mirror of
https://github.com/storytold/terraform-aws-observability-accelerator.git
synced 2026-10-09 00:09:43 +00:00
EKS Cross Account Observability using central AMP (#213)
* Added example for multi-cluster eks-monitoring and made changes to eks-monitoring module to allow cross-cluster IRSA * Updated eks-monitoring module's README to add the variable description * Hard-coded grafana license type in eks-cross-cluster-with-amp/main.tf * Added README page for eks-cross-account-with-central-amp * Extracted out the eks/amg creation and modified it to use existing resources * Update README.md to add multiaccount dashboard png * Updated README.md and multiaccount.md to add eks multiaccount png * Updated eks-cross-cluster-with-amp example to disable dashboard creation for cluster 2 * Pre commit changed committed * Fixed cross-account-observability docs and README.md and added variable for amp_workpace_alias * Removed extra spacing in multiaccount.md and added precommit suggested changes * Modified cross-account-observability example to change cross-account-amp-role to snake_case * Capitalized Terraform string in multiaccount.md and converted iam-role-attach to snake_case --------- Co-authored-by: Rodrigue Koffi <bonclay7@users.noreply.github.com>
This commit is contained in:
Venkat Penmetsa
@@ -0,0 +1,119 @@
|
||||
# AWS EKS Cross Account Observability
|
||||
|
||||
This example shows how to use the [AWS Observability Accelerator](https://github.com/aws-observability/terraform-aws-observability-accelerator), with two or more EKS clusters in multiple AWS accounts and verify the collected metrics from all the clusters in the dashboards of a common `Amazon Managed Grafana` workspace in a central monitoring account.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
#### 1. Cross Account IAM access
|
||||
|
||||
In order to create/modify resources across multiple AWS accounts, this Terraform example implements the cross-account IAM role assumption. You will need separate IAM roles in all 3 AWS accounts, and each of these IAM roles should have the below specified trust-relationship so that your local AWS user/role will be able to assume them during the terraform execution.
|
||||
|
||||
```
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": "<local-aws-user/role-arn>"
|
||||
},
|
||||
"Action": "sts:AssumeRole",
|
||||
"Condition": {}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
!!! note
|
||||
The IAM roles in Account 1 and Account 2 (EKS cluster accounts) should have permissions to perform kubernetes API operations against your EKS clusters. For more info, please review documentation for [enabling IAM principal access to your clusters](https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html)
|
||||
|
||||
#### 2. EKS clusters in multiple AWS Accounts
|
||||
|
||||
Using the example [eks-cluster-with-vpc](https://aws-observability.github.io/terraform-aws-observability-accelerator/helpers/new-eks-cluster/), create two EKS clusters with the below names in two different AWS accounts:
|
||||
|
||||
1. `eks-cluster-1` (Account 1)
|
||||
|
||||
2. `eks-cluster-2` (Account 2)
|
||||
|
||||
Update the cluster names and their corresponding region names in the `variables.tf` file along with the corresponding IAM role ARNs that can be assumed by terraform to perform cross-account API operations.
|
||||
|
||||
#### 3. Amazon Managed Grafana (AMG) workspace
|
||||
|
||||
To run this example you need an existing Amazon Managed Grafana (AMG) workspace. If not, you can create a new AMG workspace by following the [Getting Started with Amazon Managed Grafana](https://docs.aws.amazon.com/grafana/latest/userguide/getting-started-with-AMG.html) documentation.
|
||||
|
||||
Add the Grafana Workspace ID and its corresponding region name in the `variables.tf` file along with the corresponding IAM role ARN that can be assumed by terraform to perform cross-account API operations.
|
||||
|
||||
!!! note
|
||||
You can obtain the AMG Workspace ID based on its URL. For the URL `https://g-xyz.grafana-workspace.eu-central-1.amazonaws.com`, the workspace ID would be `g-xyz`
|
||||
|
||||
|
||||
## Setup
|
||||
|
||||
#### 1. Download sources and initialize Terraform
|
||||
|
||||
|
||||
```sh
|
||||
|
||||
git clone https://github.com/aws-observability/terraform-aws-observability-accelerator.git
|
||||
|
||||
cd terraform-aws-observability-accelerator/examples/eks-cross-account-with-central-amp
|
||||
|
||||
terraform init
|
||||
|
||||
```
|
||||
|
||||
#### 2. Deploy
|
||||
|
||||
By looking at the `variables.tf`, you will notice there are two EKS clusters targeted for deployment by the names/ids:
|
||||
|
||||
1. `eks-cluster-1`
|
||||
|
||||
2. `eks-cluster-2`
|
||||
|
||||
While installing the observability settings for the EKS cluster specified in variable `cluster_one.name`, Terraform also sets up:
|
||||
|
||||
* Creates an `Amazon Managed Prometheus Workspace`
|
||||
|
||||
* Dashboard folder and files in provided `Amazon Managed Grafana Workspace`
|
||||
|
||||
|
||||
!!! warning
|
||||
To override the defaults, create a `terraform.tfvars` and change the default values of the variables.
|
||||
|
||||
|
||||
|
||||
Run the following command to deploy
|
||||
|
||||
```sh
|
||||
|
||||
terraform apply --auto-approve
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
## Verifying Multi Account Observability
|
||||
|
||||
|
||||
|
||||
One you have successfully run the above setup, you should be able to see dashboards similar to the images shown below in `Amazon Managed Grafana` workspace.
|
||||
|
||||
|
||||
|
||||
You will notice that you are able to use the `cluster` dropdown to filter the dashboards to metrics collected from a specific EKS cluster.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Cleanup
|
||||
|
||||
To clean up entirely, run the following command:
|
||||
|
||||
|
||||
|
||||
```sh
|
||||
|
||||
terraform destroy --auto-approve
|
||||
|
||||
```
|
||||
Reference in New Issue
Block a user