topic AWS Integration in Cloud platforms

AWS Integration

Prithvi_Mandal — Tue, 15 Oct 2024 08:52:03 GMT

Dear Team,

We have two different AWS account one is 'A' and another one is 'B' , As we know for AWS integration with Dynatrace

we have to deploy ActiveGate on same AWS account, Now my question is if I deploy ActiveGate on A ( AWS Account) then can I use same ActiveGate to integrate with B (AWS account).

Kindly let me know this approach is feasible or not.

Thanks & Regard

Prithvi

Re: AWS Integration

dawid_kaszubski — Thu, 10 Oct 2024 10:23:24 GMT

Hi @Prithvi_Mandal ,
Yes, you can definitely use an ActiveGate deployed on the A account to monitor the B account.
Please remember that you need a DynatraceMonitoringRole in the B account with the A account in the Trust Relationships.
So, in the A account Dynatrace_ActiveGate_role's permissions should look like that:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Action": [
            "sts:AssumeRole"
         ],
         "Resource": [
            "arniam::<accountA>:role/Dynatrace_monitoring_role",
            "arniam::<accountB>:role/Dynatrace_monitoring_role"
         ],
         "Effect": "Allow"
      }
   ]
}

And in the B account DynatraceMonitoringRole's Trust Relationships should look like:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": {
            "AWS": [
               "arniam::<accountA>:role/Dynatrace_ActiveGate"
            ]
         },
         "Action": "sts:AssumeRole",
         "Condition": {
            "StringEquals": {
               "sts:ExternalId": "<ExternalId>"
            }
         }
      }
   ]
}

Re: AWS Integration

Prithvi_Mandal — Thu, 10 Oct 2024 10:25:18 GMT

thanks you @dawid_kaszubski for your suggestion.

Re: AWS Integration

p_devulapalli — Thu, 10 Oct 2024 10:26:29 GMT

@Prithvi_Mandal Here is some documentation you can refer to , look under "Deployment with existing ActiveGate"

https://docs.dynatrace.com/docs/shortlink/aws-monitoring-guide#aws-policy-and-authentication

Re: AWS Integration

Prithvi_Mandal — Sun, 24 Nov 2024 21:33:05 GMT

Hii @dawid_kaszubski ,

Some confusion that , activegate deployed on A account already in use to monitored other AWS account (ie C account. but I want to use same activegate to monitored B account.

Please find attached template , Is there any need to change this template.

Re: AWS Integration

dawid_kaszubski — Tue, 26 Nov 2024 17:29:32 GMT

Hi @Prithvi_Mandal , the CloudFormation template you attached is tailored to use only one `DynatraceMonitoringRole`. It's defined in line :49.
`- !Sub 'arniam::${MonitoredAccountID}:role/${MonitoringRoleName}'
I've attached an example template for two accounts. If you want to monitor more accounts, you can configure it in the same manner.