AWS prescriptive-guidance documentation change
Summary
Updated references from 'AWS CloudFormation' to 'CloudFormation' for consistency in terminology. No functional changes to security configurations or IAM policies were made.
Security assessment
The changes are purely branding/terminology updates (removing 'AWS' prefix from CloudFormation references). No modifications to security controls, permissions, or vulnerability mitigations were introduced. Existing security-related content about IAM roles, temporary credentials, and policy requirements remains unchanged.
Diff
diff --git a/prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/install-cloudwatch-systems-manager.md b/prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/install-cloudwatch-systems-manager.md index c356fe4b9..a67dd4441 100644 --- a//prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/install-cloudwatch-systems-manager.md +++ b//prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/install-cloudwatch-systems-manager.md @@ -5 +5 @@ -Set up State Manager and Distributor for CloudWatch agent deployment and configurationUse Systems Manager Quick Setup and manually update the created Systems Manager resources Use AWS CloudFormation instead of Quick SetupCustomized Quick Setup in a single account and Region with an AWS CloudFormation stackCustomized Quick Setup in multiple Regions and multiple accounts with AWS CloudFormation StackSetsConsiderations for configuring on-premises serversConsiderations for ephemeral EC2 instancesUsing an automated solution to deploy the CloudWatch agent +Set up State Manager and Distributor for CloudWatch agent deployment and configurationUse Systems Manager Quick Setup and manually update the created Systems Manager resources Use CloudFormation instead of Quick SetupCustomized Quick Setup in a single account and Region with an CloudFormation stackCustomized Quick Setup in multiple Regions and multiple accounts with CloudFormation StackSetsConsiderations for configuring on-premises serversConsiderations for ephemeral EC2 instancesUsing an automated solution to deploy the CloudWatch agent @@ -19 +19 @@ Amazon Linux 2 is nearing end of support. For more information, see the [Amazon - * An IAM role or credentials that have the [required CloudWatch and Systems Manager permissions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-iam-roles-for-cloudwatch-agent.html) must be attached to the EC2 instance or defined in the credentials file for an on-premises server. For example, you can create an IAM role that includes the AWS managed policies: `AmazonSSMManagedInstanceCore` for Systems Manager and `CloudWatchAgentServerPolicy` for CloudWatch. You can use the [ssm-cloudwatch-instance-role.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/blob/main/ssm-cloudwatch-instance-role.yaml) AWS CloudFormation template to deploy an IAM role and instance profile that includes both of these policies. This template can also be modified to include other standard IAM permissions for your EC2 instances. For on-premises servers or VMs, should configure the CloudWatch agent to use the [Systems Manager service role](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-service-role.html) that was configured for the on-premises server. For more information about this, see [How can I configure on-premises servers that use Systems Manager Agent and the unified CloudWatch agent to use only temporary credentials?](https://aws.amazon.com/premiumsupport/knowledge-center/cloudwatch-on-premises-temp-credentials/) in the AWS Knowledge Center. + * An IAM role or credentials that have the [required CloudWatch and Systems Manager permissions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-iam-roles-for-cloudwatch-agent.html) must be attached to the EC2 instance or defined in the credentials file for an on-premises server. For example, you can create an IAM role that includes the AWS managed policies: `AmazonSSMManagedInstanceCore` for Systems Manager and `CloudWatchAgentServerPolicy` for CloudWatch. You can use the [ssm-cloudwatch-instance-role.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/blob/main/ssm-cloudwatch-instance-role.yaml) CloudFormation template to deploy an IAM role and instance profile that includes both of these policies. This template can also be modified to include other standard IAM permissions for your EC2 instances. For on-premises servers or VMs, should configure the CloudWatch agent to use the [Systems Manager service role](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-service-role.html) that was configured for the on-premises server. For more information about this, see [How can I configure on-premises servers that use Systems Manager Agent and the unified CloudWatch agent to use only temporary credentials?](https://aws.amazon.com/premiumsupport/knowledge-center/cloudwatch-on-premises-temp-credentials/) in the AWS Knowledge Center. @@ -50 +50 @@ However, you should also consider the following three areas before you choose th -You can use [Systems Manager Quick Setup](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-quick-setup.html) to quickly configure Systems Manager features, including automatically installing and updating the CloudWatch agent on your EC2 instances. The Quick Setup deploys an AWS CloudFormation stack that deploys and configures Systems Manager resources based on your choices. +You can use [Systems Manager Quick Setup](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-quick-setup.html) to quickly configure Systems Manager features, including automatically installing and updating the CloudWatch agent on your EC2 instances. The Quick Setup deploys an CloudFormation stack that deploys and configures Systems Manager resources based on your choices. @@ -77 +77 @@ You must augment and customize the completed Quick Setup configuration to includ -Quick Setup creates an AWS CloudFormation stack to deploy and configure Systems Manager resources based on your choices. If you update your Quick Setup choices, you might need to manually re-update the Systems Manager documents. +Quick Setup creates an CloudFormation stack to deploy and configure Systems Manager resources based on your choices. If you update your Quick Setup choices, you might need to manually re-update the Systems Manager documents. @@ -79 +79 @@ Quick Setup creates an AWS CloudFormation stack to deploy and configure Systems -The following sections describe how to manually update the Systems Manager resources created by Quick Setup, as well as use your own AWS CloudFormation template to perform an updated Quick Setup. We recommend that you use your own AWS CloudFormation template to avoid manually updating resources created by Quick Setup and AWS CloudFormation. +The following sections describe how to manually update the Systems Manager resources created by Quick Setup, as well as use your own CloudFormation template to perform an updated Quick Setup. We recommend that you use your own CloudFormation template to avoid manually updating resources created by Quick Setup and CloudFormation. @@ -97 +97 @@ Review the completed [InstallAndManageCloudWatchDocument.yaml](https://github.co -## Use AWS CloudFormation instead of Quick Setup +## Use CloudFormation instead of Quick Setup @@ -99 +99 @@ Review the completed [InstallAndManageCloudWatchDocument.yaml](https://github.co -Instead of using Quick Setup, you can use AWS CloudFormation to configure Systems Manager. This approach allows you to customize your Systems Manager configuration according to your specific requirements. This approach also avoids manual updates to the configured Systems Manager resources created by Quick Setup to support custom CloudWatch configurations. +Instead of using Quick Setup, you can use CloudFormation to configure Systems Manager. This approach allows you to customize your Systems Manager configuration according to your specific requirements. This approach also avoids manual updates to the configured Systems Manager resources created by Quick Setup to support custom CloudWatch configurations. @@ -101 +101 @@ Instead of using Quick Setup, you can use AWS CloudFormation to configure System -The Quick Setup feature also uses AWS CloudFormation and creates a AWS CloudFormation stack set to deploy and configure Systems Manager resources based on your choices. Before you can use AWS CloudFormation stack sets, you must create the IAM roles used by AWS CloudFormation StackSets to support deployments across multiple accounts or Regions. Quick Setup creates the roles it requires to support multi-Region or multi-account deployments with AWS CloudFormation StackSets. You must complete the prerequisites for AWS CloudFormation StackSets if you want to configure and deploy Systems Manager resources in multiple Regions or multiple accounts from a single account and Region. For more information about this, see [Prerequisites for stack set operations](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html) in the AWS CloudFormation documentation. +The Quick Setup feature also uses CloudFormation and creates a CloudFormation stack set to deploy and configure Systems Manager resources based on your choices. Before you can use CloudFormation stack sets, you must create the IAM roles used by CloudFormation StackSets to support deployments across multiple accounts or Regions. Quick Setup creates the roles it requires to support multi-Region or multi-account deployments with CloudFormation StackSets. You must complete the prerequisites for CloudFormation StackSets if you want to configure and deploy Systems Manager resources in multiple Regions or multiple accounts from a single account and Region. For more information about this, see [Prerequisites for stack set operations](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html) in the CloudFormation documentation. @@ -103 +103 @@ The Quick Setup feature also uses AWS CloudFormation and creates a AWS CloudForm -Review the [AWS-QuickSetup-SSMHostMgmt.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/tree/main/custom_ssm_setup) AWS CloudFormation template for customized Quick Setup. +Review the [AWS-QuickSetup-SSMHostMgmt.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/tree/main/custom_ssm_setup) CloudFormation template for customized Quick Setup. @@ -105 +105 @@ Review the [AWS-QuickSetup-SSMHostMgmt.yaml](https://github.com/aws-samples/logg -You should review the resources and capabilities in the AWS CloudFormation template and make adjustments according to your requirements. You should version control the AWS CloudFormation template that you use and incrementally test changes to confirm the required result. Additionally, you should perform cloud security reviews to determine if there are any policy adjustments that are required based on your organization's requirements. +You should review the resources and capabilities in the CloudFormation template and make adjustments according to your requirements. You should version control the CloudFormation template that you use and incrementally test changes to confirm the required result. Additionally, you should perform cloud security reviews to determine if there are any policy adjustments that are required based on your organization's requirements. @@ -107 +107 @@ You should review the resources and capabilities in the AWS CloudFormation templ -You should deploy the AWS CloudFormation stack in a single test account and Region, and perform any necessary test cases to customize and confirm the desired result. You can then graduate your deployment to multiple Regions in a single account, and then to multiple accounts and multiple regions. +You should deploy the CloudFormation stack in a single test account and Region, and perform any necessary test cases to customize and confirm the desired result. You can then graduate your deployment to multiple Regions in a single account, and then to multiple accounts and multiple regions. @@ -109 +109 @@ You should deploy the AWS CloudFormation stack in a single test account and Regi -## Customized Quick Setup in a single account and Region with an AWS CloudFormation stack +## Customized Quick Setup in a single account and Region with an CloudFormation stack @@ -111 +111 @@ You should deploy the AWS CloudFormation stack in a single test account and Regi -If you are only use a single account and Region, you can deploy the complete example as a AWS CloudFormation stack instead of an AWS CloudFormation stack set. However if possible, we recommend that you use the multi-account, multi-Region stack set approach even if only use a single account and Region. Using AWS CloudFormation StackSets makes it easier to expand to additional accounts and Regions in the future. +If you are only use a single account and Region, you can deploy the complete example as a CloudFormation stack instead of an CloudFormation stack set. However if possible, we recommend that you use the multi-account, multi-Region stack set approach even if only use a single account and Region. Using CloudFormation StackSets makes it easier to expand to additional accounts and Regions in the future. @@ -113 +113 @@ If you are only use a single account and Region, you can deploy the complete exa -Use the following steps to deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/tree/main/custom_ssm_setup) AWS CloudFormation template as an AWS CloudFormation stack in a single account and AWS Region: +Use the following steps to deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/tree/main/custom_ssm_setup) CloudFormation template as an CloudFormation stack in a single account and AWS Region: @@ -117 +117 @@ Use the following steps to deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https:// - 2. Customize the default AWS CloudFormation parameter values based on your organization’s requirements. + 2. Customize the default CloudFormation parameter values based on your organization’s requirements. @@ -123 +123 @@ Use the following steps to deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https:// - 5. Retrieve and record the Amazon Resource Name (ARN) for the S3 bucket containing your CloudWatch configurations. For more information about this, see the [Managing CloudWatch configurations](./create-store-cloudwatch-configurations.html#store-cloudwatch-configuration-s3) section of this guide. A sample [cloudwatch-config-s3-bucket.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/blob/main/cloudwatch-config-s3-bucket.yaml) AWS CloudFormation template is available that includes a bucket policy to provide read access to AWS Organizations accounts. + 5. Retrieve and record the Amazon Resource Name (ARN) for the S3 bucket containing your CloudWatch configurations. For more information about this, see the [Managing CloudWatch configurations](./create-store-cloudwatch-configurations.html#store-cloudwatch-configuration-s3) section of this guide. A sample [cloudwatch-config-s3-bucket.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/blob/main/cloudwatch-config-s3-bucket.yaml) CloudFormation template is available that includes a bucket policy to provide read access to AWS Organizations accounts. @@ -125 +125 @@ Use the following steps to deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https:// - 6. Deploy the customized Quick Setup AWS CloudFormation template to the same account as your S3 bucket: + 6. Deploy the customized Quick Setup CloudFormation template to the same account as your S3 bucket: @@ -147 +147 @@ Use the following steps to deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https:// -## Customized Quick Setup in multiple Regions and multiple accounts with AWS CloudFormation StackSets +## Customized Quick Setup in multiple Regions and multiple accounts with CloudFormation StackSets @@ -149 +149 @@ Use the following steps to deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https:// -If you are using multiple accounts and Regions, then you can deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/tree/main/custom_ssm_setup) AWS CloudFormation template as a stack set. You must complete the [AWS CloudFormation StackSet prerequisites](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html) before using stack sets. The requirements vary depending on whether you are deploying stack sets with [**self-managed** or **service-managed** permissions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html). +If you are using multiple accounts and Regions, then you can deploy the [AWS-QuickSetup-SSMHostMgmt.yaml](https://github.com/aws-samples/logging-monitoring-apg-guide-examples/tree/main/custom_ssm_setup) CloudFormation template as a stack set. You must complete the [CloudFormation StackSet prerequisites](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html) before using stack sets. The requirements vary depending on whether you are deploying stack sets with [**self-managed** or **service-managed** permissions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html). @@ -153 +153 @@ We recommend that you deploy stack sets with service-managed permissions so that - 1. Complete steps 1 to 5 from the Customized Quick Setup in a single account and Region with an AWS CloudFormation stack section of this guide. + 1. Complete steps 1 to 5 from the Customized Quick Setup in a single account and Region with an CloudFormation stack section of this guide. @@ -155 +155 @@ We recommend that you deploy stack sets with service-managed permissions so that - 2. Sign in to the AWS Management Console, open the AWS CloudFormation consoler and choose **Create StackSet** : + 2. Sign in to the AWS Management Console, open the CloudFormation consoler and choose **Create StackSet** : @@ -157 +157 @@ We recommend that you deploy stack sets with service-managed permissions so that - * Choose **Template is ready** and **Upload a template file**. Upload the AWS CloudFormation template that you customized to your requirements. + * Choose **Template is ready** and **Upload a template file**. Upload the CloudFormation template that you customized to your requirements. @@ -181 +181 @@ We recommend that you deploy stack sets with service-managed permissions so that - * Test that Systems Manager and CloudWatch are correctly working in the deployed accounts by following step 7 from the Customized Quick Setup in a single account and Region with an AWS CloudFormation stack section of this guide. + * Test that Systems Manager and CloudWatch are correctly working in the deployed accounts by following step 7 from the Customized Quick Setup in a single account and Region with an CloudFormation stack section of this guide. @@ -192 +192 @@ The CloudWatch agent for on-premises servers and VMs is installed and configured -**Consider using accounts and Regions that have VPN or AWS Direct Connect access and AWS PrivateLink.** | You can use AWS Direct Connect or AWS Virtual Private Network (AWS VPN) to establish private connections between on-premises networks and your virtual private cloud (VPC). AWS PrivateLink establishes a private connection to CloudWatch Logs with an interface VPC endpoint. This approach is useful if you have restrictions that prevent data being sent over the public internet to a public service endpoint. +**Consider using accounts and Regions that have VPN or Direct Connect access and AWS PrivateLink.** | You can use AWS Direct Connect or AWS Virtual Private Network (AWS VPN) to establish private connections between on-premises networks and your virtual private cloud (VPC). AWS PrivateLink establishes a private connection to CloudWatch Logs with an interface VPC endpoint. This approach is useful if you have restrictions that prevent data being sent over the public internet to a public service endpoint.