string, object?>
                {
                    ["Sid"] = "AllowCloudWatchOmni",
                    ["Effect"] = "Allow",
                    ["Principal"] = new Dictionary<string, object?>
                    {
                        ["Service"] = "cloudwatch.amazonaws.com",
                    },
                    ["Action"] = new[]
                    {
                        "kms:Decrypt",
                        "kms:DescribeKey",
                        "kms:Encrypt",
                        "kms:GenerateDataKey*",
                        "kms:ReEncrypt*",
                    },
                    ["Resource"] = "*",
                },
            },
        }),
    });

    var exampleSpace = new Aws.CloudWatchOmni.Space("example", new()
    {
        EncryptionConfiguration = new Aws.CloudWatchOmni.Inputs.SpaceEncryptionConfigurationArgs
        {
            EncryptionStrategy = "CUSTOMER_MANAGED",
            KmsKeyArn = example.Arn,
        },
        Name = "example",
        DomainId = exampleAwsCloudwatchomniDomain.DomainId,
        DataAccessRoleArn = exampleAwsIamRole.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.kms.Key;
import com.pulumi.aws.kms.KeyArgs;
import com.pulumi.aws.cloudwatchomni.Space;
import com.pulumi.aws.cloudwatchomni.SpaceArgs;
import com.pulumi.aws.cloudwatchomni.inputs.SpaceEncryptionConfigurationArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        var example = new Key("example", KeyArgs.builder()
            .description("CloudWatch Omni Space encryption")
            .policy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(
                        jsonObject(
                            jsonProperty("Sid", "EnableIAMUserPermissions"),
                            jsonProperty("Effect", "Allow"),
                            jsonProperty("Principal", jsonObject(
                                jsonProperty("AWS", String.format("arn:aws:iam::%s:root", current.accountId()))
                            )),
                            jsonProperty("Action", "kms:*"),
                            jsonProperty("Resource", "*")
                        ), 
                        jsonObject(
                            jsonProperty("Sid", "AllowCloudWatchOmni"),
                            jsonProperty("Effect", "Allow"),
                            jsonProperty("Principal", jsonObject(
                                jsonProperty("Service", "cloudwatch.amazonaws.com")
                            )),
                            jsonProperty("Action", jsonArray(
                                "kms:Decrypt", 
                                "kms:DescribeKey", 
                                "kms:Encrypt", 
                                "kms:GenerateDataKey*", 
                                "kms:ReEncrypt*"
                            )),
                            jsonProperty("Resource", "*")
                        )
                    ))
                )))
            .build());

        var exampleSpace = new Space("exampleSpace", SpaceArgs.builder()
            .encryptionConfiguration(SpaceEncryptionConfigurationArgs.builder()
                .encryptionStrategy("CUSTOMER_MANAGED")
                .kmsKeyArn(example.arn())
                .build())
            .name("example")
            .domainId(exampleAwsCloudwatchomniDomain.domainId())
            .dataAccessRoleArn(exampleAwsIamRole.arn())
            .build());

    }
}

    resources:
  example:
    type: aws:kms:Key
    properties:
      description: CloudWatch Omni Space encryption
      policy:
        fn::toJSON:
          Version: 2012-10-17
          Statement:
            - Sid: EnableIAMUserPermissions
              Effect: Allow
              Principal:
                AWS: arn:aws:iam::${current.accountId}:root
              Action: kms:*
              Resource: '*'
            - Sid: AllowCloudWatchOmni
              Effect: Allow
              Principal:
                Service: cloudwatch.amazonaws.com
              Action:
                - kms:Decrypt
                - kms:DescribeKey
                - kms:Encrypt
                - kms:GenerateDataKey*
                - kms:ReEncrypt*
              Resource: '*'
  exampleSpace:
    type: aws:cloudwatchomni:Space
    name: example
    properties:
      encryptionConfiguration:
        encryptionStrategy: CUSTOMER_MANAGED
        kmsKeyArn: ${example.arn}
      name: example
      domainId: ${exampleAwsCloudwatchomniDomain.domainId}
      dataAccessRoleArn: ${exampleAwsIamRole.arn}
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_getcalleridentity" "current" {
}

resource "aws_kms_key" "example" {
  description = "CloudWatch Omni Space encryption"
  policy = jsonencode({
    "Version" = "2012-10-17"
    "Statement" = [{
      "Sid"    = "EnableIAMUserPermissions"
      "Effect" = "Allow"
      "Principal" = {
        "AWS" ="arn:aws:iam::${data.aws_getcalleridentity.current.account_id}:root"
      }
      "Action"   = "kms:*"
      "Resource" = "*"
      }, {
      "Sid"    = "AllowCloudWatchOmni"
      "Effect" = "Allow"
      "Principal" = {
        "Service" = "cloudwatch.amazonaws.com"
      }
      "Action"   = ["kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey*", "kms:ReEncrypt*"]
      "Resource" = "*"
    }]
  })
}
resource "aws_cloudwatchomni_space" "example" {
  encryption_configuration = {
    encryption_strategy = "CUSTOMER_MANAGED"
    kms_key_arn         = aws_kms_key.example.arn
  }
  name                 = "example"
  domain_id            = exampleAwsCloudwatchomniDomain.domainId
  data_access_role_arn = exampleAwsIamRole.arn
}

    Create Space Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Space(name: string, args: SpaceArgs, opts?: CustomResourceOptions);
    @overload
def Space(resource_name: str,
          args: SpaceArgs,
          opts: Optional[ResourceOptions] = None)

@overload
def Space(resource_name: str,
          opts: Optional[ResourceOptions] = None,
          data_access_role_arn: Optional[str] = None,
          domain_id: Optional[str] = None,
          agent_core_evaluation_role_arn: Optional[str] = None,
          encryption_configuration: Optional[SpaceEncryptionConfigurationArgs] = None,
          name: Optional[str] = None,
          region: Optional[str] = None)
    func NewSpace(ctx *Context, name string, args SpaceArgs, opts ...ResourceOption) (*Space, error)
    public Space(string name, SpaceArgs args, CustomResourceOptions? opts = null)
    public Space(String name, SpaceArgs args)
public Space(String name, SpaceArgs args, CustomResourceOptions options)

    type: aws:cloudwatchomni:Space
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_cloudwatchomni_space" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SpaceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SpaceArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SpaceArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SpaceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SpaceArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var spaceResource = new Aws.CloudWatchOmni.Space("spaceResource", new()
{
    DataAccessRoleArn = "string",
    DomainId = "string",
    AgentCoreEvaluationRoleArn = "string",
    EncryptionConfiguration = new Aws.CloudWatchOmni.Inputs.SpaceEncryptionConfigurationArgs
    {
        EncryptionStrategy = "string",
        KmsKeyArn = "string",
    },
    Name = "string",
    Region = "string",
});

    example, err := cloudwatchomni.NewSpace(ctx, "spaceResource", &cloudwatchomni.SpaceArgs{
	DataAccessRoleArn:          pulumi.String("string"),
	DomainId:                   pulumi.String("string"),
	AgentCoreEvaluationRoleArn: pulumi.String("string"),
	EncryptionConfiguration: &cloudwatchomni.SpaceEncryptionConfigurationArgs{
		EncryptionStrategy: pulumi.String("string"),
		KmsKeyArn:          pulumi.String("string"),
	},
	Name:   pulumi.String("string"),
	Region: pulumi.String("string"),
})

    resource "aws_cloudwatchomni_space" "spaceResource" {
  lifecycle {
    create_before_destroy = true
  }
  data_access_role_arn           = "string"
  domain_id                      = "string"
  agent_core_evaluation_role_arn = "string"
  encryption_configuration = {
    encryption_strategy = "string"
    kms_key_arn         = "string"
  }
  name   = "string"
  region = "string"
}

    var spaceResource = new com.pulumi.aws.cloudwatchomni.Space("spaceResource", com.pulumi.aws.cloudwatchomni.SpaceArgs.builder()
    .dataAccessRoleArn("string")
    .domainId("string")
    .agentCoreEvaluationRoleArn("string")
    .encryptionConfiguration(SpaceEncryptionConfigurationArgs.builder()
        .encryptionStrategy("string")
        .kmsKeyArn("string")
        .build())
    .name("string")
    .region("string")
    .build());

    space_resource = aws.cloudwatchomni.Space("spaceResource",
    data_access_role_arn="string",
    domain_id="string",
    agent_core_evaluation_role_arn="string",
    encryption_configuration={
        "encryption_strategy": "string",
        "kms_key_arn": "string",
    },
    name="string",
    region="string")

    const spaceResource = new aws.cloudwatchomni.Space("spaceResource", {
    dataAccessRoleArn: "string",
    domainId: "string",
    agentCoreEvaluationRoleArn: "string",
    encryptionConfiguration: {
        encryptionStrategy: "string",
        kmsKeyArn: "string",
    },
    name: "string",
    region: "string",
});

    type: aws:cloudwatchomni:Space
properties:
    agentCoreEvaluationRoleArn: string
    dataAccessRoleArn: string
    domainId: string
    encryptionConfiguration:
        encryptionStrategy: string
        kmsKeyArn: string
    name: string
    region: string

    Space Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Space resource accepts the following input properties:

    DataAccessRoleArn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    DomainId string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    AgentCoreEvaluationRoleArn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    EncryptionConfiguration SpaceEncryptionConfiguration
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    Name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    Region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    DataAccessRoleArn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    DomainId string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    AgentCoreEvaluationRoleArn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    EncryptionConfiguration SpaceEncryptionConfigurationArgs
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    Name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    Region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    data_access_role_arn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domain_id string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    agent_core_evaluation_role_arn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    encryption_configuration object
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    dataAccessRoleArn String
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domainId String
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    agentCoreEvaluationRoleArn String
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    encryptionConfiguration SpaceEncryptionConfiguration
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name String

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region String
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    dataAccessRoleArn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domainId string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    agentCoreEvaluationRoleArn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    encryptionConfiguration SpaceEncryptionConfiguration
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    data_access_role_arn str
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domain_id str
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    agent_core_evaluation_role_arn str
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    encryption_configuration SpaceEncryptionConfigurationArgs
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name str

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region str
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    dataAccessRoleArn String
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domainId String
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    agentCoreEvaluationRoleArn String
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    encryptionConfiguration Property Map
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name String

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region String
    Region where this resource is managed. Defaults to the Region set in the provider configuration.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Space resource produces the following output properties:

    DomainArn string
    ARN of the domain the space belongs to.
    Id string
    The provider-assigned unique ID for this managed resource.
    SpaceArn string
    ARN of the space.
    SpaceId string
    Unique ID of the space.
    Status string
    Status of the space.
    DomainArn string
    ARN of the domain the space belongs to.
    Id string
    The provider-assigned unique ID for this managed resource.
    SpaceArn string
    ARN of the space.
    SpaceId string
    Unique ID of the space.
    Status string
    Status of the space.
    domain_arn string
    ARN of the domain the space belongs to.
    id string
    The provider-assigned unique ID for this managed resource.
    space_arn string
    ARN of the space.
    space_id string
    Unique ID of the space.
    status string
    Status of the space.
    domainArn String
    ARN of the domain the space belongs to.
    id String
    The provider-assigned unique ID for this managed resource.
    spaceArn String
    ARN of the space.
    spaceId String
    Unique ID of the space.
    status String
    Status of the space.
    domainArn string
    ARN of the domain the space belongs to.
    id string
    The provider-assigned unique ID for this managed resource.
    spaceArn string
    ARN of the space.
    spaceId string
    Unique ID of the space.
    status string
    Status of the space.
    domain_arn str
    ARN of the domain the space belongs to.
    id str
    The provider-assigned unique ID for this managed resource.
    space_arn str
    ARN of the space.
    space_id str
    Unique ID of the space.
    status str
    Status of the space.
    domainArn String
    ARN of the domain the space belongs to.
    id String
    The provider-assigned unique ID for this managed resource.
    spaceArn String
    ARN of the space.
    spaceId String
    Unique ID of the space.
    status String
    Status of the space.

    Look up Existing Space Resource

    Get an existing Space resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SpaceState, opts?: CustomResourceOptions): Space
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        agent_core_evaluation_role_arn: Optional[str] = None,
        data_access_role_arn: Optional[str] = None,
        domain_arn: Optional[str] = None,
        domain_id: Optional[str] = None,
        encryption_configuration: Optional[SpaceEncryptionConfigurationArgs] = None,
        name: Optional[str] = None,
        region: Optional[str] = None,
        space_arn: Optional[str] = None,
        space_id: Optional[str] = None,
        status: Optional[str] = None) -> Space
    func GetSpace(ctx *Context, name string, id IDInput, state *SpaceState, opts ...ResourceOption) (*Space, error)
    public static Space Get(string name, Input<string> id, SpaceState? state, CustomResourceOptions? opts = null)
    public static Space get(String name, Output<String> id, SpaceState state, CustomResourceOptions options)
    resources:  _:    type: aws:cloudwatchomni:Space    get:      id: ${id}
    import {
  to = aws_cloudwatchomni_space.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AgentCoreEvaluationRoleArn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    DataAccessRoleArn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    DomainArn string
    ARN of the domain the space belongs to.
    DomainId string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    EncryptionConfiguration SpaceEncryptionConfiguration
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    Name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    Region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    SpaceArn string
    ARN of the space.
    SpaceId string
    Unique ID of the space.
    Status string
    Status of the space.
    AgentCoreEvaluationRoleArn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    DataAccessRoleArn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    DomainArn string
    ARN of the domain the space belongs to.
    DomainId string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    EncryptionConfiguration SpaceEncryptionConfigurationArgs
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    Name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    Region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    SpaceArn string
    ARN of the space.
    SpaceId string
    Unique ID of the space.
    Status string
    Status of the space.
    agent_core_evaluation_role_arn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    data_access_role_arn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domain_arn string
    ARN of the domain the space belongs to.
    domain_id string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    encryption_configuration object
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    space_arn string
    ARN of the space.
    space_id string
    Unique ID of the space.
    status string
    Status of the space.
    agentCoreEvaluationRoleArn String
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    dataAccessRoleArn String
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domainArn String
    ARN of the domain the space belongs to.
    domainId String
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    encryptionConfiguration SpaceEncryptionConfiguration
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name String

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region String
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    spaceArn String
    ARN of the space.
    spaceId String
    Unique ID of the space.
    status String
    Status of the space.
    agentCoreEvaluationRoleArn string
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    dataAccessRoleArn string
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domainArn string
    ARN of the domain the space belongs to.
    domainId string
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    encryptionConfiguration SpaceEncryptionConfiguration
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name string

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region string
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    spaceArn string
    ARN of the space.
    spaceId string
    Unique ID of the space.
    status string
    Status of the space.
    agent_core_evaluation_role_arn str
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    data_access_role_arn str
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domain_arn str
    ARN of the domain the space belongs to.
    domain_id str
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    encryption_configuration SpaceEncryptionConfigurationArgs
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name str

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region str
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    space_arn str
    ARN of the space.
    space_id str
    Unique ID of the space.
    status str
    Status of the space.
    agentCoreEvaluationRoleArn String
    ARN of the IAM role used by AgentCore online evaluation. Changing this forces a new resource.
    dataAccessRoleArn String
    ARN of the IAM role CloudWatch Omni assumes to access data. Must be in the same account as the space. Changing this forces a new resource.
    domainArn String
    ARN of the domain the space belongs to.
    domainId String
    ID of the CloudWatch Omni domain the space belongs to. Changing this forces a new resource.
    encryptionConfiguration Property Map
    Encryption of the space's data at rest. Omit for AWS owned encryption. See below.
    name String

    Name of the space. Must be 3-64 characters of lowercase letters, numbers and hyphens, must begin and end with a letter or number, and cannot contain consecutive hyphens.

    The following arguments are optional:

    region String
    Region where this resource is managed. Defaults to the Region set in the provider configuration.
    spaceArn String
    ARN of the space.
    spaceId String
    Unique ID of the space.
    status String
    Status of the space.

    Supporting Types

    SpaceEncryptionConfiguration, SpaceEncryptionConfigurationArgs

    EncryptionStrategy string
    Encryption strategy. Valid values are AWS_OWNED and CUSTOMER_MANAGED.
    KmsKeyArn string
    ARN of the KMS key to use. Required when encryptionStrategy is CUSTOMER_MANAGED.
    EncryptionStrategy string
    Encryption strategy. Valid values are AWS_OWNED and CUSTOMER_MANAGED.
    KmsKeyArn string
    ARN of the KMS key to use. Required when encryptionStrategy is CUSTOMER_MANAGED.
    encryption_strategy string
    Encryption strategy. Valid values are AWS_OWNED and CUSTOMER_MANAGED.
    kms_key_arn string
    ARN of the KMS key to use. Required when encryptionStrategy is CUSTOMER_MANAGED.
    encryptionStrategy String
    Encryption strategy. Valid values are AWS_OWNED and CUSTOMER_MANAGED.
    kmsKeyArn String
    ARN of the KMS key to use. Required when encryptionStrategy is CUSTOMER_MANAGED.
    encryptionStrategy string
    Encryption strategy. Valid values are AWS_OWNED and CUSTOMER_MANAGED.
    kmsKeyArn string
    ARN of the KMS key to use. Required when encryptionStrategy is CUSTOMER_MANAGED.
    encryption_strategy str
    Encryption strategy. Valid values are AWS_OWNED and CUSTOMER_MANAGED.
    kms_key_arn str
    ARN of the KMS key to use. Required when encryptionStrategy is CUSTOMER_MANAGED.
    encryptionStrategy String
    Encryption strategy. Valid values are AWS_OWNED and CUSTOMER_MANAGED.
    kmsKeyArn String
    ARN of the KMS key to use. Required when encryptionStrategy is CUSTOMER_MANAGED.

    Import

    Identity Schema

    Required

    • spaceId (String) Space ID.

    Optional

    • accountId (String) AWS Account where this resource is managed.
    • region (String) Region where this resource is managed.

    Using pulumi import, import a CloudWatch Omni Space using the spaceId. For example:

    $ pulumi import aws:cloudwatchomni/space:Space example 12345678-1234-1234-1234-123456789012

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.51.1
    published on Friday, Oct 16, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial