AWS Quick Start Guide

PrivateLink support enables secure and confidential collection of AWS resources, including their metadata and performance metrics, ensuring end-to-end data privacy. This feature ensures that all transmitted and stored information remains fully isolated and protected from unauthorized access, upholding the highest standards of data security.

Once the common infrastructure for the AWS Collector is set, please refer to Get started with AWS PrivateLink on how to create VPCs, subnets, route tables, endpoints and how to link them to the AWS services, etc.

To create VPC Transit Gateways (TGWs), please refer to Create a transit gateway using Amazon VPC Transit Gateways.

To create TGW peering, please refer to Create a peering attachment using Amazon VPC Transit Gateways.

You are now ready to enable PrivateLinks.

The PrivateLink functionality is optional and can be enabled by following the steps below.

1. Using a text editor of your choice, create a .yaml file, privatelinks.yaml in /config/aws/ directory.
2. Populate the file with the required VPC endpoints created during the AWS PrivateLink setup.
   • A reference file, sample-privatelinks.yaml, is available in the /config/aws/ directory. You can either copy its contents into the newly created privatelinks.yaml or rename the sample file.
   • Be sure to update the file with the specific endpoints from your PrivateLink setup (as described in Get started with AWS PrivateLink). For example, vpce-1234-q018afg2.ec2.ap-south-1.vpce.amazonaws.com

     
     PrivateLinks: 
       <region>:
         <service>: "<vpc-endpoint-id>.<service>.<region>.vpce.amazonaws.com" 
     

     Note:

     • region must have the corresponding AWS region. For example, us-east-1, ap-south-1
     • service must have the service name in lower-case. For example, ec2, s3, sts, sqs, monitoring, lambda, elb
     Example

     
     PrivateLinks: 
       us-east-1: 
          ec2: "vpce-1234-a7gqwuts.ec2.us-east-1.vpce.amazonaws.com"  
          s3: "bucket.vpce-1234-om0crbbo.s3.us-east-1.vpce.amazonaws.com"  
          sts: "vpce-1234-gmundb4e.sts.us-east-1.vpce.amazonaws.com"  
          sqs: "vpce-1234-hlttexco.sqs.us-east-1.vpce.amazonaws.com" 
          monitoring: "vpce-1234-wxr1dmyd.monitoring.us-east-1.vpce.amazonaws.com" 
          lambda: "vpce-1234-gtcni32g.lambda.us-east-1.vpce.amazonaws.com" 
          elb: "vpce-1234-0cf1ouw3.elasticloadbalancing.us-east-1.vpce.amazonaws.com"  
       ap-south-1: 
          ec2: "vpce-1234-q018afg2.ec2.ap-south-1.vpce.amazonaws.com" 
          s3: "bucket.vpce-1234-ek2cskah.s3.ap-south-1.vpce.amazonaws.com" 
          sts: "vpce-1234-tw6l6wt3.sts.ap-south-1.vpce.amazonaws.com"  
          sqs: "vpce-1234-2am90mcd.sqs.ap-south-1.vpce.amazonaws.com" 
          monitoring: "vpce-1234-a3mvdnjm.monitoring.ap-south-1.vpce.amazonaws.com" 
          lambda: "vpce-1234-3ok7x7sk.lambda.ap-south-1.vpce.amazonaws.com"  
          elb: "vpce-1234-juyb8526.elasticloadbalancing.ap-south-1.vpce.amazonaws.com" 
     

     Note:

     • ec2 service endpoint is necessary to collect EC2 instances, EBS volumes, Transit gateway, NAT gateway, and VPN devices.
     • elb and lambda service endpoints are required to collect ELB and lambda devices respectively.
     • s3 service endpoint is necessary to collect S3 devices and metrics, it is essential to replace * with bucket keyword in the service name. For example, *.vpce-1234-om0crbbo.s3.us-east-1.vpce.amazonaws.com must be replaced with bucket.vpce-1234-om0crbbo.s3.us-east-1.vpce.amazonaws.com.
     • sts service endpoint is necessary for validating credentials.
     • sqs and monitoring (CloudWatch) service endpoints are essential for metric collection.
3. The privatelinks.yaml file must be placed in the NMS appliance configuration directory, /config/aws/.
4. Restart the AWS Collector service on the NMS appliance to apply the configuration.
   Note: PrivateLinks must be enabled only for private (air-gapped) environments.

The following are a few common scenarios in AWS container console that may arise when configuring the PrivateLinks.

Issue# 1:

{"level":"info","ts":1749817617.106396,"msg":"Warning: ec2 vpc endpoint not found in configuration for region ap-southeast-1"}

The collector is unable to locate the VPC endpoint information, which may be due to a missing or misconfigured privatelinks.yaml file.

Issue# 2

{"level":"error","ts":1749794399.442174,"msg":"failed to Authenticate with \
AWS","error":"failed to assume role arn:aws:iam::012345678901:role/sevone-auto_collector_role: \
operation error STS: GetCallerIdentity, get identity: get credentials: failed to refresh cached credentials, \
operation error STS: AssumeRole, exceeded maximum number of attempts, 3, \
https response error StatusCode: 0, RequestID: , request send failed, \
Post \"https://vpce-1234-gmundb4e.sts.us-east-1.vpce.amazonaws.com/\": dial tcp 67.220.240.253:443: i/o timeout"}

This issue may be caused by insufficient Layer 3 connectivity between VPCs across regions. The system is attempting to access the VPC endpoint at https://vpce-1234-gmundb4e.sts.us-east-1.vpce.amazonaws.com.

Issue# 3

{"level":"error","ts":1749794306.1431816,"msg":"failed to Authenticate \
with AWS","error":"failed to assume role arn:aws:iam::012345678901:role/sevone-auto_collector_role: \
operation error STS: GetCallerIdentity, get identity: get credentials: failed to refresh cached \
credentials, operation error STS: AssumeRole, exceeded maximum number of attempts, 3, \
https response error StatusCode: 0, RequestID: , request send failed, \
Post \"https://sts.ap-south-1.amazonaws.com/\": dial tcp 13.200.92.183:443: i/o timeout"} 

This issue may be due to PrivateLink not being properly enabled. The system is attempting to access the public DNS endpoint, https://sts.ap-south-1.amazonaws.com.

1. Using ssh, log in to SevOne NMS appliance as support user.

   ssh support@<NMS appliance>

2. Open a shell within the NMS container.

   nms

3. Change directory to /config/aws/terraform/envs/infrastructure_role.
4. Update the following values in terraform.tfvars.
   Important: Variable prefix must be,

   • between 1 and 20 characters
   • contain only lowercase letters, digits, or hyphens
   • start and end with letters or digits

   
   account_id         = <YOUR AWS ACCOUNT NUMBER>
   prefix             = <PREFIX TO UNIQUELY IDENTIFY RESOURCES>
   

   Empty 'terraform.tfvars' file published with examples in comments

   
   ## Your 12 digit AWS account number
   # account_id              = <enter your AWS account number>
   
   ## Prefix to uniquely identify resources that are created in AWS
   ## - Must be all lowercase due to S3 bucket naming restrictions
   # prefix                  = "<enter a unique identifier>"
   

   Example

   
   ## Your 12 digit AWS account number
   account_id              = 012345678901
   
   ## Prefix to uniquely identify resources that are created in AWS
   ## - Must be all lowercase due to S3 bucket naming restrictions
   prefix                  = "myprefix"
   

5. Set the following environment variables with Access Key ID and Secret Key for the Infrastructure User that was created in section Access Key Credentials. For more information about creating access keys for IAM users, please refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html

   
   export AWS_ACCESS_KEY_ID="mykey"
   export AWS_SECRET_ACCESS_KEY="mysecret"
   export AWS_REGION="us-east-1"
   

6. Apply the Terraform files.

   
   terraform init
   terraform plan
   terraform apply
   

   Important: Please make note of output value, infrastructure_role_arn, as it will be required in section Run Terraform to deploy AWS resources below.

1. Change directory to /config/aws/terraform/envs/collector_infrastructure.

   cd /config/aws/terraform/envs/collector_infrastructure

2. Update the following values in terraform.tfvars.

   Empty 'terraform.tfvars' file published with examples in comments

   
   ## Your 12 digit AWS account number
   # account_id              = 012345678901
    
   ## AWS IAM User ARN that will be used to run the collector
   # collector_user_arn      = "arn:aws:iam::012345678901:user/person@company.com"
    
   ## AWS IAM Role ARN that will be used to install infrastructure
   ## - This can be found in the output of applying the `infrastructure_role` Terraform config
   # infrastructure_role_arn = "arn:aws:iam::012345678901:role/sevone_infrastructure_role"
    
   ## List of regions that you want to monitor
   # regions                 = ["us-east-1", "us-west-1"]
    
   ## Prefix to uniquely identify resources that are created in AWS
   ## - Must be all lowercase due to S3 bucket naming restrictions
   # prefix                  = "sevone"
   

   Important: Variable prefix must be the same prefix that was used when creating the Infrastructure Role.
   Important: Resources must be created in every region that you want to monitor. When adding more than one region to create the resources in, you can add it in terraform.tfvars file as,

   Example

   
   regions = ["us-east-1", "eu-central-1"]
   

3. Apply the Terraform files.

   
   cd gen
   terraform init
   terraform plan
   terraform apply
   cd ..
   terraform init
   terraform plan
   terraform apply
   

4. Details from the following output will be required to create a device in SevOne NMS.
   1. account_id
   2. collector_role_arn
   3. sqs_queue
   4. regions

1. Navigate to CloudWatch > Metric Streams.
2. Click Create metric stream to launch the wizard.
3. Select Select metrics.
4. Select Include.
5. Select the following namespaces and select Use: "AWS/<namespace> = All metrics names" to get all metrics for the selected namespaces.
   1. AWS/EC2
   2. AWS/S3
   3. AWS/NATGateway
   4. AWS/TransitGateway
   5. AWS/DX
   6. AWS/EBS
   7. AWS/NetworkELB
   8. AWS/VPN
   9. AWS/Lambda
   10. AWS/Route53
   11. AWS/Route53Resolver
   
6. Name the metric stream.
   Note: You will need the name of the S3 bucket within the Resources will be added to your account section for the next section.
7. Click Create metric stream to complete the configuration.

To create a role for Terraform to use, you must first define the policy that will be added to the role.

1. Navigate to IAM > Policies.
2. Click the Create policy button to launch the wizard.
3. Switch the Policy editor to JSON.
4. Paste in the following policy definition.
   Important: Variable prefix must be,

   1. between 1 and 20 characters
   2. contain only lowercase letters, digits, or hyphens
   3. start and end with letters or digits

   Terraform adds this prefix to the beginning of names for all resources created for the AWS plugin.
   Note: You will need to replace the instances of PREFIX in the policy statements below with the prefix you picked out, and then replace the instances of ACCOUNT_ID with the AWS account ID for the account that the resources will be created in.

   
   { 
       "Version": "2012-10-17", 
       "Statement": [ 
           { 
               "Action": [ 
                   "cloudwatch:TagResource", 
                   "cloudwatch:ListTagsForResource" 
               ], 
               "Effect": "Allow", 
               "Resource": "arn:aws:cloudwatch:*:ACCOUNT_ID:*PREFIX*", 
               "Sid": "" 
           }, 
           { 
               "Action": [ 
                   "firehose:ListTagsForDeliveryStream", 
                   "firehose:DescribeDeliveryStream", 
                   "firehose:DeleteDeliveryStream", 
                   "firehose:CreateDeliveryStream" 
               ], 
               "Effect": "Allow", 
               "Resource": "arn:aws:firehose:*:ACCOUNT_ID:deliverystream/PREFIX*", 
               "Sid": "" 
           }, 
           { 
               "Action": [ 
                   "iam:TagRole", 
                   "iam:PutRolePolicy", 
                   "iam:PassRole", 
                   "iam:ListRolePolicies", 
                   "iam:ListInstanceProfilesForRole", 
                   "iam:ListAttachedRolePolicies", 
                   "iam:GetRolePolicy", 
                   "iam:GetRole", 
                   "iam:DeleteRolePolicy", 
                   "iam:DeleteRole", 
                   "iam:CreateRole" 
               ], 
               "Effect": "Allow", 
               "Resource": " arn:aws:iam::ACCOUNT_ID:role/PREFIX*", 
               "Sid": "" 
           }, 
           { 
               "Action": [ 
                   "cloudwatch:StopMetricStreams", 
                   "cloudwatch:StartMetricStreams", 
                   "cloudwatch:PutMetricStream", 
                   "cloudwatch:ListMetricStreams", 
                   "cloudwatch:GetMetricStream", 
                   "cloudwatch:DeleteMetricStream" 
               ], 
               "Effect": "Allow", 
               "Resource": " arn:aws:cloudwatch:*:ACCOUNT_ID:*PREFIX*", 
               "Sid": "" 
           }, 
           { 
               "Action": [ 
                   "s3:PutObject", 
                   "s3:PutLifecycleConfiguration", 
                   "s3:PutBucketTagging", 
                   "s3:PutBucketPublicAccessBlock", 
                   "s3:PutBucketNotification", 
                   "s3:PutBucketAcl",
                   "s3:ListBucket", 
                   "s3:ListAllMyBuckets", 
                   "s3:GetReplicationConfiguration", 
                   "s3:GetLifecycleConfiguration", 
                   "s3:GetEncryptionConfiguration", 
                   "s3:GetBucketWebsite", 
                   "s3:GetBucketVersioning", 
                   "s3:GetBucketTagging", 
                   "s3:GetBucketRequestPayment",
                   "s3:GetBucketPublicAccessBlock", 
                   "s3:GetBucketPolicyStatus", 
                   "s3:GetBucketPolicy", 
                   "s3:GetBucketObjectLockConfiguration", 
                   "s3:GetBucketNotification", 
                   "s3:GetBucketLogging", 
                   "s3:GetBucketLocation", 
                   "s3:GetBucketCORS", 
                   "s3:GetBucketAcl",
                   "s3:GetAccelerateConfiguration", 
                   "s3:DeleteBucket",
                   "s3:CreateBucket" 
               ],
               "Effect": "Allow", 
               "Resource": "arn:aws:s3:::*PREFIX*", 
               "Sid": "" 
           }, 
           { 
               "Action": [ 
                   "sqs:TagQueue", 
                   "sqs:SetQueueAttributes", 
                   "sqs:ListQueues", 
                   "sqs:ListQueueTags", 
                   "sqs:GetQueueUrl", 
                   "sqs:GetQueueAttributes", 
                   "sqs:DeleteQueue", 
                   "sqs:CreateQueue" 
               ], 
               "Effect": "Allow", 
               "Resource": "arn:aws:sqs:*:ACCOUNT_ID:*PREFIX*", 
               "Sid": "" 
           } 
       ] 
   } 
   

   
5. Click Next.
6. Under the Policy details, enter a Policy name.
7. Click Create policy.

Once the policy has been created, you can now create the IAM role.

1. Navigate to IAM > Roles.
2. Click the Create role button to launch the wizard.
3. Under Trusted entity type, select AWS account.
4. Under An AWS account, select This account.
5. Click Next.
6. Under Permissions policies search for the name of the policy you created in the previous step.
7. Click the check box beside the policy you created in the previous step.
8. Click Next.
9. Under the Role details, enter a Role name
10. Click Create role.