Set up DESK SaaS for AWS monitoring

In your browser, open a new tab and sign in to DESK to get the External Id. Go to Settings > Cloud and virtualization > AWS, click Connect new instance, select Role based authentication method and click Copy next to the Token field.

Go to Identity and Access Management (IAM) in your Amazon Console.

Go to Roles and click Create role

Select the Another AWS account tile and establish trust with the DESK account.

Paste the 12-digit account ID (hosting the ActiveGate) that is used to access the monitored account.

Select Require external ID option.

Paste the External ID you copied in the first step. Click Next: Permissions.

In the Attach permissions policies section, choose the monitoring policy you created, for example DESK_monitoring_policy. Click Next: Review.

On the Review page, provide the role name, for example DESK_monitoring_role. Remember it, you'll need it later to connect your Amazon account to DESK. Click the Create Role button.

In your Amazon Console, go to Roles, click Create role. Select AWS service and EC2 as the service that will use the role. Click Next: Permissions and skip to the Review page.

On the Review page, provide the role a name, for example DESK_ActiveGate_role and click Create role.

Select DESK_ActiveGate_role and click Add inline policy

Select the JSON and paste the predefined policy from below. Edit it and add:

• The 12-digit monitored account number,
• The role name created in previous steps, (for example DESK_monitoring_role), that is used to assume a monitoring role.

Don't include the < and > characters.

If you want to monitor multiple target accounts, add monitoring roles Amazon Resource Names (ARNs) of all monitoring accounts to "Resource" array.

{
    "Statement": [
        {
            "Resource": [
                "arn:aws:iam::<12-digit target account number>:role/<role created in previous step (DESK_monitoring_role)>"
            ],
            "Action": [
                "sts:AssumeRole"
            ],
            "Effect": "Allow"
        }
    ],
    "Version": "2012-10-17"
}

When done, paste Update policy and then click Review policy.

Name the inline policy you've just created, for example DESK_assume_policy and click Create policy.

Go back to the DESK_monitoring_role you created earlier and select Trust relationships tab in the role summary page and click Edit Trust Relationships.

Paste the JSON sample below into a text editor. Edit it and add:

• The 12-digit AWS number of the account hosting the ActiveGate
• The role with which your Environment ActiveGate was started and the external ID you copied in previous steps

Don't include the < and > characters.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",

      "Principal": {
        "AWS": [
          "arn:aws:iam::<12-digit source account number>:role/< role for your Environment ActiveGate (DESK_ActiveGate_role)>",
          "arn:aws:iam::509560245411:root"
        ]
      },
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<External ID generated from tenant>"
        }
      }
    }
  ]
}

Paste the modified text and click Update Trust Policy button.

Go to EC2 console, right-click an instance hosting your Environment ActiveGate and select Instance settings > Attach/Replace IAM Role.

Select the role created earlier, DESK_ActiveGate_role, and click Apply.

Edit the custom.properties file of your Environment ActiveGate.

Set the following properties as below:

[vertical.topology]
use_aws_proxy_role = false

[aws_monitoring]
aws_monitoring_enabled = true

If the ActiveGate is dedicated to AWS monitoring, you must also set the MSGrouter property to false:

[collector]
MSGrouter = false

Remove aws_proxy_account and aws_proxy_role properties.

Save the file and restart ActiveGate.