AWS AmazonCloudWatch documentation change
Summary
Updated documentation to replace 'Enable Network Flow Monitor' with 'Initialize Network Flow Monitor', added multi-account monitoring guidance, restructured setup requirements, and clarified agent installation prerequisites
Security assessment
The changes emphasize proper permission configuration through service-linked roles and AWS Organizations integration, which are security best practices. However, there's no evidence of addressing a specific vulnerability. The documentation now better explains security-related prerequisites for monitoring setup.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-configure-begin.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-configure-begin.md index ee8754e50..4c8216d0f 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-configure-begin.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-configure-begin.md @@ -5 +5 @@ -Enable Network Flow MonitorInstall agents on instances +Install agents on instances @@ -7 +7 @@ Enable Network Flow MonitorInstall agents on instances -# Before you begin +# Initialize Network Flow Monitor @@ -9 +9 @@ Enable Network Flow MonitorInstall agents on instances -Before you can view performance metrics for network flows, you must enable Network Flow Monitor and install agents on your instances. +Before you can view performance metrics for network flows, you must initialize Network Flow Monitor, which grants required permissions and creates an initial topology for your account or accounts. If you plan to monitor resources for multiple accounts, you must also configure AWS Organizations with Amazon CloudWatch. Then, you specify accounts for your Network Flow Monitor scope, so that Network Flow Monitor can create an initial topology for all the accounts that you'll be tracking performance metrics for. @@ -11 +11 @@ Before you can view performance metrics for network flows, you must enable Netwo -###### Contents +In addition, you must install agents on your instances, to send performance metrics to the Network Flow Monitor backup ingestion server. For more information, see [Install Network Flow Monitor agents on instances](./CloudWatch-NetworkFlowMonitor-agents.html). @@ -13 +13 @@ Before you can view performance metrics for network flows, you must enable Netwo - * Enable Network Flow Monitor +The steps that you take to initialize Network Flow Monitor vary depending on whether you are measuring performance metrics for resources in a single account, or you want to monitor metrics from resources that are owned by multiple accounts in your organization. @@ -15 +15 @@ Before you can view performance metrics for network flows, you must enable Netwo - * Install agents on instances + * [Single account monitoring initialization](./CloudWatch-NetworkFlowMonitor-single-account.html) @@ -17,23 +17 @@ Before you can view performance metrics for network flows, you must enable Netwo - - - -## Enable Network Flow Monitor - -Network Flow Monitor requires you to grant it specific permissions so that the feature can send metrics to Amazon CloudWatch on your behalf, as well as create topologies of network flows. To grant the service-linked role the required permissions, and also create a _scope_ for monitoring in Network Flow Monitor, you must enable the feature. - -**To enable Network Flow Monitor** - - 1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). - - 2. In the left navigation pane, under **Network Monitoring** , choose **Flow monitors**. - - 3. Choose **Enable Network Flow Monitor**. - - - - -Enabling Network Flow Monitor does the following: - - * Grants permissions for Network Flow Monitor to use required service-linked roles with your account. For more information, see [Service-linked roles for Network Flow Monitor](./using-service-linked-roles-network-flow-monitor.html). - - * Sets your monitoring scope for Network Flow Monitor to the AWS account that you're signed in with. For more information, see **Scope** in [Components and features of Network Flow Monitor](./CloudWatch-NetworkFlowMonitor-components.html). + * [Multi-account monitoring initialization](./CloudWatch-NetworkFlowMonitor-multi-account.html) @@ -46 +24 @@ Enabling Network Flow Monitor does the following: -You install Network Flow Monitor agents on your workload's EC2 instances to send networking performance metrics to Network Flow Monitor. Before you can view workload insights and create monitors with the feature, you must install agents, and then wait a short period of time (about 20 minutes) for data to begin being gathered and sent to the Network Flow Monitor backend. +To track network performance with Network Flow Monitor, you must initialize the service, but you must also install Network Flow Monitor agents on your workload's EC2 instances and add permissions for the agents to send networking performance metrics to Network Flow Monitor. After you install the agents, wait a short period of time (about 20 minutes), for data to begin being sent to the Network Flow Monitor backend. Then, you can view network performance metrics, on the **Workload insights** tab, and also create monitors, to view detailed information. @@ -48 +26 @@ You install Network Flow Monitor agents on your workload's EC2 instances to send -After you install agents on your instances, you can view the top contributor performance metrics collected by agents for network flows between your local and remote resources. By viewing and analyzing these metrics, you can choose specific flows that you want to see more details for and track more closely with a monitor. By creating a monitor for specific flows, you can see detailed information about them, including metrics, sorted by the top contributors for each metric type, and topologies for each network flows. +For example, you can view the top contributor performance metrics for data transferred and retransmission timeouts, for network flows between your local and remote resources, collected by Network Flow Monitor agents. By viewing and analyzing these metrics, you can choose specific flows that you want to see more details for and track more closely with a monitor. By creating a monitor for specific flows, you can see detailed information about them, including metrics, sorted by the top contributors for each metric type and topologies for each network flow. @@ -50 +28 @@ After you install agents on your instances, you can view the top contributor per -With a monitor, Network Flow Monitor also provides a network health indicator (NHI), which you can use see there have been AWS network impairments for network flows that you're tracking in the monitor, during a time period that you've selected. That information can help you decide where to focus your network troubleshooting efforts. +With a monitor, Network Flow Monitor also provides a network health indicator (NHI), which you can use to see if there have been AWS network impairments for network flows that you're tracking in the monitor, during a time period that you've selected. That information can help you decide where to focus your network troubleshooting efforts. @@ -60 +38 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Monitor network flows +Amazon EKS agents @@ -62 +40 @@ Monitor network flows -Evaluate network flows +Single account monitoring