Set up DESK Managed for AWS monitoring

Create AWS monitoring policy

Choose an access method:

• Key-based access
• Role-based access

Define AWS resource tagging

Go to Identity and Access Management (IAM) in your Amazon Console.

Go to Policies and click Create policy.

Select the JSON tab, and paste the predefined policy from the box below.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "autoscaling:DescribeAutoScalingGroups",
        "cloudwatch:GetMetricData",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeInstances",     
        "ec2:DescribeVolumes",             
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeInstanceHealth",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeRules",
        "elasticloadbalancing:DescribeTargetHealth",
        "rds:DescribeDBInstances",
        "rds:DescribeEvents",
        "rds:ListTagsForResource",
        "dynamodb:ListTables",
        "dynamodb:ListTagsOfResource",
        "lambda:ListFunctions",
        "lambda:ListTags",
        "elasticbeanstalk:DescribeEnvironments",
        "elasticbeanstalk:DescribeEnvironmentResources",
        "s3:ListAllMyBuckets",
        "sts:GetCallerIdentity",
        "cloudformation:ListStackResources",
        "tag:GetResources",
        "tag:GetTagKeys"
      ],
      "Resource": "*"
    }
  ]
}

Give the policy a name. For example DESK_monitoring_policy. Type it in the Name field.

Click the Create policy button.

In your Amazon Console, go to Users and click Add User.

Enter a name for the key you want to create (for example, DESK_monitoring_user). In Select AWS access type, select the Programmatic access option and click Next:Permissions button.

Click Attach existing policies directly and choose the monitoring policy you defined, for example DESK_monitoring_policy. Click Next: Review.

Review the user details and click the Create user button.

Store the Access Key ID name (AKID) and Secret access key values.
You can either download the user credentials or copy the credentials displayed online (click Show).

In DESK, go to Settings > Cloud and virtualization > AWS and click Connect new instance.

Select Key based authentication method.

• Create a name for this connection. This is mandatory. DESK needs this name to identify and display the connection.
• In the Access key ID field, paste the identifier of the key you created in Amazon for DESK access.
• In the Secret access key field, paste the value of the key you created in Amazon for DESK access.
• Click Connect to verify and save the connection.

Once the connection is successfully verified and saved, your AWS account will be listed in the Cloud and virtualization settings page. You should soon begin to see AWS cloud monitoring data.

In your browser, open a new tab and sign in to DESK to get the External Id. Go to Settings > Cloud and virtualization > AWS, click Connect new instance, select Role based authentication method and click Copy next to the Token field.

Go to Identity and Access Management (IAM) in your Amazon Console.

Go to Roles and click Create role.

Select the Another AWS account tile and establish trust with the DESK account.

Paste the 12-digit account ID (hosting the ActiveGate) that is used to access the monitored account.

Select Require external ID option.

Paste the External ID you copied in the first step. Click Next: Permissions.

In the Attach permissions policies section, choose the monitoring policy you created, for example DESK_monitoring_policy. Click Next: Review.

On the Review page, provide the role name, for example DESK_monitoring_role. Remember it, you'll need it later to connect your Amazon account to DESK. Click the Create Role button.

In your Amazon Console, go to Roles, click Create role. Select AWS service and EC2 as the service that will use the role. Click Next: Permissions and skip to the Review page.

On the Review page, provide the role a name, for example DESK_ActiveGate_role and click Create role.

Select DESK_ActiveGate_role and click Add inline policy

Select the JSON and paste the predefined policy from below. Edit it and add:

• The 12-digit monitored account number
• The role name created in previous steps, (for example DESK_monitoring_role), that is used to assume a monitoring role.

Don't include the < and > characters.

If you want to monitor multiple target accounts, add monitoring roles Amazon Resource Names (ARNs) of all monitoring accounts to "Resource" array.

{
    "Statement": [
        {
            "Resource": [
                "arn:aws:iam::<12-digit target account number>:role/<role created in previous step (DESK_monitoring_role)>"
            ],
            "Action": [
                "sts:AssumeRole"
            ],
            "Effect": "Allow"
        }
    ],
    "Version": "2012-10-17"
}

When done, paste Update policy and then click Review policy.

Name the inline policy you've just created, for example DESK_assume_policy and click Create policy.

Go back to the DESK_monitoring_role you created earlier and select Trust relationships tab in the role summary page and click Edit Trust Relationships.

Paste the JSON sample below into a text editor. Edit it and add:

• The 12-digit number of the account hosting the ActiveGate,
• The role with which your Environment ActiveGate or DESK Managed Server was started, and the external ID you copied in previous steps.

Don't include the < and > characters.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<12-digit source account number>:role/<role for your DESK Managed Server (DESK_ActiveGate_role)>"
        ]
      },
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<External ID generated from tenant>"
        }
      }
    }
  ]
}

Paste the modified text and click Update Trust Policy button.

Go to EC2 console, right-click an instance hosting your Environment ActiveGate or DESK Managed Server and select Instance settings > Attach/Replace IAM Role.

Select the role created earlier, DESK_ActiveGate_role, and click Apply.

Edit the custom.properties file of your Environment ActiveGate.

Set the following properties as below:

[vertical.topology]
use_aws_proxy_role = false

[aws_monitoring]
aws_monitoring_enabled = true

If the ActiveGate is dedicated to AWS monitoring, you must also set the MSGrouter property to false:

[collector]
MSGrouter = false

Remove aws_proxy_account and aws_proxy_role properties.

Save the file and restart ActiveGate.

In DESK, go to Settings > Cloud and virtualization > AWS and click Connect new instance.

Select either the Role based authenticationmethod.

• Create a name for this connection. If you leave this field empty, the name Role will be used on DESK pages to define this connection.
• In the Role field, type the name of the role you created in Amazon for DESK, for example DESK_monitoring_role.
• Type your Account ID (the account you want us to pull metrics from).
• Click Connect to verify and save the connection.

Once the connection is successfully verified and saved, your AWS account will be listed in the Cloud and virtualization settings page.
You should soon begin to see AWS cloud monitoring data.