Creating a connection

Enabling affinity for Topology for Amazon Web Services (AWS)

Clone the following repository that contains the script and instructions: https://github.kyndryl.net/MCMP-Topology/mcmp-topology-affinity-setup.
Install dependencies by running the following command: 
python -m pip install boto3 / python3 -m pip install boto3
Add these credentials to ~/.aws/credentials:
[default]   aws_access_key_id = YOUR_KEY    aws_secret_access_key = YOUR _SECRET
Set up a default region in ~/.aws/config:
[default]   region=us-east-1
Create an S3 bucket on AWS with the name "mcmp-topology-flow-logs-YOUR_ACCOUNT_ID" in the region created in the previous step.

Run all the following scripts in the
aws-flowlog-automation-script
folder that you cloned from the https://github.kyndryl.net/MCMP-Topology/mcmp-topology-affinity-setup repository.
In the regions.json file in the inputs folder, select the regions for which to generate flow logs. Update this file at any time by running the
python updateRegions.py
command.
Run
python getVPCIds.py
to create the 
AWS-Account-<Account_Number>-VpcList.json
file in the Inputs folder that contains all the vpc-Ids for all regions listed in regions.json.
Edit the AWS-Account
-<Account_Number>-VpcList.json
file and remove any vpcIds for which no flow logs are needed.
Run
python createFlowLogs.py
to create the logging.

Sign into your Amazon SNS console.
In the
Navigation
pane, select
Topics
.
Select a topic and select
Edit
.
On the Edit {Topic} page, expand the Delivery status logging section.
Select the protocol that you want to log delivery status with. Currently only Amazon SQS and AWS Lambda are supported.
Set the Success sample rate to
100%
.
In the IAM roles section, select one of the following options:
Select
Use existing service role
and then select the
IAM roles
for successful and failed deliveries.
Select
Create new service role
and then create
IAM roles
for successful and failed deliveries.
Provide Amazon SNS with write access to use the CloudWatch logs by selecting
Allow
.
Click
Save changes
.

Create a file with the same format as
AWS-Account-<Account_Number>-VpcList.json
 containing all the VPC Ids for which to delete flow logs.
Run
python deleteFlowLog.py
or
python deleteFlowLog.py -y
(to skip user conformation for each region), enter the absolute path to input file such as
/home/User/MCMP-Topology/mcmp-topology-affinity-aws/Inputs/AWS-Account-<Account_Number>-VpcList.json
, and press
y
.

Enabling affinity for IBM Cloud

Clone the following repository that contains the script and instructions: https://github.kyndryl.net/MCMP-Topology/mcmp-topology-affinity-setup.
Install dependencies by running the following command:
python3 -m pip install -r requirements.txt
Create directories as (.mcmp/.ibmcloud) in your home directory.
Create a text file named credentials if using windows, or credentials.txt if using another operating system in your .ibmcloud directory that includes the following credentials:
ibm_account =  {IBM Cloud account ID}  ibm_apikey = {IBM Cloud API key} resource_id =  {Resource ID of resource group where you want to create buckets}

Open the
regions.json
file in the Inputs folder and remove regions until only those that you want to create flow logs for remain. To restore all regions (due to an error), run the
python updateRegions.py
command.
Run the
python3 createBuckets.py
command to create a cloud object storage instance with the name mcmp-topology-flow-logs-{Account_id} and buckets in all the regions specified in regions.json with the name mcmp-topology-flow-logs-{region}-{Account_id}. The buckets created have an expiration rule of 1 day, so they are deleted 24 hours after being archived.  If you are re-running this file, delete the already existing mcmp-topology-flow-logs-{Account_id} file before running the command.
Run the python3 getVPCIds.py command to create an IBM-Account-{Account_Number}-VpcList.json file in the Inputs folder that contains the vpc-Ids for all regions mentioned in regions.json.
Run the python3 createFlowLogs.py command to create VPC Flowlog collectors.

Go to
My Console
landing page.
Select
Logging and Monitoring
.
Click
IBM Cloud Activity tracker
.
For each region that you want to track, select the following parameters and then click
Create
:
Select the region where you want to create the tracker.
For plan, select
7 day Event Search
.
Check the box: 
I have read and agree to the following license agreements
.
Enable activity tracker for each bucket in IBM Cloud Console using these steps:
Select
Storage
.
Select the service instance with your bucket.
Select the bucket you want to enable.
In the navigation pane, click
Configuration
.
Click the
Activity Tracker
tab.
Click
Create
. If you already have an instance of IBM Cloud Activity Tracker, select it here. If not, select the appropriate configuration and click
Create
.
Select
Track data
events and select read and write in the field below.
Click
Save
.
Ensure that you have a cloud object storage instance with the name mcmp-topology-flow-logs-. If you do not, create an instance with the name mcmp-topology-flow-logs-{AccountNumber}.
Create a bucket in the cloud object storage instance that you just identified to archive all the activity tracker events in by completing these steps:
Click
Create bucket
in your cloud object storage instance.
For Name, enter topology-activity-tracker-{AccountNumber[0:15} (first 15 digits of your account number).
Create the bucket in the us-east region and select
storage
class as smart tier.
Go to the
Advanced Configurations
section and click
Expiration
.
Click
Add
.
In the
Add expiration
rule window, click
Simple
.
Enable
Expiration rule
, enter 1 in the Current version expiration field, and click
Save
.
Click
Create bucket
.
Select the bucket that you just created and copy the following information:
The private endpoint
The apikey
The resource_instance_id
Configure archiving of your IBM Cloud Activity Tracker instance into a COS bucket by completing these steps for each of them:
On the
Dashboard
, select
Services and software
.
Click
Activity tracker
.
Click
Open dashboard
.
Click the Settings icon and select
Archiving→ Manage
.
Click
Enable archiving
.
Select
IBM Cloud Object Storage
.
Enter the following parameters and then click the Service Credentials tab:
Bucket: Enter the name of the bucket.
Endpoint: The private endpoint of the bucket.
Enter the following information from your service credential (create a new one if needed) and then click
Save
:
API Key: The apikey value from your service credential.
Instance ID: The resource_instance_id from your service credential.
Click
Save
.