AWS cur medium security documentation change
Summary
Modified Prometheus scrape configuration to use Bearer token authorization and added verification steps for metrics collection
Security assessment
The change improves authentication configuration by using proper Bearer token credentials handling, which strengthens security practices for metric collection. The explicit verification steps help ensure secure monitoring implementation.
Diff
diff --git a/cur/latest/userguide/split-cost-allocation-data-resource-amp.md b/cur/latest/userguide/split-cost-allocation-data-resource-amp.md index ae794fac3..f9c84688a 100644 --- a//cur/latest/userguide/split-cost-allocation-data-resource-amp.md +++ b//cur/latest/userguide/split-cost-allocation-data-resource-amp.md @@ -93,0 +94,4 @@ To filter the metrics that are scraped to just include the two that are needed f + global: + scrape_interval: 30s + #external_labels: + #clusterArn: <REPLACE_ME> @@ -95,2 +99 @@ To filter the metrics that are scraped to just include the two that are needed f - - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token - job_name: kubernetes-nodes-cadvisor + - job_name: kubernetes-nodes-cadvisor @@ -98,0 +102,4 @@ To filter the metrics that are scraped to just include the two that are needed f + scheme: https + authorization: + type: Bearer + credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token @@ -133,0 +141,21 @@ If your EKS cluster’s authentication mode is not set to `API` or `API_AND_CONF +Once the scraper is active, verify that both metrics (`container_cpu_usage_seconds_total` and `container_memory_working_set_bytes`) are being pushed to your Amazon Managed Service for Prometheus workspace. + + + awscurl --service="aps" --region="<REGION>" "https://aps-workspaces.<REGION>.amazonaws.com/workspaces/<WorkSpace_ID>/api/v1/label/__name__/values" + +Output: + + + { + "status": "success", + "data": [ + "container_cpu_usage_seconds_total", + "container_memory_working_set_bytes", + "scrape_duration_seconds", + "scrape_samples_post_metric_relabeling", + "scrape_samples_scraped", + "scrape_series_added", + "up" + ] + } + @@ -142,0 +171,4 @@ The following is a sample Prometheus scrape configuration that includes the Prom + global: + scrape_interval: 30s + #external_labels: + #clusterArn: <REPLACE_ME> @@ -144,2 +176 @@ The following is a sample Prometheus scrape configuration that includes the Prom - - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token - job_name: kubernetes-nodes-cadvisor + - job_name: kubernetes-nodes-cadvisor @@ -147,0 +179,4 @@ The following is a sample Prometheus scrape configuration that includes the Prom + scheme: https + authorization: + type: Bearer + credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token