AWS Integration

Platform Cloud platforms
1

Dear Team,

We have two different AWS account one is ‘A’ and another one is ‘B’ , As we know for AWS integration with Dynatrace

we have to deploy ActiveGate on same  AWS account, Now my question is if I deploy ActiveGate on A ( AWS Account) then can I use same ActiveGate to integrate with B (AWS account).

Kindly let me know this approach is feasible  or not.

Thanks & Regard

Prithvi

2

Hi @Prithvi_Mandal ,
Yes, you can definitely use an ActiveGate deployed on the A account to monitor the B account. 
Please remember that you need a DynatraceMonitoringRole in the B account with the A account in the Trust Relationships. 
So, in the A account Dynatrace_ActiveGate_role’s permissions should look like that:

{<br>   <span>"Version"</span><span>: </span><span>"2012-10-17"</span><span>,<br></span>   <span>"Statement"</span><span>: </span>[<br>      {<br>         <span>"Action"</span><span>: </span>[<br>            <span>"sts:AssumeRole"<br></span>         ]<span>,<br></span>         <span>"Resource"</span><span>: </span>[<br>            <span>"arn<img class="lia-deferred-image lia-image-emoji" src="https://community.dynatrace.com/html/@F9676CCDE08B8746467ACFFDC4C9827E/images/emoticons/aws.png" alt=":aws:" title=":aws:">iam::<accountA>:role/Dynatrace_monitoring_role"</span><span>,<br></span>            <span>"arn<img class="lia-deferred-image lia-image-emoji" src="https://community.dynatrace.com/html/@F9676CCDE08B8746467ACFFDC4C9827E/images/emoticons/aws.png" alt=":aws:" title=":aws:">iam::<accountB>:role/Dynatrace_monitoring_role"<br></span>         ]<span>,<br></span>         <span>"Effect"</span><span>: </span><span>"Allow"<br></span>      }<br>   ]<br>}

And in the B account DynatraceMonitoringRole’s Trust Relationships should look like:

{<br>   <span>"Version"</span><span>: </span><span>"2012-10-17"</span><span>,<br></span>   <span>"Statement"</span><span>: </span>[<br>      {<br>         <span>"Effect"</span><span>: </span><span>"Allow"</span><span>,<br></span>         <span>"Principal"</span><span>: </span>{<br>            <span>"AWS"</span><span>: </span>[<br>               <span>"arn<img class="lia-deferred-image lia-image-emoji" src="https://community.dynatrace.com/html/@F9676CCDE08B8746467ACFFDC4C9827E/images/emoticons/aws.png" alt=":aws:" title=":aws:">iam::<accountA>:role/Dynatrace_ActiveGate"<br></span>            ]<br>         }<span>,<br></span>         <span>"Action"</span><span>: </span><span>"sts:AssumeRole"</span><span>,<br></span>         <span>"Condition"</span><span>: </span>{<br>            <span>"StringEquals"</span><span>: </span>{<br>               <span>"sts:ExternalId"</span><span>: </span><span>"<ExternalId>"<br></span>            }<br>         }<br>      }<br>   ]<br>}
3

thanks you @dawid_kaszubski  for your suggestion.

4

@Prithvi_Mandal Here is some documentation you can refer to , look under “Deployment with existing ActiveGate”

5

Hii @dawid_kaszubski ,

Some confusion that , activegate deployed on A account already in use to monitored other AWS account (ie C account. but I want to use same activegate to monitored B account.

Please find attached template , Is there any need to change this template.
# Copyright 2022 Dynatrace LLC.txt (3.19 KB)

6

Hi @Prithvi_Mandal , the CloudFormation template you attached is tailored to use only one `DynatraceMonitoringRole`.  It’s defined in line :49.
`- !Sub ‘arn:aws:iam::${MonitoredAccountID}:role/${MonitoringRoleName}’
I’ve attached an example template for two accounts. If you want to monitor more accounts, you can configure it in the same manner. 
# Copyright 2022 Dynatrace LLC.txt (3.8 KB)