## All available configuration options, their descriptions, and defaults:
## https://github.com/netdata/netdata/tree/master/src/go/plugin/go.d/collector/cloudwatch#readme
##
## Profile files:
##   stock: /usr/lib/netdata/conf.d/go.d/cloudwatch.profiles/default/
##   user:  /etc/netdata/go.d/cloudwatch.profiles/
## Format:
##   https://github.com/netdata/netdata/blob/master/src/go/plugin/go.d/collector/cloudwatch/profile-format.md
## A user profile overrides a stock profile with the same basename. Restart go.d
## after changing profiles because the catalog is cached process-wide.
##
## Required IAM permissions:
##   cloudwatch:GetMetricData
##   cloudwatch:ListMetrics when any selected profile has identifying dimensions
## Profiles whose dimensions are all constants are queried directly. For example,
## a billing_total-only job does not call ListMetrics; the other Billing grains do.
## The collector calls STS GetCallerIdentity for account attribution, but AWS
## does not require an explicit permission grant for that operation.
##   plus sts:AssumeRole for targets with assume_role
##   plus tag:GetResources when resource tag filters or labels are configured
##
## Configuration model:
##   credentials - named AWS SDK default-chain or static/session sources
##   targets     - up to 64 named monitored identities, optionally assuming one role
##   rules       - ordered target/profile/metric/region selections
##   rule_defaults - job-wide filters and query timing inherited by rules
##   labels      - optional AWS tags copied to non-identity chart labels
##   limits      - final-instance safety bounds
##
## Rule order, then target order within each rule, defines overlap ownership: the
## first matching rule/target owns each overlapping exported metric/statistic series.
## Omitting profiles selects all default-enabled profiles.
## Set profiles.defaults to false and list profiles.include to select only named
## profiles. profiles.exclude removes profiles from the selected set.
## Omit metrics to collect each selected profile's default-enabled metrics. A
## metrics entry changes only its named profile; unmentioned profiles keep their
## defaults. The entry keeps profile defaults unless defaults is false, then adds
## its exact included MetricNames. This is how stock opt-in metrics are enabled
## without copying a profile. Metric statistics override group statistics; when
## both are omitted, the profile declaration is inherited. Named AWS statistics
## are case-insensitive.
## A rule inherits rule_defaults.filters.resource_tags when it omits
## filters.resource_tags. A non-empty rule list replaces the default; [] disables
## it. Tag keys and values are exact and case-sensitive. All keys are ANDed; values
## for one key are ORed.
## Query timing resolves field-by-field from the most specific job metric item,
## its enclosing job metric group, rules[].query, rule_defaults.query,
## profile-catalog metrics[].query, profile-catalog query defaults, and the
## built-in 10m publication delay. A metric-group query applies only to series
## expanded from its include list; unlisted defaults keep the rule/profile policy.
## Profiles use one nested query object; profile query.period is required.
## period is 1m..1d in whole-minute steps; lookback must be at least period and
## an exact period multiple. Do not set period below the metric's real publication
## cadence: it can add billed queries and produce empty windows. All policies are
## evaluated on the shared update_every ticks; period remains the CloudWatch
## aggregation/rate divisor, but period < update_every skips intermediate eligible
## windows instead of creating an independent timer. A successful sparse query can
## replay its newest eligible value for up to lookback; transient AWS failures can
## replay it longer. Transient retries start after one update_every, then double
## within the same eligible window up to period; a new window resets the backoff.
## Retry calls are billable.
## Query-plan preflight rejects more than 20000 selected series, 600000 all-due
## datapoints, or 40 packed GetMetricData requests before allocating AWS query
## structures. Up to five statistics for one metric stay in one billing request.
## A rule_defaults.query.publication_delay value replaces profile-specific delays
## for every inheriting rule, including the stock S3 storage profile's conservative
## 1d collector policy. AWS documents that S3 storage metrics are reported once
## per day, but does not guarantee publication within one day. Use a shorter
## job-wide value only after verifying publication timing.
##
## limits.max_instances counts final static and discovered instances that emit a
## selected series. limits.max_discovery_groups defaults to 64 unique
## (target, region, namespace)
## groups per job. Compatible rules/profiles share a group. Raise the safeguard
## only for intentional scale (maximum 100). Split larger collection across jobs.
## Omitting limits.max_instances, limits.max_discovery_groups, or
## discovery.refresh_every selects its default (1000, 64, and 300); writing 0
## selects the same default. A 0 does not mean "unlimited" or "never", so raise a
## bound by writing the larger number. A negative value is rejected.
## Each discovery group also has fixed safeguards: 100 pages, 50000 scanned
## metrics, 1000000 residual same-shape profile matches, and 20000 candidates.
## One refresh additionally admits at most 100 ListMetrics SDK operations, 50000
## scanned metrics, 1000000 residual matches, 20000 retained candidates, and 64 MiB
## of weighted candidate storage. Every non-skipped group that resolves a client
## gets its first admitted operation before continuations share the remainder;
## skipped groups and client-resolution failures consume no operation budget.
## Successful replacements and failed-group carry-forward are rechecked together
## against the candidate and storage bounds before installation. The AWS SDK can
## retry each admitted operation up to five wire attempts. Discovery shares one
## timeout across the whole refresh.
##
## Secret fields support go.d secret references. Prefer ${env:...}, ${file:...},
## ${cmd:...}, or ${store:...}; do not put plaintext credentials in this file.

#jobs:
#  - name: default_credentials
#    credentials:
#      - name: sdk_default
#        type: default
#    targets:
#      - name: base
#        credentials: sdk_default
#    rules:
#      - name: base-defaults
#        targets: [base]
#        regions: [us-east-1]
#        query:
#          period: 5m
#          lookback: 30m
#          publication_delay: 10m
#
#  - name: static_credentials_and_roles
#    credentials:
#      - name: bootstrap
#        type: static
#        type_static:
#          access_key_id: ${env:AWS_ACCESS_KEY_ID}
#          secret_access_key: ${env:AWS_SECRET_ACCESS_KEY}
#          session_token: ${env:AWS_SESSION_TOKEN}  # optional
#    targets:
#      - name: production
#        credentials: bootstrap
#        assume_role:
#          role_arn: "arn:aws:iam::[ACCOUNT]:role/[ROLE]"
#          # Set only when the role owner's trust policy requires it. The role
#          # owner supplies this value; it is not an AWS password or access key.
#          external_id: ${env:AWS_EXTERNAL_ID}
#      - name: staging
#        credentials: bootstrap
#        assume_role:
#          role_arn: "arn:aws:iam::[ACCOUNT]:role/[ROLE]"
#    rules:
#      - name: production-defaults
#        targets: [production]
#        regions: [us-east-1, eu-west-1]
#      - name: staging-core-services
#        targets: [staging]
#        profiles:
#          defaults: false
#          include: [ec2, lambda]
#        metrics:
#          - profile: ec2
#            defaults: false
#            statistics: [Average]
#            include:
#              - name: CPUUtilization
#          - profile: lambda
#            defaults: false
#            query:
#              period: 5m
#              lookback: 15m
#              publication_delay: 10m
#            include:
#              - name: Invocations
#                statistics: [Sum]
#              - name: Errors
#                statistics: [Sum]
#              - name: Duration
#                statistics: [p90]
#                query:
#                  period: 1m
#                  lookback: 5m
#                  publication_delay: 5m
#        regions: [us-east-1]
#
#  - name: resource_tag_filtering_and_labels
#    credentials:
#      - name: sdk_default
#        type: default
#    targets:
#      - name: base
#        credentials: sdk_default
#    rule_defaults:
#      filters:
#        resource_tags:
#          - key: managed-by
#            values: [platform]
#    rules:
#      - name: production-defaults
#        targets: [base]
#        regions: [us-east-1]
#      - name: unfiltered-cloudfront
#        targets: [base]
#        profiles:
#          defaults: false
#          include: [cloudfront]
#        regions: [us-east-1]
#        filters:
#          resource_tags: []  # explicitly disable the inherited default
#    labels:
#      resource_tags:
#        - key: Name                 # AWS Name tag -> label name
#        - key: owner                # -> label owner
#        - key: region               # avoid built-in region label collision
#          label: aws_region
#    limits:
#      max_instances: 1000
#      max_discovery_groups: 64
#
#  - name: billing_estimated_charges
#    credentials:
#      - name: sdk_default
#        type: default
#    targets:
#      - name: billing
#        credentials: sdk_default
#    rules:
#      - name: billing-grains
#        targets: [billing]
#        profiles:
#          defaults: false
#          include:
#            - billing_total
#            - billing_service
#            - billing_linked_account
#            - billing_linked_account_service
#        regions: [us-east-1]
#        filters:
#          # Billing dimensions are not Resource Groups Tagging API resources.
#          # Clear an inherited rule-default filter explicitly.
#          resource_tags: []
#        # The stock Billing profiles use period 10m and lookback 24h. A rule
#        # query block overrides only the fields it sets, for example:
#        # query:
#        #   lookback: 48h