AWS Cloud

configure an aws cloud account view permission for to pull data from aws as you embark on optimizing your container clusters, it's essential to establish the right permissions within your aws cloud account by ensuring your aws cloud account is properly configured, you gain the invaluable ability to monitor and manage your elastic kubernetes service (eks) clusters with precision will only require read only access to your aws services, specifically for actions such as listclusters and describecluster this level of access allows you to maintain a secure environment while still leveraging the full capabilities of kyndryl's management tools prerequisites to enable aws cloud for container cluster management you must first configure configure it for the application using the eks (elastic kubernetes service) reads data from aws services and readonly access is required for the eks service performs the following actions on amazon eks listclusters describecluster the following code example describes a way to create a policy that allows users read only access to list or describe all clusters { "version" "2022 07 10", "statement" \[ { "effect" "allow", "action" \[ "eks\ describecluster", "eks\ listclusters" ], "resource" " " } ] } once all configuration steps have been completed at a cloud provider level, you must configure the tenant to continue with the data exchange for complete the configuration on the cloud provider console step 1 from the landing page, select the main menu or the manage tile step 2 select admin then step 3 on the screen, select the connections tab from the left panel step 4 select the add new drop down menu step 5 select the add a connection step 6 select the technology category as cloud provider step 7 select aws cloud step 8 enter the account number , access key id , and access secret key from the aws account referred to in the previous section to get the account number, refer to the image below step 9 validate your credentials by selecting test connection step 10 once the connection is successful, select add to create a connection amazon cloudwatch support supports amazon cloudwatch amazon cloudwatch is a service that monitors applications, responds to performance changes, optimizes resource use, and provides insights into operational health by collecting data across aws resources, cloudwatch gives visibility into system wide performance and allows users to set alarms, automatically react to changes, and gain a unified view of operational health users benefit from real time visibility into their cloud platform to facilitate troubleshooting, ensure availability and minimize impact on business operations configuring for cloudwatch prerequisites cms service fetches the data stored by cloudwatch container insights for aws clusters refer to docs aws amazon com for details to enable cloudwatch to gather logs and metrics data from aws clusters, the following two steps are required grant permissions to enable your amazon eks worker nodes to send metrics and logs to cloudwatch refer to docs aws amazon com for details setup cloudwatch agent to collect metrics refer to docs aws amazon com for details the following yaml configuration, containing the query to fetch cpu and memory stats is added in cms metricbeat modules \ module aws period 48h continuous true metricsets \ container insights queries \ name "cpumemorystats" query "filter type='container' | stats max(container cpu utilization) as cpu utilization, max(container cpu request) as cpu request, max(container cpu limit) as cpu limit, max(container memory usage) as memory usage, max(container memory limit) as memory limit, max(container memory request) as memory request, latest(nodename) as nodename, latest(namespace) as namespace, latest(podname) as podname, latest(clustername) as clustername,latest(kubernetes pod owners 0 owner name) as ownername,latest(kubernetes pod owners 0 owner kind) as ownerkind,latest(kubernetes containerd container id) as containerid, latest(@logstream) as logstream by kubernetes container name as containername, bin(24h) as timestamp"