Requirement
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane on the left, choose Roles, Create role.
For Choose the service that will use this role, choose EC2 Allows EC2 instances to call AWS services on your behalf. Choose Next: Permissions.
In the list of policies, select the check box next to CloudWatchAgentServerPolicy. Use the search box to find the policy, if necessary.
If you will use SSM to install or configure the CloudWatch agent, select the check box next to AmazonEC2RoleforSSM. Use the search box to find the policy, if necessary. This policy is not necessary if you will start and configure the agent only through the command line.
Choose Next: Review
Confirm that CloudWatchAgentServerPolicy and optionally AmazonEC2RoleforSSM appear next to Policies. In Role name, type a name for the role, such as CloudWatchAgentServerRole. Optionally give it a description, and choose Create role.
The role is now created.
The following procedure creates the IAM role that can also write to Parameter Store. You need to use this role if you are going to store the agent configuration file in Parameter Store so that other servers can use it.
To create the IAM role necessary for an administrator to save an agent configuration file to Systems Manager Parameter Store
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane on the left, choose Roles, Create role.
For Choose the service that will use this role, choose EC2 Allows EC2 instances to call AWS services on your behalf. Choose Next: Permissions.
In the list of policies, select the check box next to CloudWatchAgentAdminPolicy. Use the search box to find the policy, if necessary.
If you will use SSM to install or configure the CloudWatch agent, select the check box next to AmazonEC2RoleforSSM. Use the search box to find the policy, if necessary. This policy is not necessary if you will start and configure the agent only through the command line.
Choose Next: Review
Confirm that CloudWatchAgentAdminPolicy and optionally AmazonEC2RoleforSSM appear next to Policies. In Role name, type a name for the role, such as CloudWatchAgentAdminRole. Optionally give it a description, and choose Create role.
The role is now created.
- IAM Roles for the Instance to run with AmazonSSMFullAccess
- AWS System Manager, AmazonEC2RoleforSSM Policy attached to your user
- Install or Update the SSM Agent
- AWS CloudWatch Agent
- Your AWS Instance must have internet access or direct access to CloudWatch so the data can be pushed to CloudWatch
Create IAM Roles to Use with CloudWatch Agent on Amazon EC2 Instances
The first procedure creates the IAM role that you need to attach to each Amazon EC2 instance that runs the CloudWatch agent. This role provides permissions for reading information from the instance and writing it to CloudWatch.
The second procedure creates the IAM role that you need to attach to the Amazon EC2 instance being used to create the CloudWatch agent configuration file, if you are going to store this file in Systems Manager Parameter Store so that other servers can use it. This role provides permissions for writing to Parameter Store, in addition to the permissions for reading information from the instance and writing it to CloudWatch. This role includes permissions sufficient to run the CloudWatch agent as well as to write to Parameter Store.
To create the IAM role necessary for each server to run CloudWatch agent
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane on the left, choose Roles, Create role.
For Choose the service that will use this role, choose EC2 Allows EC2 instances to call AWS services on your behalf. Choose Next: Permissions.
In the list of policies, select the check box next to CloudWatchAgentServerPolicy. Use the search box to find the policy, if necessary.
If you will use SSM to install or configure the CloudWatch agent, select the check box next to AmazonEC2RoleforSSM. Use the search box to find the policy, if necessary. This policy is not necessary if you will start and configure the agent only through the command line.
Choose Next: Review
Confirm that CloudWatchAgentServerPolicy and optionally AmazonEC2RoleforSSM appear next to Policies. In Role name, type a name for the role, such as CloudWatchAgentServerRole. Optionally give it a description, and choose Create role.
The role is now created.
The following procedure creates the IAM role that can also write to Parameter Store. You need to use this role if you are going to store the agent configuration file in Parameter Store so that other servers can use it.
To create the IAM role necessary for an administrator to save an agent configuration file to Systems Manager Parameter Store
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane on the left, choose Roles, Create role.
For Choose the service that will use this role, choose EC2 Allows EC2 instances to call AWS services on your behalf. Choose Next: Permissions.
In the list of policies, select the check box next to CloudWatchAgentAdminPolicy. Use the search box to find the policy, if necessary.
If you will use SSM to install or configure the CloudWatch agent, select the check box next to AmazonEC2RoleforSSM. Use the search box to find the policy, if necessary. This policy is not necessary if you will start and configure the agent only through the command line.
Choose Next: Review
Confirm that CloudWatchAgentAdminPolicy and optionally AmazonEC2RoleforSSM appear next to Policies. In Role name, type a name for the role, such as CloudWatchAgentAdminRole. Optionally give it a description, and choose Create role.
The role is now created.
Install or Update the SSM Agent
Before you can use Systems Manager to install the CloudWatch agent, you must make sure that the instance is configured correctly for Systems Manager.
SSM Agent is installed, by default, on Amazon Linux base AMIs dated 2017.09 and later. SSM Agent is also installed, by default, on Amazon Linux 2 and Ubuntu Server 18.04 LTS AMIs. Here is the documentation to install the agent on various version.
Attach an IAM Role to the Instance
An IAM role for the instance profile is required when you install the CloudWatch agent on an Amazon EC2 instance. This role enables the CloudWatch agent to perform actions on the instance. Use one of the roles you created earlier.
If you are going to use this instance to create the CloudWatch agent configuration file and copy it to Systems Manager Parameter Store, use the role you created that has permissions to write to Parameter Store. This role may be called CloudWatchAgentAdminRole.
For all other instances, select the role that includes just the permissions needed to install and run the agent. This role may be called CloudWatchAgentServerRole.
Installing CloudWatch Agent on your Linux Instances
Installing CloudWatch Agent on your Linux Instances
- Navigate to your EC2 section
- In the navigation pane, choose Run Command.
- In the Command document list, choose AWS-ConfigureAWSPackage
- In the Targets area, choose the instance or multiple instances on which to install the CloudWatch agent. If you do not see a specific instance, it might not be configured for Run Command.
- In the Action list, choose Install.
- In the Name field, type AmazonCloudWatchAgent.
- Leave Version set to latest to install the latest version of the agent.
- Choose Run.
- Optionally, in the Targets and outputs areas, select the button next to an instance name and choose View output. Systems Manager should show that the agent was successfully installed.
Optionally You can use an Amazon S3 download link to download the CloudWatch agent package on an Amazon EC2 instance server.
To use the command line to install the CloudWatch agent on an Amazon EC2 instance
Download the CloudWatch agent. For a Linux server, type the following:
wget https://s3.amazonaws.com/amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip
Unzip the package.
unzip AmazonCloudWatchAgent.zip
Install the package. On a Linux server, change to the directory containing the package and type:
sudo ./install.sh
Create the CloudWatch Agent Configuration File with the Wizard
Start the CloudWatch agent configuration wizard by typing the following:
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard
If you are going to use Systems Manager to install and configure the agent, be sure to answer Yes when prompted whether to store the file in Systems Manager Parameter Store. You can also choose to store the file in Parameter Store even if you aren't using the SSM Agent to install the CloudWatch agent. To be able to store the file in Parameter Store, you must use an IAM role with sufficient permissions. For more information, see Create IAM Roles and Users for Use With CloudWatch Agent.
Deploying CloudWatch Configuration File
We will now deploy cloud watch configuration to the client (the instances which we need to monitor)
- In the navigation pane, choose Run Command.
- Click on Run Command once the page loads up
- In the Command document list, choose AmazonCloudWatch-ManageAgent
- In the Targets area, choose the instance or multiple instances on which you want to deploy CloudWatch Configuration on
- Under Action select configure
- Under Mode leave it as ec2
- Change the Optional Configuration Source to ssm
- Under Optional Configuration Location enter the exact same name of the parameter you created in the Parameter Store (previous section). In this example, the parameter is called CloudWatchLinux
- Optional Restart should be set to Yes (This will restart the CloudWatch agent, not the instance)
- Now click on Run
Now go to Cloudwatch and you would start receiving custom metrics that you defined in CloudWatch Configuration.
No comments:
Post a Comment