DumbMonit
Monitorar AWS (CloudWatch) com o DumbMonit
CloudWatch alarms in the ALARM state, EC2 status checks and CPU, and RDS CPU and free storage.
DocumentaçãoSite oficial: Amazon CloudWatch
As descrições estão em inglês, como no produto. Os rótulos da página seguem o seu idioma.
O que o DumbMonit vigia
The state of an AWS account through CloudWatch: alarms that are firing, EC2 instances failing their status checks or running hot, and RDS databases with a high CPU or little free storage. DumbMonit calls the CloudWatch API of one region (monitoring.<region>.amazonaws.com) with a read-only IAM access key, once a minute: DescribeAlarms for the alarms in the ALARM state, ListMetrics for the EC2 instances and RDS databases that publish metrics, and one GetMetricData request for their last 10 minutes. Requests are signed with AWS Signature Version 4 by DumbMonit itself; no AWS software is needed. Optionally, DumbMonit assumes an IAM role through STS (sts:AssumeRole) and signs with its temporary…
Uso típico. CloudWatch alarms in ALARM, EC2 status checks and CPU, RDS CPU and free storage
Exemplos
- Amazon EC2
- Amazon RDS
- CloudWatch alarms
Como se conecta
O que você precisa
- Access keyAccess key ID and secret access key of a read-only IAM user (or of a user allowed to assume a read-only role).
Portas de rede a abrir
443/TCPCloudWatch API (HTTPS, monitoring.<region>.amazonaws.com)443/TCPSTS AssumeRole, only with a role ARN (HTTPS, sts.<region>.amazonaws.com)
Etapas de configuração: Create a read-only IAM user for DumbMonit
In the AWS console, open IAM, Policies, Create policy, JSON tab, paste this read-only policy and name it DumbMonitReadOnly.
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["cloudwatch:DescribeAlarms","cloudwatch:ListMetrics","cloudwatch:GetMetricData"],"Resource":"*"}]}Open IAM, Users, Create user: name it dumbmonit, leave console access off, and attach the DumbMonitReadOnly policy.
Open the user, Security credentials, Create access key, choose Application running outside AWS. Copy the access key ID and the secret access key: the secret is shown once.
Optional, to use a role instead: attach the policy to a role that trusts the user, give the user only sts:AssumeRole on that role, and copy the role ARN into the Role ARN option.
In DumbMonit, enter monitoring.<region>.amazonaws.com as the address, paste the key and its secret, and set the same region in the Region option.
Atenção. Use a dedicated IAM user with only these read permissions, never a key that can change resources. AWS bills GetMetricData per metric requested (USD 0.01 per 1,000): a long check interval keeps the cost low on large accounts.