AWS AmazonCloudWatch documentation change
Summary
Added optional Step 7 for monitoring application health and updated documentation links. Removed detailed enablement steps in favor of linking to dedicated enablement page. Fixed multiple internal documentation links.
Security assessment
Changes focus on documentation structure, link corrections, and adding monitoring guidance. No mention of vulnerabilities, security patches, or explicit security enhancements. IAM role permissions mentioned are standard service requirements rather than new security controls.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-ECS-Daemon.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-ECS-Daemon.md index 297992753..3193f0a9b 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-ECS-Daemon.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-ECS-Daemon.md @@ -5 +5 @@ -Step 1: Enable Application Signals in your accountStep 2: Create IAM rolesStep 3: Prepare CloudWatch agent configurationStep 4: Deploy the CloudWatch agent daemon serviceStep 5: Instrument your applicationStep 6: Deploy your application +Step 1: Enable Application Signals in your accountStep 2: Create IAM rolesStep 3: Prepare CloudWatch agent configurationStep 4: Deploy the CloudWatch agent daemon serviceStep 5: Instrument your applicationStep 6: Deploy your application(Optional) Step 7: Monitor your application health @@ -11,30 +11 @@ Step 1: Enable Application Signals in your accountStep 2: Create IAM rolesStep 3 -If you haven't enabled Application Signals in this account yet, you must grant Application Signals the permissions it needs to discover your services. To do so, do the following. You need to do this only once for your account. - -###### To enable Application Signals for your applications - - 1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). - - 2. In the navigation pane, choose **Services**. - - 3. Choose **Start discovering your Services**. - - 4. Select the check box and choose **Start discovering Services**. - -Completing this step for the first time in your account creates the **AWSServiceRoleForCloudWatchApplicationSignals** service-linked role. This role grants Application Signals the following permissions: - - * `xray:GetServiceGraph` - - * `logs:StartQuery` - - * `logs:GetQueryResults` - - * `cloudwatch:GetMetricData` - - * `cloudwatch:ListMetrics` - - * `tag:GetResources` - -For more information about this role, see [Service-linked role permissions for CloudWatch Application Signals](./using-service-linked-roles.html#service-linked-role-signals). - - - +You must first enable Application Signals in your account. If you haven't, see [Enable Application Signals in your account](./CloudWatch-Application-Signals-Enable.html). @@ -186 +157 @@ Environment variable | Setting to enable Application Signals -This attribute key is used only by Application Signals, and is converted into X-Ray trace annotations and CloudWatch metric dimensions. (Optional) To enable log correlation for Application Signals, set an additional environment variable `aws.log.group.names` to be the log group name for your application log. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from the log group. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-MetricLogCorrelation). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-TraceLogCorrelation). +This attribute key is used only by Application Signals, and is converted into X-Ray trace annotations and CloudWatch metric dimensions. (Optional) To enable log correlation for Application Signals, set an additional environment variable `aws.log.group.names` to be the log group name for your application log. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from the log group. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./Application-Signals-MetricLogCorrelation.html). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./Application-Signals-TraceLogCorrelation.html). @@ -331 +302 @@ Environment variable | Setting to enable Application Signals -This attribute key is used only by Application Signals, and is converted into X-Ray trace annotations and CloudWatch metric dimensions. (Optional) To enable log correlation for Application Signals, set an additional environment variable `aws.log.group.names` to be the log group name for your application log. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from the log group. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-MetricLogCorrelation). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-TraceLogCorrelation). +This attribute key is used only by Application Signals, and is converted into X-Ray trace annotations and CloudWatch metric dimensions. (Optional) To enable log correlation for Application Signals, set an additional environment variable `aws.log.group.names` to be the log group name for your application log. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from the log group. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./Application-Signals-MetricLogCorrelation.html). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./Application-Signals-TraceLogCorrelation.html). @@ -425 +396 @@ This attribute key is used only by Application Signals, and is converted into X- - 6. (Optional) To enable log correlation, do the following before you mount the volume. In `OTEL_RESOURCE_ATTRIBUTES`, set an additional environment variable `aws.log.group.names` for the log groups of your application. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from these log groups. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-MetricLogCorrelation). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-TraceLogCorrelation). + 6. (Optional) To enable log correlation, do the following before you mount the volume. In `OTEL_RESOURCE_ATTRIBUTES`, set an additional environment variable `aws.log.group.names` for the log groups of your application. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from these log groups. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./Application-Signals-MetricLogCorrelation.html). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./Application-Signals-TraceLogCorrelation.html). @@ -878 +849 @@ Environment variable | Setting to enable Application Signals -This attribute key is used only by Application Signals, and is converted into X-Ray trace annotations and CloudWatch metric dimensions. (Optional) To enable log correlation for Application Signals, set an additional environment variable `aws.log.group.names` to be the log group name for your application log. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from the log group. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-MetricLogCorrelation). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-TraceLogCorrelation). +This attribute key is used only by Application Signals, and is converted into X-Ray trace annotations and CloudWatch metric dimensions. (Optional) To enable log correlation for Application Signals, set an additional environment variable `aws.log.group.names` to be the log group name for your application log. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from the log group. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./Application-Signals-MetricLogCorrelation.html). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./Application-Signals-TraceLogCorrelation.html). @@ -960 +931 @@ For your Application Container, add a dependency on the `init` container to make - 6. (Optional) To enable log correlation, do the following before you mount the volume. In `OTEL_RESOURCE_ATTRIBUTES`, set an additional environment variable `aws.log.group.names` for the log groups of your application. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from these log groups. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-MetricLogCorrelation). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./CloudWatch-Application-Signals-Configure.html#Application-Signals-TraceLogCorrelation). + 6. (Optional) To enable log correlation, do the following before you mount the volume. In `OTEL_RESOURCE_ATTRIBUTES`, set an additional environment variable `aws.log.group.names` for the log groups of your application. By doing so, the traces and metrics from your application can be correlated with the relevant log entries from these log groups. For this variable, replace `$YOUR_APPLICATION_LOG_GROUP` with the log group names for your application. If you have multiple log groups, you can use an ampersand (`&`) to separate them as in this example: `aws.log.group.names=log-group-1&log-group-2`. To enable metric to log correlation, setting this current environmental variable is enough. For more information, see [Enable metric to log correlation](./Application-Signals-MetricLogCorrelation.html). To enable trace to log correlation, you'll also need to change the logging configuration in your application. For more information, see [Enable trace to log correlation](./Application-Signals-TraceLogCorrelation.html). @@ -1070,0 +1042,4 @@ Create a new revision of your task definition and deploy it to your application +## (Optional) Step 7: Monitor your application health + +Once you have enabled your applications on Amazon ECS, you can monitor your application health. For more information, see [Monitor the operational health of your applications with Application Signals](./Services.html). + @@ -1079 +1054 @@ Deploy using the sidecar strategy -Enable Application Signals on Amazon EC2 +Enable Application Signals on Amazon ECS using AWS CDK