AWS devopsagent documentation change
Summary
Complete restructuring of the AWS DevOps Agent Terraform guide with updated content, new sections for cross-account monitoring, and added security considerations
Security assessment
The changes are a comprehensive rewrite and reorganization of the documentation, not addressing a specific security vulnerability. However, a new 'Security considerations' section was added that documents IAM role trust policies, principle of least privilege, and cross-account security controls. This adds security documentation but doesn't indicate a security issue was fixed.
Diff
diff --git a/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-terraform.md b/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-terraform.md index acd186e1b..65dbb34be 100644 --- a//devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-terraform.md +++ b//devopsagent/latest/userguide/getting-started-with-aws-devops-agent-getting-started-with-aws-devops-agent-using-terraform.md @@ -5 +5 @@ -OverviewPrerequisitesArchitectureGetting startedManual deploymentConfiguration optionsCross-account monitoringVerificationAccessing AWS DevOps AgentTroubleshootingClean upNext steps +OverviewPrerequisitesWhat this guide coversResources createdSetupPart 1: Deploy the agent spacePart 2 (Optional): Add cross-account monitoringTroubleshootingCleanupSecurity considerationsNext stepsAdditional resources @@ -9,2 +8,0 @@ OverviewPrerequisitesArchitectureGetting startedManual deploymentConfiguration o -AWS DevOps Agent helps you monitor and manage your AWS infrastructure using AI-powered insights. This guide shows you how to use Terraform to automate the setup and deployment of AWS DevOps Agent resources, providing Infrastructure as Code for your DevOps monitoring solution. - @@ -13,3 +11 @@ AWS DevOps Agent helps you monitor and manage your AWS infrastructure using AI-p -This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setup, automating the creation of Agent Spaces, IAM roles, and account associations. Using Terraform provides several advantages: - - * **Infrastructure as Code** – Version control your DevOps Agent configuration +This guide shows you how to use Terraform to create and deploy AWS DevOps Agent resources. The Terraform configuration automates the creation of an agent space, IAM roles, an operator app, and AWS account associations. @@ -17 +13 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu - * **Reproducible deployments** – Consistent setup across environments +The Terraform approach automates the manual steps described in the [CLI onboarding guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-cli-onboarding-guide.html) by defining all required resources as infrastructure as code. @@ -19 +15 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu - * **Automated provisioning** – Reduce manual configuration errors +AWS DevOps Agent is available in the following 6 AWS Regions: US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), and Europe (Ireland). For more information about supported Regions, see [Supported Regions](./about-aws-devops-agent-supported-regions.html). @@ -21 +17 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu - * **Cross-account management** – Easily manage multiple AWS accounts +## Prerequisites @@ -22,0 +19 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu +Before you begin, make sure you have the following: @@ -23,0 +21 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu + * Terraform >= 1.0 installed @@ -24,0 +23 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu + * AWS CLI installed and configured with appropriate credentials @@ -26 +25 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu -**Note** + * One AWS account for the monitoring (primary) account @@ -28 +27 @@ This Terraform configuration replicates the AWS DevOps Agent CLI onboarding setu -AWS DevOps Agent is in preview. The instructions on this page may change before general availability (GA). + * (Optional) A second AWS account if you want to set up cross-account monitoring @@ -30 +28,0 @@ AWS DevOps Agent is in preview. The instructions on this page may change before -## Prerequisites @@ -32 +29,0 @@ AWS DevOps Agent is in preview. The instructions on this page may change before -Before you begin, ensure you have: @@ -34 +30,0 @@ Before you begin, ensure you have: - * Terraform >= 1.0 installed @@ -36 +32 @@ Before you begin, ensure you have: - * AWS CLI configured with appropriate permissions +## What this guide covers @@ -38 +34 @@ Before you begin, ensure you have: - * AWS account with administrative access +This guide is divided into two parts: @@ -40 +36 @@ Before you begin, ensure you have: - * AWS DevOps Agent is only available in the `us-east-1` region + * **Part 1** — Deploy an agent space with an operator app and an AWS association in your monitoring account. After completing this part, the agent can monitor issues in that account. @@ -41,0 +38 @@ Before you begin, ensure you have: + * **Part 2 (Optional)** — Add a source AWS association for a service account and deploy a cross-account IAM role plus an echo Lambda into that account. This allows the agent space to monitor resources across accounts. @@ -45 +41,0 @@ Before you begin, ensure you have: -### Required IAM permissions @@ -47 +43 @@ Before you begin, ensure you have: -Your AWS credentials must have permissions to create: _IAM roles and policies_ DevOps Agent resources (Agent Spaces, associations) * Cross-account trust relationships +## Resources created @@ -49 +45 @@ Your AWS credentials must have permissions to create: _IAM roles and policies_ D -## Architecture +### Part 1: Monitoring account @@ -51 +47 @@ Your AWS credentials must have permissions to create: _IAM roles and policies_ D -The Terraform configuration creates the following resources: + * **IAM role** (`DevOpsAgentRole-AgentSpace-*`) — Assumed by the DevOps Agent service to monitor the account. Includes the `AIDevOpsAgentAccessPolicy` managed policy and an inline policy that allows creation of the Resource Explorer service-linked role. @@ -53 +49 @@ The Terraform configuration creates the following resources: -### IAM Resources + * **IAM role** (`DevOpsAgentRole-WebappAdmin-*`) — Operator app role with the `AIDevOpsOperatorAppAccessPolicy` managed policy for agent operations. @@ -55 +51 @@ The Terraform configuration creates the following resources: - * **DevOpsAgentRole-AgentSpace** – IAM role for the Agent Space with monitoring permissions + * **Agent space** (configurable name) — The central agent space, created using the `awscc_devopsagent_agent_space` resource. Includes operator app configuration. @@ -57 +53 @@ The Terraform configuration creates the following resources: - * **DevOpsAgentRole-WebappAdmin** – IAM role for the Operator App interface + * **Association** (AWS monitor) — Links the monitoring account to the agent space using the `awscc_devopsagent_association` resource. @@ -59 +55 @@ The Terraform configuration creates the following resources: - * Associated policies and trust relationships for secure access + * **Association** (AWS source) — (Optional) Links the service account to the agent space for cross-account monitoring. @@ -64 +60 @@ The Terraform configuration creates the following resources: -### DevOps Agent Resources +### Part 2: Service account (optional) @@ -66 +62 @@ The Terraform configuration creates the following resources: - * **Agent Space** – The main container for your DevOps Agent configuration + * **IAM role** (`DevOpsAgentRole-SecondaryAccount-TF`) — Cross-account role with a fixed name. Trusted by the agent space in the monitoring account. Includes the `AIDevOpsAgentAccessPolicy` managed policy and an inline policy that allows creation of the Resource Explorer service-linked role. @@ -68 +64 @@ The Terraform configuration creates the following resources: - * **AWS Account Association** – Links your AWS account for monitoring + * **Lambda function** (`echo-service-tf`) — A simple example service that echoes back input events. @@ -70 +65,0 @@ The Terraform configuration creates the following resources: - * **Operator App** – (Optional) Enables the web-based operator interface @@ -72 +66,0 @@ The Terraform configuration creates the following resources: - * **External Account Associations** – (Optional) For cross-account monitoring @@ -74,0 +69 @@ The Terraform configuration creates the following resources: +## Setup @@ -76,4 +71 @@ The Terraform configuration creates the following resources: - -## Getting started - -### Step 1: Clone the repository +### Step 1: Clone the sample repository @@ -93,2 +84 @@ Copy the example variables file and customize it for your environment: - -Edit `terraform.tfvars` with your specific configuration: +Edit `terraform.tfvars` with your agent space name and description: @@ -98,4 +88,3 @@ Edit `terraform.tfvars` with your specific configuration: - agent_space_description = "DevOps monitoring for production workloads" - enable_operator_app = true - auth_flow = "iam" - # external_account_ids = ["123456789012"] # Optional: for cross-account monitoring + agent_space_description = "DevOps Agent Space for monitoring production workloads" + +## Part 1: Deploy the agent space @@ -102,0 +92 @@ Edit `terraform.tfvars` with your specific configuration: +In this section, you create the agent space, IAM roles, operator app, and an AWS association in your monitoring account. @@ -104 +94 @@ Edit `terraform.tfvars` with your specific configuration: -### Step 3: Deploy with automation (recommended) +### Step 1: Deploy with automation (recommended) @@ -110,0 +101 @@ Use the provided deployment script for a streamlined setup: +This script automatically: @@ -112 +103 @@ Use the provided deployment script for a streamlined setup: -This script automatically: _Checks prerequisites (Terraform, AWS CLI, credentials)_ Creates `terraform.tfvars` from example if needed _Initializes, validates, plans, and applies Terraform_ Handles IAM propagation delays with retry logic + * Checks prerequisites (Terraform, AWS CLI, credentials) @@ -114 +105 @@ This script automatically: _Checks prerequisites (Terraform, AWS CLI, credential -### Step 4: Complete the setup + * Creates `terraform.tfvars` from example if needed @@ -116 +107 @@ This script automatically: _Checks prerequisites (Terraform, AWS CLI, credential -Run the post-deployment script to finalize configuration: + * Initializes, validates, plans, and applies Terraform @@ -119,4 +109,0 @@ Run the post-deployment script to finalize configuration: - ./post-deploy.sh - - -This script: _Configures AWS DevOps Agent CLI if needed_ Optionally enables the Operator App * Provides verification commands @@ -124 +110,0 @@ This script: _Configures AWS DevOps Agent CLI if needed_ Optionally enables the -## Manual deployment @@ -126,3 +112 @@ This script: _Configures AWS DevOps Agent CLI if needed_ Optionally enables the -If you prefer manual control over the deployment process: - -### Step 1: Initialize Terraform +Alternatively, if you prefer manual control: @@ -132,5 +115,0 @@ If you prefer manual control over the deployment process: - - -### Step 2: Review the plan - - @@ -137,0 +117,3 @@ If you prefer manual control over the deployment process: + terraform apply + +Type `yes` when prompted to confirm the deployment. @@ -138,0 +121 @@ If you prefer manual control over the deployment process: +### Step 2: Record the outputs @@ -140 +123 @@ If you prefer manual control over the deployment process: -### Step 3: Apply the configuration +After deployment completes, Terraform prints the outputs. Record these values for later use: @@ -143 +126,8 @@ If you prefer manual control over the deployment process: - terraform apply + Outputs: + agent_space_id = "abc123" + agent_space_arn = "arn:aws:aidevops:<REGION>:<MONITORING_ACCOUNT_ID>:agentspace/abc123" + agent_space_name = "MyCompanyAgentSpace" + devops_agentspace_role_arn = "arn:aws:iam::<MONITORING_ACCOUNT_ID>:role/DevOpsAgentRole-AgentSpace-a1b2c3d4" + devops_operator_role_arn = "arn:aws:iam::<MONITORING_ACCOUNT_ID>:role/DevOpsAgentRole-WebappAdmin-a1b2c3d4" + primary_account_id = "<MONITORING_ACCOUNT_ID>" + primary_account_association_id = "assoc-xyz" @@ -144,0 +135 @@ If you prefer manual control over the deployment process: +If you plan to complete Part 2, save the `agent_space_arn` value. You will need it to configure the service account resources. @@ -146 +137 @@ If you prefer manual control over the deployment process: -Type `yes` when prompted to confirm the deployment. +### Step 3: Verify the deployment @@ -148 +139 @@ Type `yes` when prompted to confirm the deployment. -## Configuration options +Run the post-deployment verification script: @@ -150 +140,0 @@ Type `yes` when prompted to confirm the deployment. -### Input variables @@ -152 +142 @@ Type `yes` when prompted to confirm the deployment. -Variable Description Default Required 1`aws_region` AWS region (must be us-east-1) `us-east-1` Yes 2`agent_space_name` Name for the Agent Space `MyAgentSpace` No 3`agent_space_description` Description for the Agent Space `AgentSpace for monitoring my application` No 4`enable_operator_app` Enable the operator web app TRUE No 5`auth_flow` Authentication flow (iam/idc) `iam` No 6`external_account_ids` External AWS accounts to monitor `[]` No 7`tags` Tags for all resources See variables.tf No + ./post-deploy.sh @@ -154 +144 @@ Variable Description Default Required 1`aws_region` AWS region (must be us-east- -### Output values +Or use the AWS CLI to verify that the agent space was created successfully: @@ -156 +145,0 @@ Variable Description Default Required 1`aws_region` AWS region (must be us-east- -After deployment, Terraform provides these useful outputs: @@ -158 +147,3 @@ After deployment, Terraform provides these useful outputs: - * `agent_space_id` – The ID of your Agent Space + aws devops-agent get-agent-space \ + --agent-space-id <AGENT_SPACE_ID> \ + --region <REGION> @@ -160 +151 @@ After deployment, Terraform provides these useful outputs: - * `agent_space_arn` – The ARN of your Agent Space +At this point, your agent space is deployed with the operator app enabled and your monitoring account associated. The agent can monitor issues in this account. @@ -162 +153 @@ After deployment, Terraform provides these useful outputs: - * `devops_agentspace_role_arn` – ARN of the Agent Space IAM role +## Part 2 (Optional): Add cross-account monitoring @@ -164 +155 @@ After deployment, Terraform provides these useful outputs: - * `devops_operator_role_arn` – ARN of the Operator App IAM role +In this section, you extend the setup so the agent space can monitor resources in a second AWS account (the service account). This involves two actions: @@ -166 +157 @@ After deployment, Terraform provides these useful outputs: - * `manual_setup_instructions` – Next steps and verification commands + 1. Adding a source AWS association that points to the service account. @@ -167,0 +159 @@ After deployment, Terraform provides these useful outputs: + 2. Deploying a cross-account IAM role and an echo Lambda function into the service account. @@ -171 +162,0 @@ After deployment, Terraform provides these useful outputs: