AWS AmazonCloudWatch documentation change
Summary
Moved permissions configuration details to a dedicated page and updated navigation links
Security assessment
Restructuring permissions documentation into a dedicated page improves organization but does not resolve a security flaw. The change enhances accessibility of security-critical IAM policy requirements without introducing new security content.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-agents-ec2.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-agents-ec2.md index fca810d49..6cd7e19ec 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-agents-ec2.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-agents-ec2.md @@ -5,2 +4,0 @@ -Configure permissions for agents - @@ -15 +13 @@ Regardless of the method that you use to install agents on EC2 instances, you mu - * Configure permissions for agents + * [Configure permissions for agents](./CloudWatch-NetworkFlowMonitor-agents-ec2-permissions.html) @@ -24,23 +21,0 @@ Regardless of the method that you use to install agents on EC2 instances, you mu -## Configure permissions for agents - -To enable agents to send metrics to the Network Flow Monitor ingestion backend, the EC2 instances that the agents run in must use a role that has a policy attached with the correct permissions. To provide the required permissions, use a role that has the following AWS managed policy attached: [CloudWatchNetworkFlowMonitorAgentPublishPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchNetworkFlowMonitorAgentPublishPolicy.html). Attach this policy to the IAM roles of the EC2 instances where you plan to install Network Flow Monitor agents. - -We recommend that you add the permissions before you install agents on the EC2 instances. You can choose to wait until after you install agents, but the agents won't be able to send metrics to the service until the permissions are in place. - -###### To add permissions for Network Flow Monitor agents - - 1. In the AWS Management Console, in the Amazon EC2 console, locate the EC2 instances that you plan to install Network Flow Monitor agents on. - - 2. Attach the [CloudWatchNetworkFlowMonitorAgentPublishPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchNetworkFlowMonitorAgentPublishPolicy.html) to the IAM role for each instance. - -If an instance doesn't have an IAM role attached, choose a role by doing the following: - - 1. Under **Actions** , choose **Security**. - - 2. Choose **Modify IAM role** , or create a new role by choosing **Create new IAM role**. - - 3. Choose a role for the instance, and attach the [CloudWatchNetworkFlowMonitorAgentPublishPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchNetworkFlowMonitorAgentPublishPolicy.html) policy. - - - - @@ -53 +28 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Install agents +Supported Linux versions @@ -55 +30 @@ Install agents -EC2 instance agents with SSM +Configure permissions for agents