AWS AmazonCloudWatch documentation change
Summary
Restructured and updated OpenTelemetry Collector documentation with new sections on supported receivers, getting started steps, and detailed configuration examples including SigV4 authentication for OTLP endpoints.
Security assessment
The changes add explicit documentation about using SigV4 authentication (via the sigv4auth extension) for authenticating the OpenTelemetry Collector with CloudWatch endpoints. This provides guidance on secure authentication practices but does not address a specific security vulnerability or incident.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPSimplesetup.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPSimplesetup.md index d993c72ce..f593ab79b 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPSimplesetup.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPSimplesetup.md @@ -5 +5 @@ -PrerequisiteDownload the OpenTelemetry Collector ContribInstall the OpenTelemetry Collector ContribSetup AWS credentials on your Amazon EC2 or on-premise hostsSetup AWS credentials for your Amazon EKS or Kubernetes clustersConfigure the OpenTelemetry Collector +Supported receiversGetting startedCollector configuration examples @@ -7 +7 @@ PrerequisiteDownload the OpenTelemetry Collector ContribInstall the OpenTelemetr -# OpenTelemetry Collector Contrib +# OpenTelemetry Collector @@ -9 +9 @@ PrerequisiteDownload the OpenTelemetry Collector ContribInstall the OpenTelemetr -You can use the OpenTelemetry Collector Contrib to get started with OpenTelemetry in CloudWatch. +The OpenTelemetry Collector is an open source, vendor-agnostic agent that receives, processes, and exports telemetry data. It acts as a central pipeline between your applications and Amazon CloudWatch, collecting metrics, logs, and traces from multiple sources and sending them to CloudWatch using the OpenTelemetry Protocol (OTLP). @@ -11 +11 @@ You can use the OpenTelemetry Collector Contrib to get started with OpenTelemetr -## Prerequisite +Using the OpenTelemetry Collector with CloudWatch provides the following benefits: @@ -13 +13 @@ You can use the OpenTelemetry Collector Contrib to get started with OpenTelemetr -Make sure _Transaction Search_ is enabled in CloudWatch. For more information, see [Transaction Search](https://docs.aws.amazon.com//AmazonCloudWatch/latest/monitoring/CloudWatch-Transaction-Search.html). + * Collect telemetry from multiple applications and hosts through a single agent, reducing the number of connections to CloudWatch. @@ -15 +15 @@ Make sure _Transaction Search_ is enabled in CloudWatch. For more information, s -## Download the OpenTelemetry Collector Contrib + * Process and filter telemetry before sending it to CloudWatch, including adding or removing attributes, batching data, and sampling traces. @@ -17 +17 @@ Make sure _Transaction Search_ is enabled in CloudWatch. For more information, s -Download the latest release of the [ OpenTelemetry Collector Contrib distribution](https://github.com/open-telemetry/opentelemetry-collector-releases/releases). + * Use the same collector configuration across AWS, on-premises, and other cloud environments, providing a consistent telemetry pipeline regardless of where your applications run. @@ -19 +19 @@ Download the latest release of the [ OpenTelemetry Collector Contrib distributio -## Install the OpenTelemetry Collector Contrib + * Send metrics to CloudWatch with rich labels that are available to query using the Prometheus Query Language (PromQL) in CloudWatch Query Studio. @@ -21 +20,0 @@ Download the latest release of the [ OpenTelemetry Collector Contrib distributio -Install the OpenTelemetry Collector Contrib on any operating system and platform. For more information, see [Install the Collector](https://opentelemetry.io/docs/collector/installation/). @@ -23 +21,0 @@ Install the OpenTelemetry Collector Contrib on any operating system and platform -## Setup AWS credentials on your Amazon EC2 or on-premise hosts @@ -25 +23,27 @@ Install the OpenTelemetry Collector Contrib on any operating system and platform -You can setup AWS credentials on your Amazon EC2 or on-premise hosts. + +## Supported receivers + +The OpenTelemetry Collector supports a wide range of receivers for ingesting telemetry data. You can use OpenTelemetry receivers such as the OTLP receiver for applications instrumented with OpenTelemetry SDKs, or Prometheus receivers to scrape metrics from existing Prometheus exporters. Common Prometheus receivers used with CloudWatch include: + + * Prometheus receiver, for scraping any Prometheus-compatible endpoint + + * Host Metrics receiver, for collecting system-level metrics from the host + + * Kubernetes Cluster receiver, for collecting cluster-level metrics from the Kubernetes API server + + + + +You can configure multiple receivers in a single collector, allowing you to collect both OpenTelemetry and Prometheus metrics and send them to CloudWatch through the same pipeline. For the full list of available receivers, see the OpenTelemetry Collector [repository](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver). + +## Getting started + +Prerequisite – If using the OTLP endpoint for tracing, ensure that Transaction Search is enabled. + +Steps: + + 1. Download the latest release of the OpenTelemetry Collector distribution. For more information, see the OpenTelemetry Collector [releases](https://github.com/open-telemetry/opentelemetry-collector-releases/releases). + + 2. Install the OpenTelemetry Collector on your host. The collector runs on any operating system and platform. For more information, see [Install the Collector](https://opentelemetry.io/docs/collector/installation/). + + 3. Configure AWS credentials on your Amazon EC2 or on-premises host. The collector uses these credentials to authenticate with CloudWatch when sending telemetry data. See below for details. @@ -91,6 +112 @@ Setup IAM permissions for on-premise hosts - - - -## Setup AWS credentials for your Amazon EKS or Kubernetes clusters - -To setup AWS credentials for your Amazon EKS or Kubernetes clusters to send telemetry to CloudWatch, follow the below procedure. + 4. Setup AWS credentials for your Amazon EKS or Kubernetes clusters. The easiest way to get started with Amazon EKS is to use the EKS OTel Container Insights add-on. If you prefer to use the OpenTelemetry Collector directly, follow the procedure below to set up AWS credentials for your Amazon EKS or Kubernetes clusters to send telemetry to CloudWatch. @@ -148,0 +162,2 @@ Setup IAM permissions for Kubernetes + 5. Configure the OTLP exporter in your collector configuration to send telemetry to the CloudWatch endpoint. See examples below. + @@ -152 +167 @@ Setup IAM permissions for Kubernetes -## Configure the OpenTelemetry Collector +## Collector configuration examples @@ -254,0 +270,72 @@ Configure your OpenTelemetry SDKs to _always_on_ sampling configuration to relia +Copy and paste the content below to configure your collector to send metrics to the OTLP endpoints. + + + receivers: + otlp: + protocols: + http: + endpoint: "0.0.0.0:4318" + + processors: + batch: + send_batch_size: 200 + timeout: 10s + + exporters: + otlphttp: + tls: + insecure: false + endpoint: metrics_otlp_endpoint + auth: + authenticator: sigv4auth + + extensions: + sigv4auth: + service: "monitoring" + region: "region" + + service: + extensions: [sigv4auth] + pipelines: + metrics: + receivers: [**otlp**] + processors: [**batch**] + exporters: [**otlphttp**] + + +The following is an example to send metrics using sigv4 to us-east-1. + + + receivers: + otlp: + protocols: + http: + endpoint: "0.0.0.0:4318" + + processors: + batch: + send_batch_size: 200 + timeout: 10s + + exporters: + otlphttp: + tls: + insecure: false + endpoint: "https://monitoring.us-east-1.amazonaws.com/v1/metrics:443" + auth: + authenticator: sigv4auth + + extensions: + sigv4auth: + service: "**monitoring** " + region: "**us-east-1** " + + service: + extensions: [sigv4auth] + pipelines: + metrics: + receivers: [**otlp**] + processors: [**batch**] + exporters: [**otlphttp**] + +