...

CloudWatch Metrics

Setup AWS Kinesis Firehose

In the account that emits the metrics, in the Kinesis Firehose AWS console, create a new delivery stream.

...

1. Select Direct PUT as the source

2. Select HTTP Endpoint as the destination

3. In the destination settings, use the external facing endpoint of the Kfuse cluster and provide the following URL. https://<external facing endpoint of Kfuse cluster>/ingester/kinesis/metrics

4. Optionally use the “access token key” if needed.

5. In the Content encoding section, select GZIP

6. Provide an existing S3 bucket or create a new one for storing Kinesis records as a backup. The default of only backing up failed data should suffice.

7. Change the name of the stream if necessary.

Setup AWS CloudWatch Metrics Stream

In the account that emits the metrics, in the Cloudwatch AWS console, in the Metrics section on the left side of the console, select Streams and create a metric stream

1. Select the metric namespaces to send to the stream (default is all metrics)

2. In the configuration section, Select an existing Firehose owned by your account and select the previously created Kinesis Firehose.

3. Under Change Output Format Make sure to select JSON for the output format. Kfuse currently only supports JSON format.

4. Change the name of the stream if necessary.

Enable AutoScaling Group Metrics

In the account that emits the metrics,

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/, and choose Auto Scaling Groups from the navigation pane.

2. Select the check box next to your Auto Scaling group.

3. A split pane opens up at the bottom of the page.

4. On the Monitoring tab, select the Auto Scaling group metrics collection, Enable the check box located at the top of the page under Auto Scaling.

Enable Collection of Request Metrics in S3

In the account that emits the metrics, follow the instructions to enable the collection of request metrics for S3: https://docs.aws.amazon.com/AmazonS3/latest/userguide/configure-request-metrics-bucket.html.

Enable Enrichment of AWS Metrics

The metrics sent by AWS CloudWatch to the Kinesis Firehose only include minimal labels. Kloudfuse supports attaching more labels (and also user-defined custom tags from the AWS console) to the ingested metrics. This is done by scraping AWS.

To enable enrichment of AWS metrics, follow these steps:

Step1: Modify yaml

Add the following configuration in the global section of the custom values.yaml

global:
  enrichmentEnabled:
    - aws

Step2: Create IAM scraper role in AWS account where the services are running.

In the account where the services are running whose metrics need to be captured, an IAM scraper role needs to be created which has the following policy attached to it for kloudfuse to scrape the additional labels from AWS. Refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html for assistance.

			"Action": [
				"autoscaling:DescribeAutoScalingGroups",
				"acm:ListCertificates",
				"acm:ListTagsForCertificate",
				"apigateway:GET",
				"athena:ListWorkGroups",
				"athena:ListTagsForResource",
				"autoscaling:DescribeAutoScalingGroups",
				"cloudwatch:ListMetrics",
				"cloudwatch:GetMetricStatistics",
				"dynamodb:ListTables",
				"dynamodb:DescribeTable",
				"dynamodb:ListTagsOfResource",
				"ec2:DescribeInstances",
				"ec2:DescribeInstanceStatus",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeNatGateways",
				"ec2:DescribeVolumes",
				"ecs:ListClusters",
				"ecs:ListContainerInstances",
				"ecs:ListServices",
				"ecs:DescribeContainerInstances",
				"ecs:DescribeServices",
				"ecs:ListTagsForResource",
				"elasticache:DescribeCacheClusters",
				"elasticache:ListTagsForResource",
				"elasticfilesystem:DescribeFileSystems",
				"elasticfilesystem:DescribeBackupPolicy",
				"elasticloadbalancing:DescribeTags",
				"elasticloadbalancing:DescribeLoadBalancers",
				"es:ListDomainNames",
				"es:DescribeDomains",
				"es:ListTags",
				"events:ListRules",
				"events:ListTagsForResource",
				"events:ListEventBuses",
				"firehose:DescribeDeliveryStream",
				"firehose:ListDeliveryStreams",
				"firehose:ListTagsForDeliveryStream",
				"fsx:DescribeFileSystems",
				"fsx:ListTagsForResource",
				"glue:ListJobs",
				"glue:GetTags",
				"kafka:ListTagsForResource",
				"kafka:ListClustersV2",
				"kinesis:ListStreams",
				"kinesis:ListTagsForStream",
				"kinesis:DescribeStream",
				"lambda:GetPolicy",
				"lambda:List*",
				"lambda:ListTags",
				"logs:DescribeLogGroups",
				"logs:ListTagsLogGroupListTagsForResource",
				"mq:ListBrokers",
				"mq:DescribeBroker",
				"rds:DescribeDBInstances",
				"rds:ListTagsForResource",
				"rds:DescribeEvents",
				"redshift:DescribeClusters",
				"redshift:DescribeTags",
				"route53:ListHealthChecks",
				"route53:ListTagsForResource",
				"s3:ListAllMyBuckets",
				"s3:GetBucketTagging",
				"sns:ListTagsForResource",
				"sns:ListTopics",
				"sqs:ListQueues",
				"sqs:ListQueueTags",
				"wafv2:ListWebACLs",
				"wafv2:ListRuleGroups",
				"wafv2:ListTagsForResource"
			]

...

Step 3: Use one of the following options for kfuse to consume the role created above

Option 1: Add your AWS credentials as a secret and use the secret in the ingester config.

You can retrieve your aws credentials required for the next step here.

...

helm upgrade --create-namespace --install kfuse . -f <custom_values.yaml>

Option 2: Add Role ARNs in the ingester config.

With this option, Kfuse can be configured to scrape multiple AWS accounts.

...

ingester:
  config:
    awsRoleArns:
      - role: <ADD ROLE ARN HERE>
        namespaces:
          - <add namespace>
        regions:
          - <add region>

Step4: Modify the node-group IAM role on which kloudfuse is running

The node-group (Node IAM Role ARN), in which Kloudfuse is running on, also needs to have the following permissions policy to assume the role.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": <REPLACE SCRAPER ROLE ARN HERE>
        } 
    ]
}

Step5: Helm Upgrade

Do a helm upgrade for changes to take affect

helm upgrade --create-namespace --install kfuse . -f <custom_values.yaml>

CloudWatch Logs

Setup AWS Kinesis Firehose

In the account that emits the logs, in the Kinesis Firehose AWS console, create another Firehose delivery stream for logs.

...

1. Select Direct PUT as the source

2. Select HTTP Endpoint as the destination

3. In the destination settings, use the external facing endpoint of the Kfuse cluster and provide the following URL. https://<external facing endpoint of Kfuse cluster>/ingester/kinesis/logs

4. Optionally use the “access token key” if needed

5. In the Content encoding section, select GZIP

6. Provide an existing S3 bucket or create a new one for storing Kinesis records as a backup. The default of only backing up failed data should suffice.

Create IAM Role to allow CloudWatch Logs to write to Kinesis Firehose

In the account that emits the logs, in the IAM AWS Console, under Roles, select Create Role

1. Select Custom Trust Policy and Add the following (replace the region and AWS account accordingly):

   Code Block
   { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "logs.<region>.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringLike": { "aws:SourceArn": "arn:aws:logs:<region>:<aws account number>:*" } } } ] }

2. Click Next to go to Add Permissions page and select Create Policy (This will open a new window).

3. Select JSON and add the following (Note the following allows all firehose in the same account. Adjust accordingly if only adding permission to a specific firehose):

   Code Block
   { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "firehose:*" ], "Resource": [ "arn:aws:firehose:<region>:<aws account number>:*" ] } ] }

4. Go back to the roles page and select the created permissions policy. Click “Create Role”.

5. Name and create the new role.

Setup CloudWatch logs subscriptions

In the account that emits the logs, in the Cloudwatch AWS console, perform these steps:

1. Navigate to the Logs section on the left side of the console, and select Log Groups.

2. Go to the Log group that will be sent to the Kinesis Firehose.

3. Go to Actions → Subscription Filters → Create Kinesis Firehose subscription filter

4. In the Kinesis Firehose delivery stream section, select the previously created Kinesis Firehose for Logs.

5. In the Grant Permission section, select the previously created role.

6. Provide a Subscription filter pattern (or leave it blank if streaming everything)

7. Provide Subscription filter name (required step, can be anything)

8. Select Start Streaming

Enable Enrichment of AWS Logs

In the account where you installed Klouduse to capture the logs, perform these steps.

...

To enable log enrichment, follow the same steps as enrichment for metrics, and add the following permissions:

...

Also, specify the AWS/Logs namespace in the ingester config.

Cloudtrail events as logs

• There is an option to get the Cloudtrail events as logs and ingested by Kloudfuse. Please refer to https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html and you can add a CloudWatch logs subscription for the log group as described above.

Supported AWS Component

AWS Namespaces

See also Collecting AWS Events with EventBridge.