AWS devopsagent documentation change
Summary
Updated AWS DevOps Agent CDK guide: removed preview notice, added region availability details, updated IAM policy names from AIOpsAssistantPolicy to AIDevOpsAgentAccessPolicy and AIDevOpsOperatorAppAccessPolicy, improved formatting and clarity, and replaced hardcoded us-east-1 region with <REGION> placeholder.
Security assessment
The changes are routine documentation updates for service maturity (removing preview status) and expanding region support. The IAM policy name changes appear to be rebranding or policy updates (AIOpsAssistantPolicy → AIDevOpsAgentAccessPolicy) but there's no evidence this addresses a specific security vulnerability. The documentation clarifies IAM role configurations but doesn't introduce new security features or address disclosed security issues.
Diff
diff --git a/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-aws-cdk.md b/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-aws-cdk.md index 080a3c805..f226a32fe 100644 --- a//devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-aws-cdk.md +++ b//devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-aws-cdk.md @@ -11 +11 @@ OverviewPrerequisitesWhat this guide coversResources createdSetupPart 1: Deploy -This guide shows you how to use the AWS Cloud Development Kit (AWS CDK) to create and deploy AWS DevOps Agent resources. The CDK application automates the creation of an agent space, IAM roles, an operator app, and AWS account associations through AWS CloudFormation. +This guide shows you how to use the AWS Cloud Development Kit (AWS CDK) to create and deploy AWS DevOps Agent resources. The AWS CDK application automates the creation of an agent space, AWS Identity and Access Management (IAM) roles, an operator app, and AWS account associations through AWS CloudFormation. @@ -13 +13 @@ This guide shows you how to use the AWS Cloud Development Kit (AWS CDK) to creat -The CDK approach automates the manual steps described in the [CLI onboarding guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-cli-onboarding-guide.html) by defining all required resources as infrastructure as code. +The AWS CDK approach automates the manual steps described in the [CLI onboarding guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-cli-onboarding-guide.html) by defining all required resources as infrastructure as code. @@ -15,3 +15 @@ The CDK approach automates the manual steps described in the [CLI onboarding gui -###### Note - - __AWS DevOps Agent is in preview. The instructions on this page may change before general availability (GA). +AWS DevOps Agent is available in the following 6 AWS Regions: US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), and Europe (Ireland). For more information about supported Regions, see [Supported Regions](./about-aws-devops-agent-supported-regions.html). @@ -21 +19 @@ The CDK approach automates the manual steps described in the [CLI onboarding gui -Before you begin, make sure you have the following: +Before you begin, make sure that you have the following: @@ -23 +21 @@ Before you begin, make sure you have the following: - * AWS CLI installed and configured with appropriate credentials + * AWS Command Line Interface (AWS CLI) installed and configured with the appropriate credentials @@ -27 +25 @@ Before you begin, make sure you have the following: - * AWS CDK CLI installed globally: `npm install -g aws-cdk` + * AWS CDK command line interface (CLI) installed globally. To install the AWS CDK CLI, run the following command: @@ -29 +26,0 @@ Before you begin, make sure you have the following: - * One AWS account for the monitoring (primary) account @@ -31 +27,0 @@ Before you begin, make sure you have the following: - * (Optional) A second AWS account if you want to set up cross-account monitoring @@ -34,0 +31,6 @@ Before you begin, make sure you have the following: + npm install -g aws-cdk + + * One AWS account for the monitoring (primary) account + + * (Optional) A second AWS account if you want to set up cross-account monitoring + @@ -36 +37,0 @@ Before you begin, make sure you have the following: -###### Important @@ -38 +38,0 @@ Before you begin, make sure you have the following: - __AWS DevOps Agent is currently available in the`us-east-1` Region. @@ -44 +44 @@ This guide is divided into two parts: - * **Part 1** — Deploy an agent space with an operator app and an AWS association in your monitoring account. After completing this part, the agent can monitor issues in that account. + * **Part 1** — Deploy an agent space with an operator app and an AWS association in your monitoring account. After you complete this part, the agent can monitor issues in that account. @@ -46 +46 @@ This guide is divided into two parts: - * **Part 2 (Optional)** — Add a source AWS association for a service account and deploy a cross-account IAM role into that account. This allows the agent space to monitor resources across accounts. + * **Part 2 (Optional)** — Add a source AWS association for a service account and deploy a cross-account IAM role into that account. This configuration enables the agent space to monitor resources across accounts. @@ -55 +55 @@ This guide is divided into two parts: - * **IAM role** (`DevOpsAgentRole-AgentSpace`) — Assumed by the DevOps Agent service to monitor the account. Includes the `AIOpsAssistantPolicy` managed policy and inline policies for support and expanded permissions. + * **IAM role** (`DevOpsAgentRole-AgentSpace`) — Assumed by the DevOps Agent service to monitor the account. Includes the `AIDevOpsAgentAccessPolicy` managed policy and an inline policy that allows creation of the Resource Explorer service-linked role. @@ -57 +57 @@ This guide is divided into two parts: - * **IAM role** (`DevOpsAgentRole-WebappAdmin`) — Operator app role with inline policies for agent operations and support actions. + * **IAM role** (`DevOpsAgentRole-WebappAdmin`) — Operator app role with the `AIDevOpsOperatorAppAccessPolicy` managed policy for agent operations. @@ -59 +59 @@ This guide is divided into two parts: - * **Agent space** (`MyCDKAgentSpace`) — The central agent space, created using the `AWS::DevOpsAgent::AgentSpace` CloudFormation resource. Includes operator app configuration. + * **Agent space** (`MyCDKAgentSpace`) — The central agent space, created by using the `AWS::DevOpsAgent::AgentSpace` CloudFormation resource. Includes operator app configuration. @@ -61 +61 @@ This guide is divided into two parts: - * **Association** (AWS monitor) — Links the monitoring account to the agent space using the `AWS::DevOpsAgent::Association` CloudFormation resource. + * **Association** (AWS monitor) — Links the monitoring account to the agent space by using the `AWS::DevOpsAgent::Association` CloudFormation resource. @@ -70 +70 @@ This guide is divided into two parts: - * **IAM role** (`DevOpsAgentRole-SecondaryAccount`) — Cross-account role with a fixed name. Trusted by the agent space in the monitoring account. Includes the `AIOpsAssistantPolicy` managed policy and expanded inline policies. + * **IAM role** (`DevOpsAgentRole-SecondaryAccount`) — Cross-account role with a fixed name. Trusted by the agent space in the monitoring account. Includes the `AIDevOpsAgentAccessPolicy` managed policy and an inline policy that allows creation of the Resource Explorer service-linked role. @@ -80,0 +81,2 @@ This guide is divided into two parts: +Run the following commands to clone the repository and change to the project directory: + @@ -82 +84,2 @@ This guide is divided into two parts: - git clone https://github.com/aws-samples/sample-aws-devops-agent-cdk.gitcd sample-aws-devops-agent-cdk + git clone https://github.com/aws-samples/sample-aws-devops-agent-cdk.git + cd sample-aws-devops-agent-cdk @@ -85,0 +89 @@ This guide is divided into two parts: +Run the following command to install the project dependencies: @@ -87 +90,0 @@ This guide is divided into two parts: - npm install @@ -88,0 +92 @@ This guide is divided into two parts: + npm install @@ -97,0 +102 @@ Open `lib/constants.ts` and set your monitoring account ID: +The following example shows the constant to update: @@ -99 +103,0 @@ Open `lib/constants.ts` and set your monitoring account ID: - export const MONITORING_ACCOUNT_ID = "<YOUR_MONITORING_ACCOUNT_ID>"; @@ -100,0 +105 @@ Open `lib/constants.ts` and set your monitoring account ID: + export const MONITORING_ACCOUNT_ID = "<YOUR_MONITORING_ACCOUNT_ID>"; @@ -104 +109 @@ Open `lib/constants.ts` and set your monitoring account ID: -If you have not bootstrapped the AWS CDK in your monitoring account, run the following command: +If you haven't bootstrapped the AWS CDK in your monitoring account, run the following command: @@ -107 +112 @@ If you have not bootstrapped the AWS CDK in your monitoring account, run the fol - cdk bootstrap aws://<MONITORING_ACCOUNT_ID>/us-east-1 --profile monitoring + cdk bootstrap aws://<MONITORING_ACCOUNT_ID>/<REGION> --profile monitoring @@ -111 +116 @@ If you have not bootstrapped the AWS CDK in your monitoring account, run the fol -Build the TypeScript code and deploy the stack: +Run the following commands to build the TypeScript code and deploy the stack: @@ -119 +124,3 @@ Build the TypeScript code and deploy the stack: -After deployment completes, the AWS CDK prints the stack outputs. Record these values for later use: +After deployment completes, the AWS CDK prints the stack outputs. Record these values for later use. + +The following example shows the expected output: @@ -123 +130 @@ After deployment completes, the AWS CDK prints the stack outputs. Record these v - DevOpsAgentStack.AgentSpaceArn = arn:aws:aidevops:us-east-1:123456789012:agentspace/abc123 + DevOpsAgentStack.AgentSpaceArn = arn:aws:aidevops:<REGION>:123456789012:agentspace/abc123 @@ -128 +135 @@ After deployment completes, the AWS CDK prints the stack outputs. Record these v -If you plan to complete Part 2, save the `AgentSpaceArn` value. You will need it to configure the service account stack. +If you plan to complete Part 2, save the `AgentSpaceArn` value. You need it to configure the service account stack. @@ -132 +139 @@ If you plan to complete Part 2, save the `AgentSpaceArn` value. You will need it -Use the AWS CLI to verify that the agent space was created successfully: +To verify that the agent space was created successfully, run the following AWS CLI command: @@ -137 +144 @@ Use the AWS CLI to verify that the agent space was created successfully: - --region us-east-1 + --region <REGION> @@ -143 +150 @@ At this point, your agent space is deployed with the operator app enabled and yo -In this section, you extend the setup so the agent space can monitor resources in a second AWS account (the service account). This involves two actions: +In this section, you extend the setup so that your agent space can monitor resources in a second AWS account (the service account). This involves two actions: @@ -154 +161 @@ In this section, you extend the setup so the agent space can monitor resources i - __You must complete Part 1 before proceeding. The ServiceStack requires the`AgentSpaceArn` from the DevOpsAgentStack deployment output. + __You must complete Part 1 before you proceed. The ServiceStack requires the`AgentSpaceArn` from the DevOpsAgentStack deployment output. @@ -159,0 +167,2 @@ Open `lib/constants.ts` and set your service account ID: +The following example shows the constant to update: + @@ -162,0 +172 @@ Open `lib/constants.ts` and set your service account ID: +The DevOpsAgentStack creates a source AWS association by using this account ID. If you deployed the DevOpsAgentStack before setting this value, redeploy to create the association: @@ -164 +174 @@ Open `lib/constants.ts` and set your service account ID: -The DevOpsAgentStack creates a source AWS association using this account ID. If you deployed the DevOpsAgentStack before setting this value, redeploy to create the association: +Run the following commands to redeploy: @@ -173,0 +184 @@ Copy the `AgentSpaceArn` value from the DevOpsAgentStack output (Part 1, Step 4) +The following example shows the constant to update: @@ -175 +185,0 @@ Copy the `AgentSpaceArn` value from the DevOpsAgentStack output (Part 1, Step 4) - export const AGENT_SPACE_ARN = "arn:aws:aidevops:us-east-1:<MONITORING_ACCOUNT_ID>:agentspace/<SPACE_ID>"; @@ -176,0 +187 @@ Copy the `AgentSpaceArn` value from the DevOpsAgentStack output (Part 1, Step 4) + export const AGENT_SPACE_ARN = "arn:aws:aidevops:<REGION>:<MONITORING_ACCOUNT_ID>:agentspace/<SPACE_ID>"; @@ -182,2 +193 @@ The ServiceStack uses this value to scope the trust policy on the secondary acco -If you have not bootstrapped the AWS CDK in your service account, run the following command: - +If you haven't bootstrapped the AWS CDK in your service account, run the following command: @@ -185 +194,0 @@ If you have not bootstrapped the AWS CDK in your service account, run the follow - cdk bootstrap aws://<SERVICE_ACCOUNT_ID>/us-east-1 --profile service @@ -186,0 +196 @@ If you have not bootstrapped the AWS CDK in your service account, run the follow + cdk bootstrap aws://<SERVICE_ACCOUNT_ID>/<REGION> --profile service @@ -190 +200 @@ If you have not bootstrapped the AWS CDK in your service account, run the follow -Build and deploy the ServiceStack using credentials for the service account: +Run the following commands to build and deploy the ServiceStack by using credentials for the service account: @@ -208 +217 @@ This creates the following resources in the service account: -Test the echo service to confirm the Lambda function was deployed successfully: +To confirm that the Lambda function was deployed successfully, run the following commands to test the echo service: @@ -219,0 +229,2 @@ Test the echo service to confirm the Lambda function was deployed successfully: +This section describes common issues and how to resolve them. + @@ -222 +233 @@ Test the echo service to confirm the Lambda function was deployed successfully: - * Verify that you are deploying in the `us-east-1` Region. + * Verify that you are deploying in a [Supported Regions](./about-aws-devops-agent-supported-regions.html). @@ -256 +267,3 @@ Test the echo service to confirm the Lambda function was deployed successfully: -To remove all resources, destroy the stacks in reverse order: +To remove all resources, destroy the stacks in reverse order. + +Run the following commands to destroy the stacks: @@ -264 +277 @@ To remove all resources, destroy the stacks in reverse order: -**Warning:** This permanently deletes your agent space and all associated data. Make sure you have backed up any important information before proceeding. +**Warning:** This action permanently deletes your agent space and all associated data. This action can't be undone. Make sure that you have backed up any important information before you proceed. @@ -268 +281 @@ To remove all resources, destroy the stacks in reverse order: - * The CDK application creates IAM roles with trust policies that only allow the `aidevops.amazonaws.com` service principal to assume them. + * The AWS CDK application creates IAM roles with trust policies that only allow the `aidevops.amazonaws.com` service principal to assume them. @@ -281 +294 @@ To remove all resources, destroy the stacks in reverse order: -After you have deployed your AWS DevOps Agent using the AWS CDK: +After you have deployed your AWS DevOps Agent by using the AWS CDK: @@ -285 +298 @@ After you have deployed your AWS DevOps Agent using the AWS CDK: - 2. Consider integrating the CDK deployment into your CI/CD pipelines for automated infrastructure management. + 2. Consider integrating the AWS CDK deployment into your CI/CD pipelines for automated infrastructure management. @@ -294 +307 @@ After you have deployed your AWS DevOps Agent using the AWS CDK: - * [Sample CDK repository](https://github.com/aws-samples/sample-aws-devops-agent-cdk) + * [Sample CDK repository](https://github.com/aws-samples/sample-aws-devops-agent-cdk) on the GitHub website @@ -309 +322 @@ Creating a test environment -Getting started with AWS DevOps Agent using Terraform +Getting started with AWS DevOps Agent using AWS CloudFormation