AWS AmazonCloudWatch documentation change
Summary
Added documentation for opting out of Application Signals, updated version references from 4.0.0 to 5.0.0, and changed default 'monitorAllServices' value from false to true
Security assessment
Changes focus on feature configuration options and version updates rather than addressing security vulnerabilities. The opt-out documentation helps users maintain existing APM setups but doesn't describe security controls.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Observability-EKS-addon.md b/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Observability-EKS-addon.md index 0b48a34d3..f9be73ba5 100644 --- a//AmazonCloudWatch/latest/monitoring/install-CloudWatch-Observability-EKS-addon.md +++ b//AmazonCloudWatch/latest/monitoring/install-CloudWatch-Observability-EKS-addon.md @@ -5 +5 @@ -Option 1: Install using EKS Pod Identity Option 2: Install with IAM permissions on worker nodes Option 3: Install using IAM service account role (applies only to using the add-on)Considerations for Amazon EKS Hybrid Nodes(Optional) Additional configurationCollect Java Management Extensions (JMX) metricsEnable Kueue metricsAppending OpenTelemetry collector configuration filesApplication Signals configurationTroubleshooting +Option 1: Install using EKS Pod Identity Option 2: Install with IAM permissions on worker nodes Option 3: Install using IAM service account role (applies only to using the add-on)Considerations for Amazon EKS Hybrid Nodes(Optional) Additional configurationCollect Java Management Extensions (JMX) metricsEnable Kueue metricsAppending OpenTelemetry collector configuration filesApplication Signals configurationTroubleshootingOpt out of Application Signals @@ -50 +50 @@ When you install the add-on or the Helm chart, you must also grant IAM permissio - * Configuring Application Signals for your Amazon EKS cluster + * Enabling APM through Application Signals for your Amazon EKS cluster @@ -53,0 +54,2 @@ When you install the add-on or the Helm chart, you must also grant IAM permissio + * Opt out of Application Signals + @@ -907 +909,5 @@ or -## Configuring Application Signals for your Amazon EKS cluster +## Enabling APM through Application Signals for your Amazon EKS cluster + +By default, OpenTelemetry (OTEL) based Application Performance Monitoring (APM) is enabled through Application Signals when installing either the CloudWatch Observability EKS add-on (V5.0.0 or greater) or the Helm chart. You can further customize specific settings using the advanced configuration for the Amazon EKS add-on or by overriding values with the Helm chart. + +###### Note @@ -909 +915 @@ or -[Application Signals](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Monitoring-Sections.html) is enabled by default when installing either the CloudWatch Observability EKS add-on or the Helm chart. You can further customize specific settings using the advanced configuration for the Amazon EKS add-on or by overriding values with the Helm chart. +If you use any OpenTelemetry (OTEL) based APM solution, enabling Application Signals affects your existing observability setup. Review your current implementation before proceeding. To maintain your existing APM setup after upgrading to V5.0.0 or later, see Opt out of Application Signals. @@ -913 +919 @@ or -Version 4.0.0 of the CloudWatch Observability Amazon EKS add-on and Helm chart introduces new functionality. You can now automatically enable Application Signals for all or specific service workloads in your EKS cluster through the Auto monitor configuration. The following `autoMonitor` settings can be specified within the `applicationSignals` section under the `manager` section of the advanced configuration. +Version 5.0.0 of the CloudWatch Observability Amazon EKS add-on and Helm chart introduces new functionality. You can now automatically enable Application Signals for all or specific service workloads in your EKS cluster through the Auto monitor configuration. The following `autoMonitor` settings can be specified within the `applicationSignals` section under the `manager` section of the advanced configuration. @@ -915 +921 @@ Version 4.0.0 of the CloudWatch Observability Amazon EKS add-on and Helm chart i - * _monitorAllServices_ – A boolean flag to enable (true) or disable (false) monitoring of all service workloads by Auto monitor. Defaults to false. Enabling this flag will ensure that all Kubernetes workloads (Deployments, DaemonSets, and StatefulSets) in the cluster that are mapped to a Kubernetes Service will be in scope for automatic enablement of Application Signals when they are brought up for the first time (or when restarted for existing workloads). The system excludes workloads in the `kube-system` and `amazon-cloudwatch` namespaces by default. + * _monitorAllServices_ – A boolean flag to enable (true) or disable (false) monitoring of all service workloads by Auto monitor. Defaults to true. Enabling this flag will ensure that all Kubernetes workloads (Deployments, DaemonSets, and StatefulSets) in the cluster that are mapped to a Kubernetes Service will be in scope for automatic enablement of Application Signals when they are brought up for the first time (or when restarted for existing workloads). The system excludes workloads in the `kube-system` and `amazon-cloudwatch` namespaces by default. @@ -1067,0 +1074,38 @@ Alternatively, the add-on supports a conflict resolution configuration option th +## Opt out of Application Signals + +Fine-tune your service monitoring preferences in the CloudWatch console or with the SDK. + +For versions before 5.0.0, to disable Application Signals auto-monitoring, follow the procedure below: + +**Using CLI or SDK** + +The following configuration can be applied either as an advanced configuration to the EKS add-on or as a values override when using the helm chart. + + + { + "manager": { + "applicationSignals": { + "autoMonitor": { + "monitorAllServices": false + } + } + } + } + +Restart your services for the changes to take effect. + +**Using the console** + +Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). + + 1. In the navigation pane, under **Application Signals (APM)** , choose **Services**. + + 2. Choose **Enable Application Signals** to view the enablement page. + + 3. Clear the **Auto-Monitor** checkbox for each service you don't want to monitor. + + 4. Restart your services for the changes to take effect. + + + +