...
In the account where the services are running whose metrics need to be captured, an IAM scraper role needs to be created which has the following policy attached to it for kloudfuse to scrape the additional labels from AWS. Refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html for assistance.
| Code Block |
|---|
"Action": [ "acm:ListCertificates", "acm:ListTagsForCertificate", "apigateway:GET", "athena:ListWorkGroups", "athena:ListTagsForResource", "autoscaling:DescribeAutoScalingGroups", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:ListTagsOfResource", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeSecurityGroups", "ec2:DescribeNatGateways", "ec2:DescribeVolumes", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:ListTagsForResource", "elasticache:DescribeCacheClusters", "elasticache:ListTagsForResource", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeBackupPolicy", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeLoadBalancers", "es:ListDomainNames", "es:DescribeDomains", "es:ListTags", "events:ListRules", "events:ListTagsForResource", "events:ListEventBuses", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "glue:ListJobs", "glue:GetTags", "kafka:ListTagsForResource", "kafka:ListClustersV2", "kinesis:ListStreams", "kinesis:ListTagsForStream", "kinesis:DescribeStream", "lambda:GetPolicy", "lambda:List*", "lambda:ListTags", "logs:DescribeLogGroups", "logs:ListTagsLogGroup" "mq:ListBrokers", "mq:DescribeBroker", "rds:DescribeDBInstances", "rds:ListTagsForResource", "rds:DescribeEvents", "redshift:DescribeClusters", "redshift:DescribeTags", "route53:ListHealthChecks", "route53:ListTagsForResource", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "sns:ListTagsForResource", "sns:ListTopics", "sqs:ListQueues", "sqs:ListQueueTags", "wafv2:ListWebACLs", "wafv2:ListRuleGroups", "wafv2:ListTagsForResource" ] |
Please make sure the permissions mapped to the correct nodepool being used for EKS cluster where Kloudfuse is hosted.
Step 3
...
:
...
Follow the instructions on the AWS page to create an IAM policy: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html
...
Use one of the following options for kfuse to consume the
...
role created above
Option 1: Add your AWS credentials as a secret and use the secret in the ingester config.
...