AWS

Amazon Web Services (AWS) is a subsidiary of Amazon.com that provides on-demand cloud computing platforms on a paid subscription basis. The technology allows subscribers to have at their disposal a virtual cluster of computers, available all the time, through the Internet.

Available solutions

Zabbix version 7.4 7.2 7.0 6.4 6.2 6.0
Source: templates/cloud/AWS/aws_http

AWS by HTTP

Overview

This template is designed for the effortless deployment of AWS monitoring by Zabbix via HTTP and doesn't require any external scripts.

  • Currently, the template supports the discovery of EC2 and RDS instances, ECS clusters, ELB, Lambda, S3 buckets, and backup vaults.

Included Monitoring Templates

  • AWS EC2 by HTTP
  • AWS ECS Cluster by HTTP
  • AWS ECS Serverless Cluster by HTTP
  • AWS ELB Application Load Balancer by HTTP
  • AWS ELB Network Load Balancer by HTTP
  • AWS Lambda by HTTP
  • AWS RDS instance by HTTP
  • AWS S3 bucket by HTTP
  • AWS Cost Explorer by HTTP
  • AWS Backup Vault by HTTP

Requirements

Zabbix version: 7.4 and higher.

Tested versions

This template has been tested on:

  • AWS by HTTP

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

Before using the template, you need to create an IAM policy for the Zabbix role in your AWS account with the necessary permissions.

Required Permissions

Add the following required permissions to your Zabbix IAM policy in order to collect metrics.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData",
                "ec2:DescribeInstances",
                "ec2:DescribeVolumes",
                "ec2:DescribeRegions",
                "rds:DescribeEvents",
                "rds:DescribeDBInstances",
                "ecs:DescribeClusters",
                "ecs:ListServices",
                "ecs:ListTasks",
                "ecs:ListClusters",
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation",
                "s3:GetMetricsConfiguration",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTargetGroups",
                "ec2:DescribeSecurityGroups",
                "lambda:ListFunctions",
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

Access Key Authorization

If you are using access key authorization, you need to generate an access key and secret key for an IAM user with the necessary permissions:

  1. Create an IAM user with programmatic access.
  2. Attach the required policy to the IAM user.
  3. Generate an access key and secret key.
  4. Use the generated credentials in the macros {$AWS.ACCESS.KEY.ID} and {$AWS.SECRET.ACCESS.KEY}.

Assume Role Authorization

For using assume role authorization, add the appropriate permissions to the role you are using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::{Account}:user/{UserName}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData",
                "ec2:DescribeInstances",
                "ec2:DescribeVolumes",
                "ec2:DescribeRegions",
                "rds:DescribeEvents",
                "rds:DescribeDBInstances",
                "ecs:DescribeClusters",
                "ecs:ListServices",
                "ecs:ListTasks",
                "ecs:ListClusters",
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation",
                "s3:GetMetricsConfiguration",
                "ec2:AssociateIamInstanceProfile",
                "ec2:ReplaceIamInstanceProfileAssociation",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTargetGroups",
                "ec2:DescribeSecurityGroups",
                "lambda:ListFunctions",
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Resource": "*"
        }
    ]
}

Trust Relationships for Assume Role Authorization

Next, add a principal to the trust relationships of the role you are using:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{Account}:user/{UserName}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Set the following macros: {$AWS.ACCESS.KEY.ID}, {$AWS.SECRET.ACCESS.KEY}, {$AWS.STS.REGION}, {$AWS.ASSUME.ROLE.ARN}.

Note: If you set the {$AWS.ASSUME.ROLE.AUTH.METADATA} macro to true and set the macros {$AWS.STS.REGION} and {$AWS.ASSUME.ROLE.ARN}, the Zabbix server or proxy will attempt to retrieve the role credentials from the instance metadata service. This means that the Zabbix server or proxy must be running on an AWS EC2 instance with an IAM role assigned that has the necessary permissions. This approach is recommended when running Zabbix inside an AWS EC2 instance with an IAM role assigned, as it simplifies credential management.

Role-Based Authorization

If you are using role-based authorization, add the appropriate permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::<<--account-id-->>:role/<<--role_name-->>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData",
                "ec2:DescribeInstances",
                "ec2:DescribeVolumes",
                "ec2:DescribeRegions",
                "rds:DescribeEvents",
                "rds:DescribeDBInstances",
                "ecs:DescribeClusters",
                "ecs:ListServices",
                "ecs:ListTasks",
                "ecs:ListClusters",
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation",
                "s3:GetMetricsConfiguration",
                "ec2:AssociateIamInstanceProfile",
                "ec2:ReplaceIamInstanceProfileAssociation",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTargetGroups",
                "ec2:DescribeSecurityGroups",
                "lambda:ListFunctions",
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Resource": "*"
        }
    ]
}

Trust Relationships for Role-Based Authorization

Next, add a principal to the trust relationships of the role you are using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "ec2.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}

Note: Using role-based authorization is only possible when you use a Zabbix server or proxy inside AWS.

To gather Request metrics, enable Requests metrics on your Amazon S3 buckets from the AWS console.

Set the macros: {$AWS.AUTH_TYPE}. Possible values: access_key, assume_role, role_base.

For more information about managing access keys, see official documentation.

Refer to the Macros section for a list of macros used for LLD filters.

Additional information about the metrics and used API methods:

Macros used

Name Description Default
{$AWS.AUTH_TYPE}

Authorization method. Possible values: access_key, assume_role, role_base.

 access_key
{$AWS.ASSUME.ROLE.AUTH.METADATA}

Add when using the assume_role through instance metadata or environment authorization method. Possible values: false, true.

 false
{$AWS.ACCESS.KEY.ID}

Access key ID.
{$AWS.SECRET.ACCESS.KEY}

Secret access key.
{$AWS.ASSUME.ROLE.ARN}

ARN assume role; add when using the assume_role authorization method.
{$AWS.PROXY}

Sets HTTP proxy value. If this macro is empty then no proxy is used.
{$HTTP.TLS.VERIFY}

TLS certificate verification for script items: "none" - disabled, "peer" - verify the certificate chain and expiration, "full" - full verification. Any other value enables full verification. To override the setting for this template only, define the macro with the context "AWS", e.g. {$HTTP.TLS.VERIFY:"AWS"}.

 full
{$AWS.REQUEST.REGION}

Region used in GET request ListBuckets.

 us-east-1
{$AWS.DESCRIBE.REGION}

Region used in POST request DescribeRegions.

 us-east-1
{$AWS.STS.REGION}

Region used in assume role request.

 us-east-1
{$AWS.DATA.TIMEOUT}

A response timeout for an API.

 60s
{$AWS.EC2.LLD.FILTER.NAME.MATCHES}

Filter of discoverable EC2 instances by namespace.

 .*
{$AWS.EC2.LLD.FILTER.NAME.NOT_MATCHES}

Filter to exclude discovered EC2 instances by namespace.

 CHANGE_IF_NEEDED
{$AWS.EC2.LLD.FILTER.REGION.MATCHES}

Filter of discoverable EC2 instances by region.

 .*
{$AWS.EC2.LLD.FILTER.REGION.NOT_MATCHES}

Filter to exclude discovered EC2 instances by region.

 CHANGE_IF_NEEDED
{$AWS.ECS.LLD.FILTER.NAME.MATCHES}

Filter of discoverable ECS clusters by name.

 .*
{$AWS.ECS.LLD.FILTER.NAME.NOT_MATCHES}

Filter to exclude discovered ECS clusters by name.

 CHANGE_IF_NEEDED
{$AWS.ECS.LLD.FILTER.STATUS.MATCHES}

Filter of discoverable ECS clusters by status.

 ACTIVE
{$AWS.ECS.LLD.FILTER.STATUS.NOT_MATCHES}

Filter to exclude discovered ECS clusters by status.

 CHANGE_IF_NEEDED
{$AWS.S3.LLD.FILTER.NAME.MATCHES}

Filter of discoverable S3 buckets by namespace.

 .*
{$AWS.S3.LLD.FILTER.NAME.NOT_MATCHES}

Filter to exclude discovered S3 buckets by namespace.

 CHANGE_IF_NEEDED
{$AWS.RDS.LLD.FILTER.NAME.MATCHES}

Filter of discoverable RDS instances by namespace.

 .*
{$AWS.RDS.LLD.FILTER.NAME.NOT_MATCHES}

Filter to exclude discovered RDS instances by namespace.

 CHANGE_IF_NEEDED
{$AWS.RDS.LLD.FILTER.REGION.MATCHES}

Filter of discoverable RDS instances by region.

 .*
{$AWS.RDS.LLD.FILTER.REGION.NOT_MATCHES}

Filter to exclude discovered RDS instances by region.

 CHANGE_IF_NEEDED
{$AWS.ECS.LLD.FILTER.REGION.MATCHES}

Filter of discoverable ECS clusters by region.

 .*
{$AWS.ECS.LLD.FILTER.REGION.NOT_MATCHES}

Filter to exclude discovered ECS clusters by region.

 CHANGE_IF_NEEDED
{$AWS.ELB.LLD.FILTER.NAME.MATCHES}

Filter of discoverable ELB load balancers by name.

 .*
{$AWS.ELB.LLD.FILTER.NAME.NOT_MATCHES}

Filter to exclude discovered ELB load balancers by name.

 CHANGE_IF_NEEDED
{$AWS.ELB.LLD.FILTER.REGION.MATCHES}

Filter of discoverable ELB load balancers by region.

 .*
{$AWS.ELB.LLD.FILTER.REGION.NOT_MATCHES}

Filter to exclude discovered ELB load balancers by region.

 CHANGE_IF_NEEDED
{$AWS.ELB.LLD.FILTER.STATE.MATCHES}

Filter of discoverable ELB load balancers by status.

 active
{$AWS.ELB.LLD.FILTER.STATE.NOT_MATCHES}

Filter to exclude discovered ELB load balancer by status.

 CHANGE_IF_NEEDED
{$AWS.LAMBDA.LLD.FILTER.REGION.MATCHES}

Filter of discoverable Lambda functions by region.

 .*
{$AWS.LAMBDA.LLD.FILTER.REGION.NOT_MATCHES}

Filter to exclude discovered Lambda functions by region.

 CHANGE_IF_NEEDED
{$AWS.LAMBDA.LLD.FILTER.RUNTIME.MATCHES}

Filter of discoverable Lambda functions by Runtime.

 .*
{$AWS.LAMBDA.LLD.FILTER.RUNTIME.NOT_MATCHES}

Filter to exclude discovered Lambda functions by Runtime.

 CHANGE_IF_NEEDED
{$AWS.LAMBDA.LLD.FILTER.NAME.MATCHES}

Filter of discoverable Lambda functions by name.

 .*
{$AWS.LAMBDA.LLD.FILTER.NAME.NOT_MATCHES}

Filter to exclude discovered Lambda functions by name.

 CHANGE_IF_NEEDED
{$AWS.BACKUP_VAULT.LLD.FILTER.NAME.MATCHES}

Filter of discoverable backup vaults by name.

 .*
{$AWS.BACKUP_VAULT.LLD.FILTER.NAME.NOT_MATCHES}

Filter to exclude discovered backup vaults by name.

 CHANGE_IF_NEEDED
{$AWS.BACKUP_VAULT.LLD.FILTER.REGION.MATCHES}

Filter of discoverable backup vaults by region.

 .*
{$AWS.BACKUP_VAULT.LLD.FILTER.REGION.NOT_MATCHES}

Filter to exclude discovered backup vaults by region.

 CHANGE_IF_NEEDED

LLD rule S3 buckets discovery

Name Description Type Key and additional info
S3 buckets discovery

Get S3 bucket instances.

 Script aws.s3.discovery

LLD rule EC2 instances discovery

Name Description Type Key and additional info
EC2 instances discovery

Get EC2 instances.

 Script aws.ec2.discovery

LLD rule RDS instances discovery

Name Description Type Key and additional info
RDS instances discovery

Get RDS instances.

 Script aws.rds.discovery

LLD rule ECS clusters discovery

Name Description Type Key and additional info
ECS clusters discovery

Get ECS clusters.

 Script aws.ecs.discovery

LLD rule ELB load balancers discovery

Name Description Type Key and additional info
ELB load balancers discovery

Get ELB load balancers.

 Script aws.elb.discovery

LLD rule Lambda discovery

Name Description Type Key and additional info
Lambda discovery

Get Lambda functions.

 Script aws.lambda.discovery

LLD rule Backup vault discovery

Name Description Type Key and additional info
Backup vault discovery

Get backup vaults.

 Script aws.backup_vault.discovery

Articles and documentation

+ Propose new article

Sie können die Integration nicht finden, die Sie benötigen?

Request custom integration

Zabbix integration team will develop custom integration based on your requirements and Zabbix best practices.

Request

Propose integration

Have you already developed high quality integration and want to submit to Zabbix integration repository?

Propose