Signing in
Validate & Save says the key or role can't read CloudWatch
CloudPeek checks it can read CloudWatch before it saves an account. Make sure the CloudPeekReadOnly policy (or CloudWatchReadOnlyAccess) is attached to the user, or is in the permission set you chose. See Give CloudPeek read-only access.
The access key is rejected
Check you copied the whole secret, which is shown only once when the key is created. If you've lost it, create a new key for the user and delete the old one. For temporary credentials, include the session token too: Paste credentials block picks all three up from a profile, export AWS_… lines or the CLI's JSON.
IAM Identity Center doesn't list my account or role
The permission set must be assigned to you, directly or through a group, in that account. If you added the assignment a moment ago, wait a minute and sign in again.
A widget says “Sign-in expired”
IAM Identity Center sessions end at your organisation's session limit. Tap the widget, or Sign In Again in the app: it's pre-filled, and your pinned widgets carry on as they were.
What a widget is telling you
When a refresh fails, a widget keeps its last data and says why, with the time of that data.
| Message | What to do |
|---|---|
| Sign-in expired | Sign in again in the app. Pinned widgets don't need to change. |
| Access denied | The sign-in is missing a permission. Alarm widgets need cloudwatch:DescribeAlarms; everything else needs GetDashboard and GetMetricData. Check the policy, and that you pinned from the right account. |
| Couldn't connect | No network, or AWS didn't answer. It tries again within 10 minutes. |
| Dashboard deleted | The dashboard it was pinned from no longer exists, or was renamed. Pin the widget again from its new dashboard. |
| Account not added | The account the widget was pinned from has been removed from CloudPeek. Add it again, or pin a widget from another account. |
| No data for this time range. | CloudWatch has no points for these metrics in the widget's window. Check the dimensions and region, or widen the range with start. |
| Will refresh once your device is unlocked. | Your iPhone has restarted and hasn't been unlocked yet, so credentials can't be read. Unlock it. |
| … widgets aren't supported yet. | Logs Insights, Metrics Explorer and custom (Lambda) widgets can't be shown yet. Pin a metric widget instead. |
A widget looks faded
Its data is more than a day old. The message under it says why it hasn't refreshed.
Widgets don't refresh exactly on time
iOS decides when widgets refresh, and spreads refreshes out on a busy day or in Low Power Mode. Your interval in Settings is a guide. Tap a widget's refresh button, or open the app, to refresh now.
Missing or unexpected data
A dashboard change isn't showing
Widgets read the dashboard each time they refresh from AWS, but reuse anything loaded in the last five minutes. Tap the widget's refresh button to fetch it now. Check you saved the dashboard in the console, or that your deploy finished.
A widget isn't following a change to its dashboard
Pins follow a widget that's moved, resized, retitled or edited. If a dashboard changes so much at once that CloudPeek can't tell which widget a pin was, it keeps showing the version you pinned. Open the dashboard in the app and pin the widget again: Home Screen widgets that showed it reconnect.
The numbers don't match the console
Check the time window under the widget. CloudPeek uses the widget's start, then the dashboard's, then the last 3 hours, and may raise the period for long ranges, as the console does. The widget reference has the rules.
Billing widgets are empty
Billing metrics only exist in us-east-1, and only after Receive CloudWatch billing alerts is turned on. See the spend guide.
An alarm shows a question mark
It has too little data yet, or CloudPeek couldn't find it. See the alarms guide.
Metrics from another account are missing
A metric with an accountId needs CloudWatch cross-account observability between the two accounts. Alarms are only looked up in the account you pinned from.
CloudFormation and Terraform
CloudFormation: “Unresolved resource dependencies” or a variable it doesn't recognise
Inside !Sub, every ${…} is read as a CloudFormation variable, including CloudWatch dynamic labels. Write ${PROP('Dim.ServiceName')} as ${!PROP('Dim.ServiceName')}.
CloudFormation: “Requires capabilities: [CAPABILITY_NAMED_IAM]”
The templates create IAM resources with names you chose. Add --capabilities CAPABILITY_NAMED_IAM, or tick the acknowledgement in the console.
Terraform: an error pointing at a ${…} in a dashboard label
Terraform reads ${…} in a string as an interpolation. Write a CloudWatch dynamic label as $${PROP('Dim.ServiceName')}.
The dashboard is invalid after a deploy
CloudWatch checks the JSON when you deploy. Paste the body into Actions › View/edit source in the console, which points at the problem, then copy the fix back into your code. In Terraform, jsonencode always produces valid JSON, so look for a wrong property name or value.
Deleting the stack, or terraform destroy, fails on the user or policy
IAM won't delete a user that still has an access key, or a policy that's attached outside the stack. Delete the key and detach the policy from any permission sets first. See Removing it.
Console changes disappeared
If the dashboard is managed by CloudFormation or Terraform, the next deploy replaces it with what's in your code. Copy changes you like from Actions › View/edit source into the code. See Manage it as code.
Still stuck?
Email support@cloudpeek.app with what the widget says and which guide you followed. Never send us your secret access key.