AWS AmazonCloudWatch documentation change
Summary
Renamed 'service map' to 'application map' throughout documentation, added details about dynamic grouping/filtering, custom group configuration via tags/OTEL attributes, and enhanced visualization capabilities
Security assessment
Changes focus on rebranding terminology (service->application map) and adding operational features for grouping/filtering services. No mention of vulnerabilities, access controls, encryption, or explicit security mechanisms. New audit findings/deployment tracking features are operational monitoring improvements rather than security controls.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/ServiceMap.md b/AmazonCloudWatch/latest/monitoring/ServiceMap.md index 3604bbf18..c33b7f447 100644 --- a//AmazonCloudWatch/latest/monitoring/ServiceMap.md +++ b//AmazonCloudWatch/latest/monitoring/ServiceMap.md @@ -5 +5 @@ -Explore the service map +Explore the application map @@ -7 +7 @@ Explore the service map -# View your application topology and monitor operational health with the CloudWatch service map +# View your application topology and monitor operational health with the CloudWatch application map @@ -11 +11 @@ Explore the service map -The CloudWatch service map replaces the ServiceLens map. To see a map of your application based on AWS X-Ray traces, open the [X-Ray Trace Map](https://docs.aws.amazon.com/xray/latest/devguide/xray-console-servicemap.html). Choose **Trace Map** under the **X-Ray** section in the left navigation pane of the CloudWatch console. +The CloudWatch application map replaces the Service Map. To see a map of your application based on AWS X-Ray traces, open the [X-Ray Trace Map](https://docs.aws.amazon.com/xray/latest/devguide/xray-console-servicemap.html). Choose **Trace Map** under the **X-Ray** section in the left navigation pane of the CloudWatch console. @@ -13 +13 @@ The CloudWatch service map replaces the ServiceLens map. To see a map of your ap -Use the service map to view the topology of your application clients, synthetics canaries, services and dependencies, and monitor operational health. To view the service map, open the [CloudWatch console](https://console.aws.amazon.com/cloudwatch/) and choose **Service Map** under the **Application Signals** section in the left navigation pane. +After enabling your application for Application Signals, the application map displays nodes representing your groups. You then drill down in these groups to view your services and their dependencies. Use the application map to view the topology of your application clients, synthetics canaries, services and dependencies, and monitor operational health. To view the application map, open the [CloudWatch console](https://console.aws.amazon.com/cloudwatch/) and choose **Application Map** under the **Application Signals** section in the left navigation pane. @@ -15 +15 @@ Use the service map to view the topology of your application clients, synthetics -After you [enable your application for Application Signals](./CloudWatch-Application-Signals-Enable.html), use the service map to make it easier to monitor your application's operational health: +After you [enable your application for Application Signals](./CloudWatch-Application-Signals-Enable.html), use the application map to make it easier to monitor your application's operational health: @@ -23 +23 @@ After you [enable your application for Application Signals](./CloudWatch-Applica - * Filter and zoom the service map to make it easier to focus on a part of your application topology, or see the entire map. Create a filter by choosing one or more properties from the filter text box. As you choose each property, you are guided through filter criteria. You will see the complete filter below the filter text box. Choose **Clear filters** at any time to remove the filter. + * Filter and zoom the application map to make it easier to focus on a part of your application topology, or see the entire map. Create a filter by choosing one or more properties from the filter text box. As you choose each property, you are guided through filter criteria. You will see the complete filter below the filter text box. Choose **Clear filters** at any time to remove the filter. @@ -24,0 +25 @@ After you [enable your application for Application Signals](./CloudWatch-Applica + * Group and filter services to create customized views that match your workflows. This organization helps you quickly find and access the services you use most frequently @@ -25,0 +27 @@ After you [enable your application for Application Signals](./CloudWatch-Applica + * Save your filtered and grouped views to quickly return to frequently used configurations @@ -28 +29,0 @@ After you [enable your application for Application Signals](./CloudWatch-Applica -The following example service map shows services with edges connecting them to components that they interact with. If an SLO is defined, the service map also shows health status. @@ -30 +30,0 @@ The following example service map shows services with edges connecting them to c - @@ -32 +32 @@ The following example service map shows services with edges connecting them to c -## Explore the service map +## Explore the application map @@ -34 +34 @@ The following example service map shows services with edges connecting them to c -After you have enabled your application for Application Signals, the service map displays nodes representing your services and their dependencies. +When you visit the application map, by default it shows services grouped by **Related services**. Related services group services based on their dependencies. For example, if Service A calls Service B, which calls Service C, they're grouped under Service A. You can view SLI health, metrics and service count for all services in each group. @@ -36 +36 @@ After you have enabled your application for Application Signals, the service map -Turn on active tracing for your CloudWatch RUM clients and synthetics canaries to see client and canary nodes on the map. + @@ -38 +38 @@ Turn on active tracing for your CloudWatch RUM clients and synthetics canaries t -By default, canaries, RUM clients, and AWS service dependencies of the same kind are grouped together into a single expandable icon in the service map. Service dependencies outside of AWS are not grouped together by default. For example, in the following image, all Amazon S3 buckets are grouped together under one expandable icon: +### Dynamic grouping and filtering @@ -40 +40 @@ By default, canaries, RUM clients, and AWS service dependencies of the same kind - +You can click the **Group by** dropdown to use different grouping options. By default, Application Map provides 2 groupings: @@ -42 +42 @@ By default, canaries, RUM clients, and AWS service dependencies of the same kind -In the previous image, the label between the Amazon S3 grouping and originating service displays the number of edges to the group in parenthesis under the dependency's icon. Select the (+) icon to expand the group and see its individual elements, as shown in the following image: + * **Related services** \- Groups services based on their dependencies @@ -44 +44 @@ In the previous image, the label between the Amazon S3 grouping and originating - + * **Environment** \- Groups services by their environment @@ -46 +45,0 @@ In the previous image, the label between the Amazon S3 grouping and originating -Choose a tab for information about exploring each kind of node and the edges (connections) between them. @@ -48 +46,0 @@ Choose a tab for information about exploring each kind of node and the edges (co -View your application services @@ -51 +49 @@ View your application services -You can view your application services and the status of their SLOs and service level indicators (SLIs) in the **Service Map**. If you didn't create SLOs for a service, choose the **Create SLO** button below the service node. +If you want to define your own custom grouping, click **Manage groups** to define custom groups and then tag your services or add OTEL Resource Attributes with the group key. @@ -53 +51 @@ You can view your application services and the status of their SLOs and service -The **Service Map** displays all of your services. It also shows the customers and canaries that consume the service and the dependencies that your services calls, as shown in the following image: +Default grouping in Application Signals automatically organizes services based on their downstream dependencies. The system analyzes the service dependency graph and creates groups where the root node (a service with no upstream dependencies) becomes the group name. All services that depend on this root service, either directly or indirectly, are automatically included in the group. For example, if Service A calls Service B, which in turn calls Service C, all three services will be grouped together with Service A as the group name since it's the root of the dependency chain. This automatic grouping mechanism provides a natural way to visualize and manage related services based on their actual runtime interactions and dependencies. @@ -55 +53 @@ The **Service Map** displays all of your services. It also shows the customers a - +### Group actions and insights @@ -57 +55 @@ The **Service Map** displays all of your services. It also shows the customers a -The following icons represent examples of application services in the service map: +For each group, you can perform the following actions: @@ -59 +57 @@ The following icons represent examples of application services in the service ma - * [Amazon Elastic Kubernetes Service](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html): + * Click **View insight** to view metrics charts and last deployment time for the group @@ -61 +59 @@ The following icons represent examples of application services in the service ma - + * Click **View dashboard** to view metrics dashboard and service list for the group @@ -63 +60,0 @@ The following icons represent examples of application services in the service ma - * A [Kubernetes](https://kubernetes.io/) container: @@ -65 +61,0 @@ The following icons represent examples of application services in the service ma - @@ -67 +62,0 @@ The following icons represent examples of application services in the service ma - * Amazon Elastic Compute Cloud (Amazon EC2): @@ -69 +64 @@ The following icons represent examples of application services in the service ma - +You can also use **Group and filter** on the left bar to filter groups which have services with deployment time, SLI health status or compute platform type. @@ -71 +66 @@ The following icons represent examples of application services in the service ma - * Other application service types not previously listed: +Use the **Search and filter** bar to search groups by name or search groups which contain specific service environment or dependency. @@ -73 +68 @@ The following icons represent examples of application services in the service ma - +### Configuring custom groups @@ -74,0 +70 @@ The following icons represent examples of application services in the service ma +Custom grouping allows you to organize your services logically based on your business requirements and operational priorities. This feature enables you to view and save defined views prioritized by your specific needs, create groups based on team ownership, and assemble groups of services needed for critical business transactions. @@ -75,0 +72 @@ The following icons represent examples of application services in the service ma +Create the custom group names (the group names you will see in the UI) and the corresponding group key names. Complete this step either from the Application Signals UI or using the [PutGroupingConfiguration](https://docs.aws.amazon.com/applicationsignals/latest/APIReference/API_PutGroupingConfiguration.html) API. @@ -76,0 +74 @@ The following icons represent examples of application services in the service ma +Group key names can be either, AWS tag key or OTEL resource attribute for your service. When deciding between tags and OTEL resource attributes, consider your compute platform: @@ -78 +76 @@ The following icons represent examples of application services in the service ma -When you select a service node, a pane opens displaying detailed service information: + * For single-service platforms (for example, Lambda or Auto Scaling Group) – Use AWS tags @@ -80 +78 @@ When you select a service node, a pane opens displaying detailed service informa - * Metrics for call volume, latency, error, and fault rate. + * For multi-service platforms (for example, Amazon EKS cluster) – Use OTEL resource attributes for more granular grouping @@ -82 +79,0 @@ When you select a service node, a pane opens displaying detailed service informa - * The number of SLIs and SLOs that are `healthy` or `unhealthy`. @@ -84 +80,0 @@ When you select a service node, a pane opens displaying detailed service informa - * The option to view more information about an SLO. @@ -86 +81,0 @@ When you select a service node, a pane opens displaying detailed service informa - * The number of service operations, dependencies, synthetics canaries, and client pages. @@ -88 +83 @@ When you select a service node, a pane opens displaying detailed service informa - * The option to select each number to open the [Service details](./ServiceDetail.html) page for it. +**Adding AWS tags** @@ -90 +85 @@ When you select a service node, a pane opens displaying detailed service informa - * The application name, if you have associated the underlying compute resource with an application using AppRegistry or the Applications card on the AWS Management Console home page. +Add an AWS tag with the custom group key as a key and a value to an Amazon EKS cluster. When there are multiple services running in one Amazon EKS cluster all of them are tagged with the same custom group key. For example, when Amazon EKS Cluster A has Service 1, Service 2 and Service 3 running, adding an AWS tag with key _Team X_ to the cluster will add all three services to _Team X_. To add only specific services to _Team X_ , add OTEL resource attributes for the services as shown below. @@ -92 +87 @@ When you select a service node, a pane opens displaying detailed service informa - * Choose the application name to display the application details in the [myApplications](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/aws-myApplications.html) console page. +**Adding OTEL resource attributes** @@ -94 +89 @@ When you select a service node, a pane opens displaying detailed service informa - * The `Cluster`, `Namespace`, and `Workload` for services hosted in Amazon EKS, or `Environment` for services hosted in Amazon ECS or Amazon EC2. For Amazon EKS-hosted services, choose any link to open CloudWatch Container Insights. +To add an OTEL resource attribute, see the configuration below: @@ -95,0 +91 @@ When you select a service node, a pane opens displaying detailed service informa +**General configuration** @@ -96,0 +93 @@ When you select a service node, a pane opens displaying detailed service informa +Configure the `OTEL_RESOURCE_ATTRIBUTES` environment variable in your application using the custom group key-value pairs. The keys are listed under `aws.application_signals.metric_resource_keys` separated by `&`. @@ -97,0 +95 @@ When you select a service node, a pane opens displaying detailed service informa +For example, to create custom groups using `Application=PetClinic` and `Owner=Test`, use the following: @@ -99 +96,0 @@ When you select a service node, a pane opens displaying detailed service informa -Select an edge or connection between a service node and a downstream service or dependency node. This opens a pane containing top paths by fault rate, latency, and error rate, as shown in the following example image. Choose any link in the pane to open the [Service details](./ServiceDetail.html) page and see detailed information for the chosen service or dependency. @@ -101 +98 @@ Select an edge or connection between a service node and a downstream service or - + OTEL_RESOURCE_ATTRIBUTES=Application=PetClinic,Owner=Test,aws.application_signals.metric_resource_keys=Application&Owner @@ -103 +100 @@ Select an edge or connection between a service node and a downstream service or -View dependencies +**Platform-specific configuration** @@ -104,0 +102 @@ View dependencies +The following are the deployment specifications. @@ -106 +104 @@ View dependencies -Your application dependencies are displayed on the service map, connected to the services that call them. +**Amazon EKS and native kubernetes** @@ -108 +105,0 @@ Your application dependencies are displayed on the service map, connected to the -Choose a dependency node to open a pane containing top paths by fault rate, latency, and error rate. Choose any service or target link to open the [Service Details](./ServiceDetail.html) page and see detailed information about the chosen service or dependency target, as shown in the example image below: @@ -110 +107,16 @@ Choose a dependency node to open a pane containing top paths by fault rate, late -You can view the dependencies and the status of SLOs created on the dependencies. + apiVersion: apps/v1 + kind: Deployment + metadata: + ... + spec: + replicas: 1 + ... + template: + spec: + containers: + - name: your-app + image: your-app-image + env: + ... + - name: OTEL_RESOURCE_ATTRIBUTES + value: Application=PetClinic,Owner=Test,aws.application_signals.metric_resource_keys=Application&Owner @@ -112 +124 @@ You can view the dependencies and the status of SLOs created on the dependencies - +**Amazon EC2** @@ -114 +126 @@ You can view the dependencies and the status of SLOs created on the dependencies -Service dependencies are grouped together by default into a single expandable icon. Select the (+) icon, as shown in the previous image, to expand the group and see its individual elements. +Add `OTEL_RESOURCE_ATTRIBUTES` to your application start script. For the complete example, see [Adding `OTEL_RESOURCE_ATTRIBUTES`](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-EC2Main.html#CloudWatch-Application-Signals-Monitor-EC2). @@ -116 +127,0 @@ Service dependencies are grouped together by default into a single expandable ic -The following icons represent examples of dependency nodes in the service map: @@ -118 +129,3 @@ The following icons represent examples of dependency nodes in the service map: - * An [Amazon S3](https://docs.aws.amazon.com/streams/latest/dev/introduction.html) bucket: + ... + OTEL_RESOURCE_ATTRIBUTES="service.name=$YOUR_SVC_NAME,Application=PetClinic,Owner=Test,aws.application_signals.metric_resource_keys=Application&Owner" \ + java -jar $MY_JAVA_APP.jar @@ -120 +133 @@ The following icons represent examples of dependency nodes in the service map: - +**Amazon ECS** @@ -122 +135 @@ The following icons represent examples of dependency nodes in the service map: - * An [Amazon Kinesis](https://docs.aws.amazon.com/streams/latest/dev/introduction.html) stream: +Add `OTEL_RESOURCE_ATTRIBUTES` to the TaskDefinition. For the complete example, see [Enable on Amazon ECS](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals-Enable-ECSMain.html). @@ -124 +136,0 @@ The following icons represent examples of dependency nodes in the service map: - @@ -126 +138,11 @@ The following icons represent examples of dependency nodes in the service map: - * [Amazon Simple Queue Service](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html) (Amazon SQS): + { + "name": "my-app", + ... + "environment": [ + { + "name": "OTEL_RESOURCE_ATTRIBUTES", + "value": "service.name=$YOUR_SVC_NAME,Application=PetClinic,Owner=Test,aws.application_signals.metric_resource_keys=Applicationmanagement portalOwner" + }, + ... + ] + } @@ -128 +150 @@ The following icons represent examples of dependency nodes in the service map: - +**Lambda** @@ -130 +152 @@ The following icons represent examples of dependency nodes in the service map: - * An [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Introduction.html) table: +Add `OTEL_RESOURCE_ATTRIBUTES` to the Lambda environment variable. @@ -132 +153,0 @@ The following icons represent examples of dependency nodes in the service map: - @@ -134 +155 @@ The following icons represent examples of dependency nodes in the service map: