AWS S3 by HTTP not working?

[bartdb]

Hi,

I use Zabbix 7.0 but I can't seem to get the AWS by HTTP template working. I have configured everyting like it is said here: https://www.zabbix.com/integrations/aws. When I test the queries in the template it self it works (with a high enough timeout value)

When I add the template to a host I get this error and no data is coming in (and I get this error in my discovery rules: Cannot find the "data" array in the received JSON object

Anybody can help?

[cyber]

It probably times out and then cannot find expected json...
As you say .. "When I test the queries in the template it self it works (with a high enough timeout value)"
you may need to increase timeout value for your server/proxy also, so it waits longer for result...

[bartdb]

You mean increase the timeout values under Administration --> General --> Timeouts? I think I should increase the HTTP agent timeout value right? everything is set to 3s as standard value.

[cyber]

I was thinking about https://www.zabbix.com/documentation...server#timeout
But then again.. maybe I was overthinking ... it says "agent, SNMP device or external check" ... Should not affect http agent.. You are still defining that timeout in http item..

[bartdb]

Yeah thanks, got it working. It was related to interval issues

[Javivu]

Yeah thanks, got it working. It was related to interval issues

Hi, i have an issue with AWS S3: get metrics check

Request failed with status code 403: <?xml version="1.0" encoding="UTF-8"?> <Error><Code>AccessDenied</Code><Message>Access Denied</Message>​

Can you explain more detailed "it was related to interval issues" ?? Thaniks!

[Markku]

Request failed with status code 403: <?xml version="1.0" encoding="UTF-8"?> <Error><Code>AccessDenied</Code><Message>Access Denied</Message>​

AccessDenied = your configured AWS access key doesn't have access to whatever the item was trying to do.

Markku

[Javivu]

AccessDenied = your configured AWS access key doesn't have access to whatever the item was trying to do.

Markku

Ok, I think maybe would be the problem, but I config access_key auth with this policie https://git.zabbix.com/projects/ZBX/...Frelease%2F6.4

Any idea?

In other terms, what exactly versión of template i need to use? My zabbix versión is 6.4.10:

• branch "release/6.4" (updated 6 days ago)
• branch "master" (updated 6 days ago)
• tag "6.4.10" (updated 22 sep 2023)

All files are different!!

[Markku]

Sorry, I don't have any experience on that template. You can try to follow the script to see what kind of calls it makes to AWS API, and then verify if your keys are valid for those calls.

For 6.4.x you should use release/6.4 branch.

Markku

[Javivu]

Hi, thanks for your help Markku, OK now I'm using release/6.4 branch:

• EC2 instances are discovered and data is updating
• S3 buckets are discovered but data isn't updating

I'm using this policie config:

"Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:GetMetricData",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListServices",
                "cloudwatch:ListMetrics",
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeVolumes",
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        }
    ]
}​

And the error with a discovered AWS S3 bucket with "AWS S3: Get metrics check" is:

• Request failed with status code 403: <?xml version="1.0" encoding="UTF-8"?> <Error><Code>AccessDenied</Code><Message>Access Denied</Message>

I'm not sure about what metric or data in the script need for Access

Any help?¿ Thanks!

[Markku]

https://git.zabbix.com/projects/ZBX/...Frelease%2F6.4 (the AWS S3 HTTP template) says:

"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricData"

so you are missing at least the first one

Markku

[Markku]

I also see lines like

Zabbix.log(4, '[ AWS S3 ] Sending request: ' + url);

so you may want to increase the Zabbix logging level to see the actual URLs, if they give you some more information.

Markku

[Javivu]

Thanks, added "cloudwatchescribeAlarms" but same error...
I increase logging level to 4... a lot lot of info... i can see:

519122:20231229:120226.342 [ AWS S3 ] Sending request: https://****bucketname****.s3.us-east-1.amazonaws.com/****bucketname****?location=<LocationConstraint xmlns="http://s3.amazonaws.com/doc/2006-03-01/">eu-west-1</LocationConstraint>
519122:20231229:120227.199 [ AWS S3 ] Sending request: https://****bucketname****​.s3.eu-west-1.amazonaws.com/?metrics=​

And no more info or log.... I think like the sending request y Script code, not use the auth methods...

[Markku]

I presume someone has tested the template at some point, so:

1. Re-check all your macros
2. Add some helpful debug logging in the script if you feel it does not work correctly.

Markku

[Javivu]

Thanks for your ideas and helps.... for the moment I have more info about error/problem:

The script have a function getBucketFilterId, this do a call to another funtion AWS.request with this params:

data = AWS.getField(AWS.request('filter_id', 'GET', region, 's3', AWS.prepareParams(payload), '', bucket_name), 'ListMetricsConfigurationsResult');

The url for request is like this format ----> https://bucketname.s3.region.amazonaws.com/?metrics=

This is the call that get error "Acces Denied" the others functions all OK with good return data:

• var region = AWS.getBucketLocation(AWS.params.bucket_name), ----> results Ok no problems
• metrics = AWS.getMetricsData(region), ----> results Ok no problems
• filter_id = AWS.getBucketFilterId(AWS.params.bucket_name, region); --> result with AccesDenied error

I'm trying to understand what is getButcketFilterID() and the request to ?metrics