Skip to content

Commit ce0e82d

Browse files
kcantrelkcantrel
committed
Made some formating changes; Updated the CW dashboard metrics.
1 parent 9ce2c1e commit ce0e82d

File tree

2 files changed

+106
-101
lines changed

2 files changed

+106
-101
lines changed

‎Monitoring/CloudWatch-FSx/README.md‎

Lines changed: 103 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -1,122 +1,127 @@
11
# AWS CloudWatch Dashboard for FSx for ONTAP
22

33
## Introduction
4-
This solution provides a CloudFormation template to deploy an AWS CloudWatch dashboard for monitoring FSx for ONTAP systems. The dashboard offers comprehensive insights into your FSx for ONTAP resources, helping you monitor performance, track metrics, and manage alarms efficiently.
5-
The template creates the following resources:
4+
This solution provides a CloudFormation template to deploy an AWS CloudWatch dashboard for monitoring FSx for ONTAP systems. The dashboard offers comprehensive insights into your FSx for ONTAP resources, helping you monitor performance, track metrics, and manage alarms efficiently.
5+
The template creates the following resources:
66

7-
1. Dashboard - The Amazon CloudWatch dashboard divided into four main sections:
8-
a. Overview metrics of all FSx systems in the region
9-
b. Metrics by individual FSx system
10-
c. Metrics by volume ID
11-
d. Alarms
12-
2. Lambda - The service does the following:
13-
a. Build custom widgets for the dashboard
14-
b. Collect metrics directly from ONTAP (like snapmirror unhealthy relations)
15-
c. Create alarms for all files systems in the region
16-
3. Schedulers - Two Amazon EventBridge schedulers that triggers the Lambda metrics collection every minute and alarms creating/
17-
updating/deleting every hour.
18-
4. Lambda Role - The IAM role that allows the Lambda service to run.
19-
5. Scheduler Role - The IAM role that allows the scheduler to trigger the Lambda service.
20-
6. SecretManager endpoint - The Lambda function runs inside a VPC, which by default lacks outgoing internet connectivity. To enable the function to securely access the fsxadmin passwords stored in AWS Secrets Manager, a VPC endpoint for the Secrets Manager service is required. This endpoint allows the Lambda function to retrieve sensitive information from Secrets Manager without needing direct internet access, maintaining security while ensuring the function can access the necessary credentials.
21-
7. CloudWatch endpoint - The Lambda function runs inside a VPC, which by default lacks outgoing internet connectivity. To enable the function to send logs and metrics to CloudWatch, a VPC endpoint for the CloudWatch service is required.
22-
This endpoint allows the Lambda function to communicate with CloudWatch without needing direct internet access, maintaining security while ensuring proper monitoring and logging functionality.
23-
8. FsxService endpoint - The Lambda function runs inside a VPC, which by default lacks outgoing internet connectivity. To enable the
24-
function to send calls to FsxService to reterive file systems inforamtion.
7+
1. Dashboard - The Amazon CloudWatch dashboard divided into four main sections:
8+
a. Overview metrics of all FSx systems in the region
9+
b. Metrics by individual FSx system
10+
c. Metrics by volume ID
11+
d. Alarms
12+
2. Lambda - The service does the following:
13+
a. Build custom widgets for the dashboard
14+
b. Collect metrics directly from ONTAP (like snapmirror unhealthy relations)
15+
c. Create alarms for all files systems in the region
16+
3. Schedulers - Two Amazon EventBridge schedulers that triggers the Lambda metrics collection every minute and alarms creating/
17+
updating/deleting every hour.
18+
4. Lambda Role - The IAM role that allows the Lambda service to run.
19+
5. Scheduler Role - The IAM role that allows the scheduler to trigger the Lambda service.
20+
6. SecretManager endpoint - The Lambda function runs inside a VPC, which by default lacks outgoing internet connectivity. To enable the function to securely access the fsxadmin passwords stored in AWS Secrets Manager, a VPC endpoint for the Secrets Manager service is required. This endpoint allows the Lambda function to retrieve sensitive information from Secrets Manager without needing direct internet access, maintaining security while ensuring the function can access the necessary credentials.
21+
7. CloudWatch endpoint - The Lambda function runs inside a VPC, which by default lacks outgoing internet connectivity. To enable the function to send logs and metrics to CloudWatch, a VPC endpoint for the CloudWatch service is required.
22+
This endpoint allows the Lambda function to communicate with CloudWatch without needing direct internet access, maintaining security while ensuring proper monitoring and logging functionality.
23+
8. FsxService endpoint - The Lambda function runs inside a VPC, which by default lacks outgoing internet connectivity. To enable the
24+
function to send calls to FsxService to reterive file systems inforamtion.
2525

2626
## Prerequisites
27-
1. You should have an AWS Account with the following permissions to create and manage resources:
28-
"cloudformation:DescribeStacks",
29-
"cloudformation:ListStacks",
30-
"cloudformation:DescribeStackEvents",
31-
"cloudformation:ListStackResources",
32-
"cloudformation:CreateChangeSet",
33-
"ec2:DescribeSubnets",
34-
"ec2:DescribeSecurityGroups",
35-
"ec2:DescribeVpcs",
36-
"iam:ListRoles",
37-
"iam:GetRolePolicy",
38-
"iam:GetRole",
39-
"iam:DeleteRolePolicy",
40-
"iam:CreateRole",
41-
"iam:DetachRolePolicy",
42-
"iam:PassRole",
43-
"iam:PutRolePolicy",
44-
"iam:DeleteRole",
45-
"iam:AttachRolePolicy",
46-
"lambda:AddPermission",
47-
"lambda:RemovePermission",
48-
"lambda:InvokeFunction",
49-
"lambda:GetFunction",
50-
"lambda:CreateFunction",
51-
"lambda:DeleteFunction",
52-
"lambda:TagResource",
53-
"codestar-connections:GetSyncConfiguration",
54-
"ecr:BatchGetImage",
55-
"ecr:GetDownloadUrlForLayer",
56-
"scheduler:GetSchedule",
57-
"scheduler:CreateSchedule",
58-
"scheduler:DeleteSchedule",
59-
"logs:PutRetentionPolicy",
60-
"secretsmanager:GetSecretValue", (on specific secert)
27+
1. You should have an AWS Account with the following permissions to create and manage resources:
28+
"cloudformation:DescribeStacks",
29+
"cloudformation:ListStacks",
30+
"cloudformation:DescribeStackEvents",
31+
"cloudformation:ListStackResources",
32+
"cloudformation:CreateChangeSet",
33+
"ec2:DescribeSubnets",
34+
"ec2:DescribeSecurityGroups",
35+
"ec2:DescribeVpcs",
36+
"iam:ListRoles",
37+
"iam:GetRolePolicy",
38+
"iam:GetRole",
39+
"iam:DeleteRolePolicy",
40+
"iam:CreateRole",
41+
"iam:DetachRolePolicy",
42+
"iam:PassRole",
43+
"iam:PutRolePolicy",
44+
"iam:DeleteRole",
45+
"iam:AttachRolePolicy",
46+
"lambda:AddPermission",
47+
"lambda:RemovePermission",
48+
"lambda:InvokeFunction",
49+
"lambda:GetFunction",
50+
"lambda:CreateFunction",
51+
"lambda:DeleteFunction",
52+
"lambda:TagResource",
53+
"codestar-connections:GetSyncConfiguration",
54+
"ecr:BatchGetImage",
55+
"ecr:GetDownloadUrlForLayer",
56+
"scheduler:GetSchedule",
57+
"scheduler:CreateSchedule",
58+
"scheduler:DeleteSchedule",
59+
"logs:PutRetentionPolicy",
60+
"secretsmanager:GetSecretValue", (on specific secert)
6161
62-
2. Optional: create a secret in AWS Secrets Manager with key-value pairs of file system IDs and their corresponding fsxadmin
63-
passwords. This secret is necessary for making direct ONTAP API calls to monitor resources, such as SnapMirror relations.
64-
Example secret structure:
65-
{
66-
"fs-111222333": "Password1",
67-
"fs-444555666": "Password2"
68-
}
69-
When deploying the CloudFormation template, you will need to provide the ARN of this secret as a parameter. This allows the Lambda to securely access the passwords for monitoring purposes.
70-
Note: If you choose not to provide this secret, some monitoring capabilities (such as SnapMirror relations metrics) may be limited.
62+
2. Optional: create a secret in AWS Secrets Manager with key-value pairs of file system IDs and their corresponding fsxadmin
63+
passwords. This secret is necessary for making direct ONTAP API calls to monitor resources, such as SnapMirror relations.
64+
Example secret structure:
65+
```
66+
{
67+
"fs-111222333": "Password1",
68+
"fs-444555666": "Password2"
69+
}
70+
```
71+
When deploying the CloudFormation template, you will need to provide the ARN of this secret as a parameter. This allows the Lambda to securely access the passwords for monitoring purposes.
72+
Note: If you choose not to provide this secret, some monitoring capabilities (such as SnapMirror relations metrics) may be limited.
7173

7274

7375
## Usage
74-
To use this solution, you will need to run the CloudFormation template in your AWS account.
75-
The CloudFormation template requires the following parameters:
76+
To use this solution, you will need to run the CloudFormation template in your AWS account.
77+
The CloudFormation template requires the following parameters:
7678

77-
1. Stack name - Identifier for the CloudFormation stack. Must not exceed 25 characters. (Note: While AWS permits stack names up to
78-
128 characters, limit yours to 25. This name is used in or concatenated with resource names created within the stack, so keeping it short prevents issues with resource naming length limits.)
79-
2. VPC ID - The ID of the VPC in which the Lambda function will run. This VPC must have connectivity to all target file systems. It
80-
can be either the same VPC where the file systems are located, or a different VPC with established connectivity (e.g., VPC peering, Transit Gateway) to the file systems' VPCs.
81-
3. Subnet IDs - The IDs of the subnets in which the Lambda function will run. These subnets must have connectivity to the file
82-
systems.
83-
4. Security Group IDs - The IDs of the Security Groups that will be associated with the Lambda function when it runs. These Security
84-
Groups must allow connectivity to the file systems.
85-
5. Create Fsx Service Endpoint - A boolean flag indicating whether you plan to create a FsxService VPC endpoint inside the VPC. Set
86-
this to true if you want to create the endpoint, or false if you don't. The decision to create this endpoint depends on whether you already have this type of endpoint. If you already have one, set this to false; otherwise, set it to true.
87-
6. Create Secret Manager Endpoint - A boolean flag indicating whether you plan to create a SecretManager VPC endpoint inside the
88-
VPC. Set this to true if you want to create the endpoint, or false if you don't. The decision to create this endpoint depends on whether you already have this type of endpoint. If you already have one, set this to false; otherwise, set it to true.
89-
7. Create CloudWatch Endpoint - A boolean flag indicating whether you plan to create a CloudWatch VPC endpoint inside the VPC. Set
90-
this to true if you want to create the endpoint, or false if you don't. The decision to create this endpoint depends on whether you already have this type of endpoint. If you already have one, set this to false; otherwise, set it to true.
91-
8. Secret Manager FSx Admin Passwords ARN - Optional - The ARN of the AWS Secrets Manager secret containing the fsxadmin passwords.
92-
This ARN is required for certain functionalities, such as snapmirror metrics collection.
93-
If not provided, some features may not operate correctly. This secret should contain key-value pairs.
94-
The key is the File System ID, and the value is the password. For example:
95-
{"fs-111222333":"Password1","fs-444555666":"Password2"}
79+
1. Stack name - Identifier for the CloudFormation stack. Must not exceed 25 characters. (Note: While AWS permits stack names up to
80+
128 characters, limit yours to 25. This name is used in or concatenated with resource names created within the stack, so keeping it short prevents issues with resource naming length limits.)
81+
2. VPC ID - The ID of the VPC in which the Lambda function will run. This VPC must have connectivity to all target file systems. It
82+
can be either the same VPC where the file systems are located, or a different VPC with established connectivity (e.g., VPC peering, Transit Gateway) to the file systems' VPCs.
83+
3. Subnet IDs - The IDs of the subnets in which the Lambda function will run. These subnets must have connectivity to the file
84+
systems.
85+
4. Security Group IDs - The IDs of the Security Groups that will be associated with the Lambda function when it runs. These Security
86+
Groups must allow connectivity to the file systems.
87+
5. Create Fsx Service Endpoint - A boolean flag indicating whether you plan to create a FsxService VPC endpoint inside the VPC. Set
88+
this to true if you want to create the endpoint, or false if you don't. The decision to create this endpoint depends on whether you already have this type of endpoint. If you already have one, set this to false; otherwise, set it to true.
89+
6. Create Secret Manager Endpoint - A boolean flag indicating whether you plan to create a SecretManager VPC endpoint inside the
90+
VPC. Set this to true if you want to create the endpoint, or false if you don't. The decision to create this endpoint depends on whether you already have this type of endpoint. If you already have one, set this to false; otherwise, set it to true.
91+
7. Create CloudWatch Endpoint - A boolean flag indicating whether you plan to create a CloudWatch VPC endpoint inside the VPC. Set
92+
this to true if you want to create the endpoint, or false if you don't. The decision to create this endpoint depends on whether you already have this type of endpoint. If you already have one, set this to false; otherwise, set it to true.
93+
8. Secret Manager FSx Admin Passwords ARN - Optional - The ARN of the AWS Secrets Manager secret containing the fsxadmin passwords.
94+
This ARN is required for certain functionalities, such as snapmirror metrics collection.
95+
If not provided, some features may not operate correctly. This secret should contain key-value pairs.
96+
The key is the File System ID, and the value is the password. For example:
97+
```
98+
{
99+
"fs-111222333":"Password1",
100+
"fs-444555666":"Password2"
101+
}
102+
```
96103

97104
## Important Disclaimer: CloudWatch Alarms Deletion
105+
Please note that when you delete the CloudFormation stack associated with this project, the CloudWatch Alarms created by the stack will not be automatically deleted.
98106

99-
Please note that when you delete the CloudFormation stack associated with this project, the CloudWatch Alarms created by the stack will not be automatically deleted.
107+
CloudFormation does not manage the lifecycle of CloudWatch Alarms created by the Lambda. This means that even after stack deletion, these alarms will persist in your AWS account.
100108

101-
CloudFormation does not manage the lifecycle of CloudWatch Alarms created by the Lambda. This means that even after stack deletion, these alarms will persist in your AWS account.
109+
To fully clean up resources after using this solution:
110+
1. Delete the CloudFormation stack as usual.
111+
2. Manually review and delete any associated CloudWatch Alarms through the AWS Console or using AWS CLI/SDK.
112+
You can find the alarms by searching for the name prefix "FSx-ONTAP" in the CloudWatch Alarms section.
102113

103-
To fully clean up resources after using this solution:
104-
105-
1. Delete the CloudFormation stack as usual.
106-
2. Manually review and delete any associated CloudWatch Alarms through the AWS Console or using AWS CLI/SDK.
107-
You can find the alarms by searching for the name prefix "FSx-ONTAP" in the CloudWatch Alarms section.
108-
109-
This behavior ensures that important monitoring setups are not unintentionally removed, but it requires additional steps for complete resource cleanup.
114+
This behavior ensures that important monitoring setups are not unintentionally removed, but it requires additional steps for complete resource cleanup.
110115

111116

112117
## Author Information
113-
This repository is maintained by the contributors listed on GitHub.
118+
This repository is maintained by the contributors listed on GitHub.
114119

115120
## License
116-
Licensed under the Apache License, Version 2.0 (the "License").
121+
Licensed under the Apache License, Version 2.0 (the "License").
117122

118-
You may obtain a copy of the License at apache.org/licenses/LICENSE-2.0.
123+
You may obtain a copy of the License at apache.org/licenses/LICENSE-2.0.
119124

120-
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" basis, without WARRANTIES or conditions of any kind, either express or implied.
125+
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" basis, without WARRANTIES or conditions of any kind, either express or implied.
121126

122-
See the License for the specific language governing permissions and limitations under the License.
127+
See the License for the specific language governing permissions and limitations under the License.

‎Monitoring/CloudWatch-FSx/cloudformation-template.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@
298298
}
299299
},
300300
"PackageType": "Image",
301-
"Timeout": 30,
301+
"Timeout": 90,
302302
"Environment": {
303303
"Variables": {
304304
"NODE_TLS_REJECT_UNAUTHORIZED": "0",
@@ -1108,7 +1108,7 @@
11081108
"type": "metric",
11091109
"properties": {
11101110
"metrics": [
1111-
[ "AWS/FSx", "StorageCapacityUtilization", "VolumeId", "\"\"", "StorageTier", "SSD", "FileSystemId", "\"\"", "DataType", "All", { "id": "m1", "region": {"Ref": "AWS::Region"} } ]
1111+
[ "AWS/FSx", "StorageCapacityUtilization", "VolumeId", "\"\"", "FileSystemId", "\"\"", { "region": {"Ref": "AWS::Region"} } ]
11121112
],
11131113
"yAxis": {
11141114
"left": {
@@ -1119,7 +1119,7 @@
11191119
"view": "timeSeries",
11201120
"stacked": false,
11211121
"region": {"Ref": "AWS::Region"},
1122-
"stat": "Maximum",
1122+
"stat": "Average",
11231123
"period": 300,
11241124
"title": "Volume Utilization"
11251125
}

0 commit comments

Comments
 (0)