Summary
With Classic AWS monitoring, an AWS connection can be handled by any ActiveGate that is eligible to run it. Filtering the AWS regions (via custom.properties) ann/or using Network Zones/ActiveGate groups do not control which ActiveGate performs the monitoring.
Problem
A particular AWS account must be monitored only through a subset of AWS-enabled ActiveGates (for example, only in Europe), so there's a need to control which ActiveGates will be monitoring these AWS account/credentials.
Troubleshooting steps
As mentioned, any AWS-enabled ActiveGate can be a target for assignment of any AWS account monitoring,
the quickest way to locate which account being monitored by which ActiveGate using Data Explorer is to run queries similar to below
- either by the hostname -
dsfm:active_gate.aws.elements.total:splitBy("aws.account_id","host.name"):sort(value(auto,descending)):limit(20)
- or by the ActiveGate ID
dsfm:active_gate.aws.elements.total:splitBy("aws.account_id","dt.active_gate.id"):sort(value(auto,descending)):limit(20)
Resolution/configuration steps
1. Give the required ActiveGates their own AWS IAM role.
The role must be used only by the ActiveGates that are allowed to monitor the account. If European and non-European ActiveGates share the same role, AWS sees them as the same identity and cannot tell them apart.
2. Update the monitoring role in the target AWS account.
In its trust policy, allow `sts:AssumeRole` only from the IAM role used by the selected ActiveGates. Keep the Dynatrace external ID condition when one is configured, so the target account should trust:
```
ActiveGate (from EU, for example) role -> allowed
Other ActiveGate roles -> not allowed
```
3. Remove access from the other ActiveGate roles.
Check both sides of the role setup:
- The target ActiveGate role is allowed to assume the target monitoring role.
- The target monitoring role trusts this subset's ActiveGate role.
- Roles used by ActiveGates in other locations are not included.
4. Test and verify.
After changing the policies, allow some time for existing AWS STS sessions to expire.
- The AWS connection validates in Dynatrace.
- Data starts or continues to arrive in Data Explorer.
- ActiveGate logs show successful polling on an allowed European ActiveGate.
- AWS CloudTrail shows `AssumeRole` requests from the expected European ActiveGate role.
Important to know
- ActiveGate groups and network zones do not provide a per-AWS-connection pinning option for Classic AWS monitoring.
- The setup above limits which ActiveGates have permission to monitor the account. It does not create scheduler affinity inside Dynatrace.
- To ensure availability - use at least two ActiveGates if monitoring must continue when one ActiveGate is unavailable.
- Again, if all allowed target ActiveGates are unavailable, AWS monitoring will stop instead of moving to an ActiveGate that does not have permission.
References
- [Dynatrace Classic AWS credentials API](https://docs.dynatrace.com/docs/dynatrace-api/configuration-api/aws-credentials-api/get-credentials)
- [Dynatrace ActiveGate groups](https://docs.dynatrace.com/docs/ingest-from/dynatrace-activegate/activegate-group)
- [Dynatrace ActiveGate network-zone connectivity](https://docs.dynatrace.com/docs/manage/network-zones/activegate-connectivity)
- [AWS cross-account role access](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html)
