Skip to content

Commit 38dc59a

Browse files
esc1144esc1144
committed
Merge branch 'main' into instrumentation
2 parents fdfc9c6 + 75814df commit 38dc59a

13 files changed

+1890
-13
lines changed

‎data-collection/deploy/deploy-data-collection.yaml‎

Lines changed: 82 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
AWSTemplateFormatVersion: '2010-09-09'
2-
Description: CID Data Collection Stack v3.6.4
2+
Description: CID Data Collection Stack v3.8.0
33
Metadata:
44
AWS::CloudFormation::Interface:
55
ParameterGroups:
@@ -30,13 +30,22 @@ Metadata:
3030
- IncludeInventoryCollectorModule
3131
- IncludeOrgDataModule
3232
- IncludeRDSUtilizationModule
33+
- IncludeEUCUtilizationModule
3334
- IncludeRightsizingModule
3435
- IncludeTAModule
3536
- IncludeTransitGatewayModule
3637
- IncludeAWSFeedsModule
3738
- IncludeLicenseManagerModule
3839
- IncludeQuickSightModule
3940
- IncludeServiceQuotasModule
41+
- Label:
42+
default: 'EUC Module Configuration'
43+
Parameters:
44+
- IncludeEUCUtilizationModule
45+
- Label:
46+
default: 'EUC Module Settings'
47+
Parameters:
48+
- EUCAccountIDs
4049
ParameterLabels:
4150
DestinationBucket:
4251
default: 'Destination S3 bucket prefix'
@@ -76,6 +85,10 @@ Metadata:
7685
default: 'Include ECS Chargeback Data Collection Module'
7786
IncludeRDSUtilizationModule:
7887
default: 'Include RDS Utilization Data Collection Module'
88+
IncludeEUCUtilizationModule:
89+
default: 'Include WorkSpaces Utilization Data Collection Module'
90+
EUCAccountIDs:
91+
default: 'WorkSpaces Account IDs (optional)'
7992
IncludeOrgDataModule:
8093
default: 'Include AWS Organization Data Collection Module'
8194
IncludeBudgetsModule:
@@ -140,11 +153,11 @@ Parameters:
140153
Default: "Optimization-Data-Multi-Account-Role"
141154
Schedule:
142155
Type: String
143-
Description: EventBridge schedule to trigger data collection for Trusted Advisor, Compute Optimizer, Organizations Data, Rightsizing, RDS Utilization, Inventory Collector, Transit Gateway, Backup, and ECS Chargeback modules (see docs for tailoring the schedule for each module).
156+
Description: "EventBridge schedule to trigger data collection for Trusted Advisor, Compute Optimizer, Organizations Data, Rightsizing, RDS Utilization, Inventory Collector, Transit Gateway, Backup, and ECS Chargeback modules (see docs for tailoring the schedule for each module). Recommended value: rate(14 days). Increasing data collection frequency will trigger additional cost, avoid setting the data collection schedule to more than once per day."
144157
Default: "rate(14 days)"
145158
ScheduleFrequent:
146159
Type: String
147-
Description: EventBridge schedule to trigger data collection for Cost Anomalies, Budgets, Support Cases and Health Events modules (see docs for tailoring the schedule for each module).
160+
Description: "EventBridge schedule to trigger data collection for Cost Anomalies, Budgets, Support Cases and Health Events modules (see docs for tailoring the schedule for each module). Recommended value: rate(1 day). Increasing data collection frequency will trigger additional cost, avoid setting the data collection schedule to more than once per day."
148161
Default: "rate(1 day)"
149162
RegionsInScope:
150163
Type: String
@@ -208,6 +221,15 @@ Parameters:
208221
Description: Collects RDS CloudWatch metrics from your accounts
209222
AllowedValues: ['yes', 'no']
210223
Default: 'no'
224+
IncludeEUCUtilizationModule:
225+
Type: String
226+
Description: Collects WorkSpaces CloudWatch metrics from your accounts
227+
AllowedValues: ['yes', 'no']
228+
Default: 'no'
229+
EUCAccountIDs:
230+
Type: String
231+
Description: "Optional, If you enable EUC Utilization or Inventory module and you use Amazon WorkSpaces, please provide a comma-separated list of account IDs where WorkSpaces are deployed. If left blank, metrics will be collected from all linked accounts in the Organization."
232+
Default: ""
211233
IncludeOrgDataModule:
212234
Type: String
213235
Description: Collects AWS Organizations data such as account Id, account name, organization parent and specified tags
@@ -263,6 +285,7 @@ Conditions:
263285
DeployComputeOptimizerModule: !Equals [ !Ref IncludeComputeOptimizerModule, "yes"]
264286
DeployEcsChargebackModule: !Equals [ !Ref IncludeECSChargebackModule, "yes"]
265287
DeployRDSUtilizationModule: !Equals [ !Ref IncludeRDSUtilizationModule, "yes"]
288+
DeployEUCUtilizationModule: !Equals [ !Ref IncludeEUCUtilizationModule, "yes"]
266289
DeployOrgDataModule: !Equals [ !Ref IncludeOrgDataModule, "yes"]
267290
DeployBudgetsModule: !Equals [ !Ref IncludeBudgetsModule, "yes"]
268291
DeployTransitGatewayModule: !Equals [ !Ref IncludeTransitGatewayModule, "yes"]
@@ -275,6 +298,7 @@ Conditions:
275298
DeployPricingModule: !Or
276299
- !Condition DeployInventoryCollectorModule
277300
- !Condition DeployRDSUtilizationModule
301+
- !Condition DeployEUCUtilizationModule
278302
DeployAccountCollector: !Or
279303
- Fn::Or:
280304
- !Condition DeployTAModule
@@ -294,6 +318,7 @@ Conditions:
294318
- !Condition DeployLicenseManagerModule
295319
- !Condition DeployQuickSightModule
296320
- !Condition DeployServiceQuotasModule
321+
- !Condition DeployEUCUtilizationModule
297322
RegionsInScopeIsEmpty: !Equals
298323
- !Join [ '', !Split [ ' ', !Ref RegionsInScope ] ] # remove spaces
299324
- ""
@@ -1214,6 +1239,60 @@ Resources:
12141239
- !Sub "${AWS::Region}"
12151240
- !Join [ '', !Split [ ' ', !Ref RegionsInScope ] ] # remove spaces
12161241

1242+
EUCUsageModule:
1243+
Type: AWS::CloudFormation::Stack
1244+
Condition: DeployEUCUtilizationModule
1245+
Properties:
1246+
TemplateURL: !Sub "https://${CFNSourceBucket}.s3.${AWS::URLSuffix}/cfn/data-collection/module-workspaces-metrics.yaml"
1247+
Parameters:
1248+
DatabaseName: !Ref DatabaseName
1249+
DataBucketsKmsKeysArns: !Ref DataBucketsKmsKeysArns
1250+
DestinationBucket: !Ref S3Bucket
1251+
DestinationBucketARN: !GetAtt S3Bucket.Arn
1252+
GlueRoleARN: !GetAtt GlueRole.Arn
1253+
MultiAccountRoleName: !Sub "${ResourcePrefix}${MultiAccountRoleName}"
1254+
Schedule: !Ref Schedule
1255+
ResourcePrefix: !Ref ResourcePrefix
1256+
LambdaAnalyticsARN: !GetAtt LambdaAnalytics.Arn
1257+
AccountCollectorLambdaARN: !Sub "${AccountCollector.Outputs.LambdaFunctionARN}"
1258+
CodeBucket: !If [ ProdCFNTemplateUsed, !FindInMap [RegionMap, !Ref "AWS::Region", CodeBucket], !Ref CFNSourceBucket ]
1259+
StepFunctionTemplate: !FindInMap [StepFunctionCode, main-v4-3, TemplatePath]
1260+
StepFunctionExecutionRoleARN: !GetAtt StepFunctionExecutionRole.Arn
1261+
SchedulerExecutionRoleARN: !GetAtt SchedulerExecutionRole.Arn
1262+
EUCAccountIDs: !Ref EUCAccountIDs
1263+
RegionsInScope:
1264+
Fn::If:
1265+
- RegionsInScopeIsEmpty
1266+
- !Sub "${AWS::Region}"
1267+
- !Join [ '', !Split [ ' ', !Ref RegionsInScope ] ] # remove spaces
1268+
1269+
EUCUsageModule:
1270+
Type: AWS::CloudFormation::Stack
1271+
Condition: DeployEUCUtilizationModule
1272+
Properties:
1273+
TemplateURL: !Sub "https://${CFNSourceBucket}.s3.${AWS::URLSuffix}/cfn/data-collection/module-workspaces-metrics.yaml"
1274+
Parameters:
1275+
DatabaseName: !Ref DatabaseName
1276+
DataBucketsKmsKeysArns: !Ref DataBucketsKmsKeysArns
1277+
DestinationBucket: !Ref S3Bucket
1278+
DestinationBucketARN: !GetAtt S3Bucket.Arn
1279+
GlueRoleARN: !GetAtt GlueRole.Arn
1280+
MultiAccountRoleName: !Sub "${ResourcePrefix}${MultiAccountRoleName}"
1281+
Schedule: !Ref Schedule
1282+
ResourcePrefix: !Ref ResourcePrefix
1283+
LambdaAnalyticsARN: !GetAtt LambdaAnalytics.Arn
1284+
AccountCollectorLambdaARN: !Sub "${AccountCollector.Outputs.LambdaFunctionARN}"
1285+
CodeBucket: !If [ ProdCFNTemplateUsed, !FindInMap [RegionMap, !Ref "AWS::Region", CodeBucket], !Ref CFNSourceBucket ]
1286+
StepFunctionTemplate: !FindInMap [StepFunctionCode, main-v3, TemplatePath]
1287+
StepFunctionExecutionRoleARN: !GetAtt StepFunctionExecutionRole.Arn
1288+
SchedulerExecutionRoleARN: !GetAtt SchedulerExecutionRole.Arn
1289+
EUCAccountIDs: !Ref EUCAccountIDs
1290+
RegionsInScope:
1291+
Fn::If:
1292+
- RegionsInScopeIsEmpty
1293+
- !Sub "${AWS::Region}"
1294+
- !Join [ '', !Split [ ' ', !Ref RegionsInScope ] ] # remove spaces
1295+
12171296
OrgDataModule:
12181297
Type: AWS::CloudFormation::Stack
12191298
Condition: DeployOrgDataModule

‎data-collection/deploy/deploy-data-read-permissions.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
AWSTemplateFormatVersion: "2010-09-09"
2-
Description: CID Data Collection - All-in-One for Management Account v3.6.4
2+
Description: CID Data Collection - All-in-One for Management Account v3.8.0
33
Metadata:
44
AWS::CloudFormation::Interface:
55
ParameterGroups:
@@ -25,6 +25,7 @@ Metadata:
2525
- IncludeHealthEventsModule
2626
- IncludeInventoryCollectorModule
2727
- IncludeRDSUtilizationModule
28+
- IncludeEUCUtilizationModule
2829
- IncludeRightsizingModule
2930
- IncludeTAModule
3031
- IncludeTransitGatewayModule
@@ -59,6 +60,8 @@ Metadata:
5960
default: "Include Inventory Collector Module"
6061
IncludeRDSUtilizationModule:
6162
default: "Include RDS Utilization Data Collection Module"
63+
IncludeEUCUtilizationModule:
64+
default: "Include WorkSpaces Utilization Data Collection Module"
6265
IncludeRightsizingModule:
6366
default: "Include Rightsizing Recommendations Data Collection Module"
6467
IncludeTAModule:
@@ -138,6 +141,11 @@ Parameters:
138141
Description: Collects RDS CloudWatch metrics from your accounts
139142
AllowedValues: ['yes', 'no']
140143
Default: 'no'
144+
IncludeEUCUtilizationModule:
145+
Type: String
146+
Description: Collects WorkSpaces CloudWatch metrics from your accounts
147+
AllowedValues: ['yes', 'no']
148+
Default: 'no'
141149
IncludeRightsizingModule:
142150
Type: String
143151
Description: "Collects AWS Cost Explorer Rightsizing Recommendations"
@@ -208,13 +216,14 @@ Resources:
208216
IncludeInventoryCollectorModule: !Ref IncludeInventoryCollectorModule
209217
IncludeECSChargebackModule: !Ref IncludeECSChargebackModule
210218
IncludeRDSUtilizationModule: !Ref IncludeRDSUtilizationModule
219+
IncludeEUCUtilizationModule: !Ref IncludeEUCUtilizationModule
211220
IncludeBudgetsModule: !Ref IncludeBudgetsModule
212221
IncludeTransitGatewayModule: !Ref IncludeTransitGatewayModule
213222
IncludeServiceQuotasModule: !Ref IncludeServiceQuotasModule
214223
DataCollectorOrgAccountModulesReadStackSet:
215224
Type: AWS::CloudFormation::StackSet
216225
Properties:
217-
Description: "StackSet in charge of deploying read roles across organization accounts v3.6.4"
226+
Description: "StackSet in charge of deploying read roles across organization accounts v3.8.0"
218227
PermissionModel: SERVICE_MANAGED
219228
AutoDeployment:
220229
Enabled: true
@@ -242,6 +251,8 @@ Resources:
242251
ParameterValue: !Ref IncludeECSChargebackModule
243252
- ParameterKey: IncludeRDSUtilizationModule
244253
ParameterValue: !Ref IncludeRDSUtilizationModule
254+
- ParameterKey: IncludeEUCUtilizationModule
255+
ParameterValue: !Ref IncludeEUCUtilizationModule
245256
- ParameterKey: IncludeBudgetsModule
246257
ParameterValue: !Ref IncludeBudgetsModule
247258
- ParameterKey: IncludeTransitGatewayModule

‎data-collection/deploy/deploy-in-linked-account.yaml‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
AWSTemplateFormatVersion: '2010-09-09'
2-
Description: CID Data Collection - Role for Linked Account v3.6.4
2+
Description: CID Data Collection - Role for Linked Account v3.8.0
33
Metadata:
44
AWS::CloudFormation::Interface:
55
ParameterGroups:
@@ -16,6 +16,7 @@ Metadata:
1616
- IncludeECSChargebackModule
1717
- IncludeInventoryCollectorModule
1818
- IncludeRDSUtilizationModule
19+
- IncludeEUCUtilizationModule
1920
- IncludeTAModule
2021
- IncludeSupportCasesModule
2122
- IncludeTransitGatewayModule
@@ -37,6 +38,8 @@ Metadata:
3738
default: 'Include ECS Chargeback Data Collection Module'
3839
IncludeRDSUtilizationModule:
3940
default: 'Include RDS Utilization Data Collection Module'
41+
IncludeEUCUtilizationModule:
42+
default: 'Include WorkSpaces Utilization Data Collection Module'
4043
IncludeBudgetsModule:
4144
default: 'Include Budgets Collection Module'
4245
IncludeTransitGatewayModule:
@@ -81,6 +84,11 @@ Parameters:
8184
Description: Collects RDS CloudWatch metrics from your accounts
8285
AllowedValues: ['yes', 'no']
8386
Default: 'no'
87+
IncludeEUCUtilizationModule:
88+
Type: String
89+
Description: Collects WorkSpaces CloudWatch metrics from your accounts
90+
AllowedValues: ['yes', 'no']
91+
Default: 'no'
8492
IncludeBudgetsModule:
8593
Type: String
8694
Description: Collects budgets from your accounts
@@ -113,6 +121,9 @@ Conditions:
113121
IncludeRDSUtilizationModulePolicy: !Equals
114122
- !Ref IncludeRDSUtilizationModule
115123
- "yes"
124+
IncludeEUCUtilizationModulePolicy: !Equals
125+
- !Ref IncludeEUCUtilizationModule
126+
- "yes"
116127
IncludeBudgetsModulePolicy: !Equals
117128
- !Ref IncludeBudgetsModule
118129
- "yes"
@@ -146,6 +157,7 @@ Resources:
146157
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}budgets-LambdaRole"
147158
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}ecs-chargeback-LambdaRole"
148159
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}inventory-LambdaRole"
160+
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}workspaces-metrics-LambdaRole"
149161
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}rds-usage-LambdaRole"
150162
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}transit-gateway-LambdaRole"
151163
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}trusted-advisor-LambdaRole"
@@ -241,6 +253,9 @@ Resources:
241253
- "eks:ListNodegroups"
242254
- "eks:DescribeNodegroup"
243255
- "lambda:ListFunctions"
256+
- "workspaces:DescribeWorkspaces"
257+
- "workspaces:DescribeWorkspaceDirectories"
258+
- "workspaces:DescribeWorkspacesConnectionStatus"
244259
Resource: "*" ## Policy is used for scanning of a wide range of resources
245260
Roles:
246261
- Ref: LambdaRole
@@ -295,6 +310,32 @@ Resources:
295310
rules_to_suppress:
296311
- id: W12
297312
reason: "Policy is used for scanning of a wide range of resources"
313+
EUCUtilizationPolicy:
314+
Type: 'AWS::IAM::Policy'
315+
Condition: IncludeEUCUtilizationModulePolicy
316+
Properties:
317+
PolicyName: EUCUtilizationPolicy
318+
PolicyDocument:
319+
Version: "2012-10-17"
320+
Statement:
321+
- Effect: "Allow"
322+
Action:
323+
- "workspaces:DescribeWorkspaces"
324+
Resource: "*" ## Policy is used for scanning of a wide range of resources
325+
- Effect: "Allow"
326+
Action:
327+
- "ec2:DescribeRegions"
328+
- "cloudwatch:GetMetricStatistics"
329+
- "cloudwatch:ListMetrics"
330+
Resource: "*" ## Policy is used for scanning of a wide range of resources
331+
Roles:
332+
- Ref: LambdaRole
333+
Metadata:
334+
cfn_nag:
335+
rules_to_suppress:
336+
- id: W12
337+
reason: "Policy is used for scanning of a wide range of resources"
338+
298339
TransitGatewayPolicy:
299340
Type: 'AWS::IAM::Policy'
300341
Condition: IncludeTransitGatewayModulePolicy

‎data-collection/deploy/deploy-in-management-account.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
AWSTemplateFormatVersion: '2010-09-09'
2-
Description: CID Data Collection - Role for Management Account v3.6.4
2+
Description: CID Data Collection - Role for Management Account v3.8.0
33
Metadata:
44
AWS::CloudFormation::Interface:
55
ParameterGroups:

‎data-collection/deploy/module-compute-optimizer.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -330,7 +330,6 @@ Resources:
330330
Status: Enabled
331331
NoncurrentVersionExpiration:
332332
NoncurrentDays: 1
333-
NewerNoncurrentVersions: 1
334333
Tags: # Hacky way to manage dependencies
335334
- Key: IgnoreMeIamOnlyWorkaround
336335
Value: !GetAtt StackSetExecutionRole.Arn

0 commit comments

Comments
 (0)