DumbMonit
Monitor AWS (CloudWatch) with DumbMonit
CloudWatch alarms in the ALARM state, EC2 status checks and CPU, and RDS CPU and free storage.
DocumentationOfficial website: Amazon CloudWatch
Product descriptions are in English, as in the product. The page labels follow your language.
What DumbMonit watches
The state of an AWS account through CloudWatch: alarms that are firing, EC2 instances failing their status checks or running hot, and RDS databases with a high CPU or little free storage. DumbMonit calls the CloudWatch API of one region (monitoring.<region>.amazonaws.com) with a read-only IAM access key, once a minute: DescribeAlarms for the alarms in the ALARM state, ListMetrics for the EC2 instances and RDS databases that publish metrics, and one GetMetricData request for their last 10 minutes. Requests are signed with AWS Signature Version 4 by DumbMonit itself; no AWS software is needed. Optionally, DumbMonit assumes an IAM role through STS (sts:AssumeRole) and signs with its temporary…
Typical use. CloudWatch alarms in ALARM, EC2 status checks and CPU, RDS CPU and free storage
Examples
- Amazon EC2
- Amazon RDS
- CloudWatch alarms
How it connects
What you need
- Access keyAccess key ID and secret access key of a read-only IAM user (or of a user allowed to assume a read-only role).
Network ports to open
443/TCPCloudWatch API (HTTPS, monitoring.<region>.amazonaws.com)443/TCPSTS AssumeRole, only with a role ARN (HTTPS, sts.<region>.amazonaws.com)
Setup steps: Create a read-only IAM user for DumbMonit
In the AWS console, open IAM, Policies, Create policy, JSON tab, paste this read-only policy and name it DumbMonitReadOnly.
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["cloudwatch:DescribeAlarms","cloudwatch:ListMetrics","cloudwatch:GetMetricData"],"Resource":"*"}]}Open IAM, Users, Create user: name it dumbmonit, leave console access off, and attach the DumbMonitReadOnly policy.
Open the user, Security credentials, Create access key, choose Application running outside AWS. Copy the access key ID and the secret access key: the secret is shown once.
Optional, to use a role instead: attach the policy to a role that trusts the user, give the user only sts:AssumeRole on that role, and copy the role ARN into the Role ARN option.
In DumbMonit, enter monitoring.<region>.amazonaws.com as the address, paste the key and its secret, and set the same region in the Region option.
Heads-up. Use a dedicated IAM user with only these read permissions, never a key that can change resources. AWS bills GetMetricData per metric requested (USD 0.01 per 1,000): a long check interval keeps the cost low on large accounts.