https://community.dynatrace.com/t5/Troubleshooting/Keep-AWS-monitoring-only-on-selected-ActiveGates/ta-p/302373 <P>&nbsp;</P> <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <H2>Summary</H2> <P>With Classic AWS monitoring, an AWS connection can be handled by any ActiveGate that is eligible to run it. Filtering the AWS regions (via custom.properties) ann/or using Network Zones/ActiveGate groups do not control which ActiveGate performs the monitoring.</P> <H2>Problem</H2> <P>A particular AWS account must be monitored only through a subset of AWS-enabled ActiveGates (for example, only in Europe), so there's a need to control which ActiveGates will be monitoring these AWS account/credentials.</P> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P>As mentioned, any AWS-enabled ActiveGate can be a target for assignment of any AWS account monitoring,<BR />the quickest way to locate which account being monitored by which ActiveGate using Data Explorer is to run queries similar to below</P> <P>- either by the hostname -</P> <P>dsfm:active_gate.aws.elements.total:splitBy("aws.account_id","host.name"):sort(value(auto,descending)):limit(20)</P> <P>- or by the ActiveGate ID</P> <P>dsfm:active_gate.aws.elements.total:splitBy("aws.account_id","dt.active_gate.id"):sort(value(auto,descending)):limit(20)</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Andriy_Sidorkin_0-1784892979307.png" style="width: 807px;"><img src="https://community.dynatrace.com/t5/image/serverpage/image-id/33757iC284A8A43DA9642A/image-dimensions/807x448?v=v2" width="807" height="448" role="button" title="Andriy_Sidorkin_0-1784892979307.png" alt="Andriy_Sidorkin_0-1784892979307.png" /></span> <P>&nbsp;</P> <H2>Resolution/configuration steps</H2> <P>1. Give the required ActiveGates their own AWS IAM role.</P> <P>The role must be used only by the ActiveGates that are allowed to monitor the account. If European and non-European ActiveGates share the same role, AWS sees them as the same identity and cannot tell them apart.</P> <P>2. Update the monitoring role in the target AWS account.</P> <P>In its trust policy, allow `sts:AssumeRole` only from the IAM role used by the selected ActiveGates. Keep the Dynatrace external ID condition when one is configured, so the target account should trust:</P> <P>```<BR />ActiveGate (from EU, for example) role -&gt; allowed<BR />Other ActiveGate roles -&gt; not allowed<BR />```</P> <P>3. Remove access from the other ActiveGate roles.</P> <P>Check both sides of the role setup:</P> <P>- The target ActiveGate role is allowed to assume the target monitoring role.<BR />- The target monitoring role trusts this subset's ActiveGate role.<BR />- Roles used by ActiveGates in other locations are not included.</P> <P>4. Test and verify.</P> <P>After changing the policies, allow some time for existing AWS STS sessions to expire. <BR />- The AWS connection validates in Dynatrace.<BR />- Data starts or continues to arrive in Data Explorer.<BR />- ActiveGate logs show successful polling on an allowed European ActiveGate.<BR />- AWS CloudTrail shows `AssumeRole` requests from the expected European ActiveGate role.</P> <P><EM>&nbsp;</EM></P> <H2>Important to know</H2> <P>- ActiveGate groups and network zones do not provide a per-AWS-connection pinning option for Classic AWS monitoring.<BR />- The setup above limits which ActiveGates have permission to monitor the account. It does not create scheduler affinity inside Dynatrace.<BR />- To ensure availability - use at least two ActiveGates if monitoring must continue when one ActiveGate is unavailable.<BR />- Again, if all allowed target ActiveGates are unavailable, AWS monitoring will stop instead of moving to an ActiveGate that does not have permission.</P> <H2>References</H2> <P>- [Dynatrace Classic AWS credentials API](<A href="https://docs.dynatrace.com/docs/dynatrace-api/configuration-api/aws-credentials-api/get-credentials" target="_blank" rel="noopener">https://docs.dynatrace.com/docs/dynatrace-api/configuration-api/aws-credentials-api/get-credentials</A>)<BR />- [Dynatrace ActiveGate groups](<A href="https://docs.dynatrace.com/docs/ingest-from/dynatrace-activegate/activegate-group" target="_blank" rel="noopener">https://docs.dynatrace.com/docs/ingest-from/dynatrace-activegate/activegate-group</A>)<BR />- [Dynatrace ActiveGate network-zone connectivity](<A href="https://docs.dynatrace.com/docs/manage/network-zones/activegate-connectivity" target="_blank" rel="noopener">https://docs.dynatrace.com/docs/manage/network-zones/activegate-connectivity</A>)<BR />- [AWS cross-account role access](<A href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html" target="_blank" rel="noopener">https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html</A>)</P> </DIV> Fri, 24 Jul 2026 11:59:05 GMT Andriy_Sidorkin 2026-07-24T11:59:05Z https://community.dynatrace.com/t5/Troubleshooting/Keep-AWS-monitoring-only-on-selected-ActiveGates/ta-p/302373 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H2>Summary</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve/ task it will describe.</EM></P> <P>&nbsp;</P> <H2>Problem</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem/ task to be described. Use anonymized screenshots, and include text for&nbsp;important messages, errors, or information that will help the customer find this article when searching.</EM></P> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P><EM>*This section can be omitted as necessary.</EM></P> <P><EM>Explain what troubleshooting steps should be taken to ensure the problem matches this article.</EM></P> <P>&nbsp;</P> <H2>Resolution</H2> <P><EM>*This section can be omitted for articles that guide customers on ticket creation.</EM></P> <P><EM>Explain the solution or all possible solutions resulting from the troubleshooting steps.<BR /><BR /></EM></P> <H2>What's next</H2> <P><EM>*This is a mandatory section. Customers need a way to respond or follow up if they have questions.&nbsp;</EM></P> <P><EM>Explain what to do if the article did not help.&nbsp;</EM><EM>Note that there are multiple options available, including:</EM></P> <OL> <LI><EM><STRONG>Opening a support ticket</STRONG> - be as specific as possible about the information the customer should include in the ticket.&nbsp;</EM> If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket: <UL> <LI>link to XYZ</LI> <LI>screenshot of XYZ</LI> <LI>information about XYZ</LI> </UL> </LI> <LI><EM><STRONG>Suggesting Product Idea</STRONG> - encourage the customer to suggest/ vote for a Product Idea explaining their business use case.</EM></LI> <LI><EM><STRONG>Explain this will change in the future</STRONG> - explain that this behaviour will change in a future release. (No product idea / support ticket needed)</EM></LI> <LI><EM><STRONG>Alternatives -</STRONG>&nbsp;any other actions or links to other articles that could move the customer forward.</EM></LI> </OL> <P>&nbsp;</P> <P><EM>*If it exists, link this article to the relevant troubleshooting map using the following guideline</EM></P> <H3>More articles can be found on the <A href="https://community.dynatrace.com/t5/Troubleshooting/" target="_self">XXX Troubleshooting Map</A></H3> </DIV> Fri, 24 Jul 2026 11:59:05 GMT https://community.dynatrace.com/t5/Troubleshooting/Keep-AWS-monitoring-only-on-selected-ActiveGates/ta-p/302373 Andriy_Sidorkin 2026-07-24T11:59:05Z