View this page as a PDF

To learn more watch the following video:

Creating Connections from the Payer Account

In addition to creating connections from your linked accounts, you also need to create a Resource Utilization Metrics (CloudWatch) connection for your payer account. The payer account connection provides additional data when working with reserved instances and savings plans.

Working with Reserved Instances

When working with Reserved Instances you must collect both CloudWatch and billing data from all accounts in which you are using Reserved Instances. Since RIs can be shared between linked accounts they are often purchased through the payer account, so in order to see how the RI's are utilized, you need to collect both CloudWatch and billing data from the payer account.

To learn more watch the video:

When you create a role for cross-account access, you establish trust from the customer's account that owns the role (and the resources (trusting account) to the Densify account containing the user that will collect data (trusted account). You specify the trusted account number as the Principal in the role's trust policy when you create the role. This allows the Densify user in the trusted account to assume the role and collect utilization data.

Creating the IAM Role and Attaching a Permission Policy to Collect CloudWatch Data

This role allows you to collect resource utilization data for the selected account. You need to attach a policy that allows the role to collect the required CloudWatch resource utilization metrics.

1. Log into the AWS Management Console and navigate to Services > Security, Identity & Compliance > IAM. In the navigation tree on the left, click Roles.
2. Click Create Role in the Roles dashboard.
3. Select AWS account as the type of trusted entity.
4. Enter an Account ID. This is the Densify account that will assume the role. Enter the following Densify account ID: 036437403198.
5. Select Require external ID and enter your external ID. This value is similar to a password and should be unique and difficult to guess. Densify recommends using a password generator to create a random, alphanumeric string (e.g. ae73mcf4ldjpet96) for the external ID.

You will need this external ID later, when creating the cloud connection in Densify.

6. Click Next.
Figure: Creating a Role



7. Attach the appropriate permission policy to the role. Select AWS's predefined ReadOnlyAccess policy. Use the filter to find the ReadOnlyAccess policy. Even with the filter set you will need to page through qutie a few options to find the "ReadOnlyAccess" policy.

Note:  The ReadOnlyAccess policy is provided here as an easy option for non-sensitive accounts. In most cases, you need to create a custom permission policy to grant Densify, the permissions to collect only the required CloudWatch data. Refer to Creating an IAM Policy with Minimum Permissions for the CloudWatch Data Collection for details.

Figure: Selecting the ReadOnlyAccess Policy



8. After selecting the permission policy for the role, click Next.
9. In the Review page, specify the Role name and Role description. The role name can be any string used to identify and describe the role within the AWS account (e.g. DensifyCrossAccountRole).
10. Click Create role. The new role is created.
11. From the Roles page, click on the role name that you have just created, to view the role summary.
Figure: Role Summary



12. Copy and save the Role ARN as you will need to paste this string into the Densify Cloud Connection wizard to create the connection.
13. You can now create an AWS connection through the Densify Public Cloud Connection wizard. See Using the Public Cloud Connections Wizard.

You can also use the Densify API. See Analysis: AWS.

Optional Configuration

The following sections contain detailed instructions for optional configuration. Some of this configuration is referenced in the procedures above.

• Resource Tagging
• Creating an IAM Policy with Minimum Permissions for the CloudWatch Data Collection
• Enabling Collection of AWS Memory Usage Metrics

Resource Tagging

You must define your resource tags for the grouping and filtering options to be used effectively. The value of the resource tag can be used for grouping and filtering your AWS instances within Densify. See the following video: Tagging for Cloud Optimization

You must tag your resources appropriately and then map your AWS Resource tags to Densify attributes so the tags will be included in the analyses. Contact [email protected] for details.

Creating an IAM Policy with Minimum Permissions for the CloudWatch Data Collection

To simplify setup and maintenance of either an IAM user account or an IAM role for performing the CloudWatch audit, Densify recommends attaching the AWS-managed “ReadOnlyAccess” policy to the user or role. This policy provides read-only access to your AWS services and resources and supports the requirements of the Densify CloudWatch audit. As the Densify CloudWatch audit continues to evolve and expand, you do not need to update permission policy to include newly added services and features.

Alternatively, if you must restrict the IAM user or role with the minimum permissions to perform the CloudWatch audit, you can create a custom policy with only the required permissions, as shown below.

Note:  This custom policy must be updated periodically as Densify’s standard audit requirements are updated to support additional AWS services and features.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
{
            "Version": "2012-10-17",    
            "Statement": [
                    {
                        "Sid": "Stmt1499171905000",
                        "Effect": "Allow",    
                        "Action": [
                            "autoscaling:DescribeAutoScalingGroups",
                            "autoscaling:DescribeLaunchConfigurations",
                            "cloudformation:DescribeStackResource",
                            "cloudformation:DescribeStackResources",
                            "cloudformation:ListStackInstances",
                            "cloudformation:ListStackResources",
                            "cloudwatch:GetMetricData",
                            "cloudwatch:GetMetricStatistics",    
                            "cloudwatch:ListMetrics",
                            "ec2:DescribeHosts",
                            "ec2:DescribeImages",
                            "ec2:DescribeInstances",
                            "ec2:DescribeLaunchTemplateVersions",
                            "ec2:DescribeRegions",
                            "ec2:DescribeSnapshots",
                            "ec2:DescribeVolumes",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeSecurityGroupRules",
                            "ec2:DescribeSecurityGroups",                    
                            "ec2:DescribeVpcs",
                            "ecs:DescribeCapacityProviders",
                            "ecs:DescribeClusters",    
                            "ecs:DescribeContainerInstances",    
                            "ecs:DescribeServices",    
                            "ecs:DescribeTaskDefinition",    
                            "ecs:ListClusters",    
                            "ecs:ListContainerInstances",    
                            "ecs:ListServices",
                            "ecs:ListTagsForResource",    
                            "ecs:ListTaskDefinitions",    
                            "eks:DescribeCluster",
                            "eks:ListClusters",    
                            "elasticache:DescribeCacheClusters",
                            "elasticache:DescribeReplicationGroups",
                            "elasticache:ListTagsForResource",
                            "iam:ListAccountAliases",
                            "organizations:DescribeOrganization",
                            "organizations:ListAccounts",
                            "rds:DescribeDBInstances",    
                            "rds:DescribeReservedDBInstances",    
                            "rds:DescribeDBClusters",    
                            "rds:ListTagsForResource"
                            
                        ],
                        
                        "Resource": "*"
                     }
            ]
}

Note:  The permissions related to CloudFormation are used for linking ASGs with ECS clusters. If these permissions are not included and the data is not available, linking the ASGs to ECS clusters may be done based on existing container instances. If the permissions are missing, Densify may not link some ASGs to their ECS clusters,

1. Log into the AWS management console and navigate to Services > IAM.
2. Select Policies and click Create policy.
3. Click the JSON tab and enter the policy from the example above.
4. Review the policy and enter a policy name (e.g. DensifyMinimumReadAccess) and a description (e.g. Minimum permissions required for Densify standard audit).

Enabling Collection of AWS Memory Usage Metrics

Memory metrics are not collected by default, and they are not required to complete the Densify analyses. You can manually enable collection of memory and disk metrics.

Note:  The CloudWatch Agent must be installed and configured on each instance for which you want to obtain memory and/or disk metrics. Refer to the AWS user documentation for details. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html

Once the CloudWatch Agent is installed and configured, Densify uses the default, CWAgent as the namespace for metrics collected by the CloudWatch agent.

Additionally, when working with ASGs, ASG EC2 members will have memory utilization data using the basic memory settings, but you need to specify "aggregation_dimensions" to collect memory, aggregated at the ASG level.

Use the following information to configure the CloudWatch Agent (CWagent) via config.json to collect the metrics that Densify can use for analyses. Instructions are provided for both Linux and Windows instances.

If you are using a third-party application to collect memory metrics, the collected data can be loaded using the Receive Metrics API endpoint. See Importing Metrics for Existing Services in the API documentation.

Refer to the AWS user documentation for details on using the CloudWatch Agent to collect memory metrics.