DumbMonit
Monitorare AWS (CloudWatch) con DumbMonit
CloudWatch alarms in the ALARM state, EC2 status checks and CPU, and RDS CPU and free storage.
DocumentazioneSito ufficiale: Amazon CloudWatch
Le descrizioni sono in inglese, come nel prodotto. Le etichette della pagina seguono la tua lingua.
Cosa controlla DumbMonit
The state of an AWS account through CloudWatch: alarms that are firing, EC2 instances failing their status checks or running hot, and RDS databases with a high CPU or little free storage. DumbMonit calls the CloudWatch API of one region (monitoring.<region>.amazonaws.com) with a read-only IAM access key, once a minute: DescribeAlarms for the alarms in the ALARM state, ListMetrics for the EC2 instances and RDS databases that publish metrics, and one GetMetricData request for their last 10 minutes. Requests are signed with AWS Signature Version 4 by DumbMonit itself; no AWS software is needed. Optionally, DumbMonit assumes an IAM role through STS (sts:AssumeRole) and signs with its temporary…
Uso tipico. CloudWatch alarms in ALARM, EC2 status checks and CPU, RDS CPU and free storage
Esempi
- Amazon EC2
- Amazon RDS
- CloudWatch alarms
Come si collega
Cosa serve
- Access keyAccess key ID and secret access key of a read-only IAM user (or of a user allowed to assume a read-only role).
Porte di rete da aprire
443/TCPCloudWatch API (HTTPS, monitoring.<region>.amazonaws.com)443/TCPSTS AssumeRole, only with a role ARN (HTTPS, sts.<region>.amazonaws.com)
Passaggi di configurazione: Create a read-only IAM user for DumbMonit
In the AWS console, open IAM, Policies, Create policy, JSON tab, paste this read-only policy and name it DumbMonitReadOnly.
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["cloudwatch:DescribeAlarms","cloudwatch:ListMetrics","cloudwatch:GetMetricData"],"Resource":"*"}]}Open IAM, Users, Create user: name it dumbmonit, leave console access off, and attach the DumbMonitReadOnly policy.
Open the user, Security credentials, Create access key, choose Application running outside AWS. Copy the access key ID and the secret access key: the secret is shown once.
Optional, to use a role instead: attach the policy to a role that trusts the user, give the user only sts:AssumeRole on that role, and copy the role ARN into the Role ARN option.
In DumbMonit, enter monitoring.<region>.amazonaws.com as the address, paste the key and its secret, and set the same region in the Region option.
Attenzione. Use a dedicated IAM user with only these read permissions, never a key that can change resources. AWS bills GetMetricData per metric requested (USD 0.01 per 1,000): a long check interval keeps the cost low on large accounts.