Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Orion Platform > Orion Documentation > Orion Platform Administrator Guide > Monitor cloud instances and VMs > Configure cloud accounts for the Orion Platform > Configure an AWS account for cloud monitoring

Configure an AWS account for cloud monitoring

Before adding AWS accounts to the Orion Platform, IAM permissions must be configured in the AWS Management Console to provide access to the Orion Platform so it can collect status and metrics for AWS instances.

To integrate the AWS cloud service with the Orion Platform, Identity and Access Management (IAM) permissions must be configured and IAM policies must be assigned to AWS accounts., as described next. Consult your system administrator and refer to AWS documentation for details.

Establish AWS IAM permissions

To interact with the Orion Platform, an AWS account must be able to retrieve CloudWatch metrics from various resources. Review Authentication and Access Control for Amazon CloudWatch and use this section as a reference for specific permissions.

Although you can embed inline policies to set permissions, SolarWinds recommends attaching an IAM policy to an account so JSON code can be used to permit or restrict user actions.

Each AWS account requires the following resource-level permissions:

  • ec2:DescribeInstances
  • ec2:DescribeAddresses
  • ec2:DescribeVolumes
  • ec2:DescribeVolumeStatus
  • cloudwatch:GetMetricStatistics
  • autoscaling:DescribeAutoScalingGroups

To define actions that can be performed against an instance, add the following permissions:

  • ec2:StartInstances
  • ec2:StopInstances
  • ec2:RebootInstances
  • ec2:TerminateInstances

The following JSON code provides standard access to an Orion Platform user:

{
	"Version": "2016-10-17",
	"Statement": [{	
		"Effect": "Allow",
		"Action": [
		"ec2:DescribeInstances",
		"ec2:DescribeAddresses",
		"ec2:DescribeVolumes", 
		"ec2:DescribeVolumeStatus",
		"cloudwatch:GetMetricStatistics",
		"autoscaling:DescribeAutoScalingGroups", 
	],
	"Resource": "*"
    }
  ]
}

Add an IAM policy to AWS accounts

These steps describe how to create an AWS IAM policy to attach to AWS accounts.

  1. Log into the AWS Management Console and open the IAM console.
  2. Click Policies.
  3. If this is your first time adding Policies, the Welcome page appears. Click Get Started.
  4. Click Create Policy.
  5. On the Create Policy page, click Select > Create Your Own Policy.
  6. Enter policy details, such as name and description.
  7. To enter policies in a policy editor, add the following permission statements to the Policy Document:

    {
    	"Version": "2016-10-17",
    	"Statement": [{	
    		"Effect": "Allow",
    		"Action": [
    		"ec2:DescribeInstances",
    		"ec2:DescribeAddresses",
    		"ec2:DescribeVolumes", 
    		"ec2:DescribeVolumeStatus",
    		"cloudwatch:GetMetricStatistics",
    		"autoscaling:DescribeAutoScalingGroups", 
    		"ec2:StopInstances", 
    		"ec2:StartInstances",
    		"ec2:RebootInstances", 
    		"ec2:TerminateInstances"
    	],
    	"Resource": "*"
        }
      ]
    }
  8. Click Validate Policy.
  9. Click Create Policy.

To attach the policy to an account:

  1. In the AWS Management Console, click Policies.
  2. Navigate to the policy and selects its check box.
  3. Click Policy Actions > Attach.
  4. Select the All Types option and Users.
  5. Navigate to the account and selects its check box.
  6. Click Attach Policy.
Last modified

Tags

This page has no custom tags.

Classifications

Public