AWS Integration

[Prithvi_Mandal]

Dear Team,

We have two different AWS account one is 'A' and another one is 'B' , As we know for AWS integration with Dynatrace

we have to deploy ActiveGate on same  AWS account, Now my question is if I deploy ActiveGate on A ( AWS Account) then can I use same ActiveGate to integrate with B (AWS account).

Kindly let me know this approach is feasible  or not. 

Thanks & Regard

Prithvi

[dawid_kaszubski · Accepted solution]

Hi @Prithvi_Mandal ,
Yes, you can definitely use an ActiveGate deployed on the A account to monitor the B account. 
Please remember that you need a DynatraceMonitoringRole in the B account with the A account in the Trust Relationships. 
So, in the A account Dynatrace_ActiveGate_role's permissions should look like that:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Action": [
            "sts:AssumeRole"
         ],
         "Resource": [
            "arniam::<accountA>:role/Dynatrace_monitoring_role",
            "arniam::<accountB>:role/Dynatrace_monitoring_role"
         ],
         "Effect": "Allow"
      }
   ]
}

 And in the B account DynatraceMonitoringRole's Trust Relationships should look like:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": {
            "AWS": [
               "arniam::<accountA>:role/Dynatrace_ActiveGate"
            ]
         },
         "Action": "sts:AssumeRole",
         "Condition": {
            "StringEquals": {
               "sts:ExternalId": "<ExternalId>"
            }
         }
      }
   ]
}

[Prithvi_Mandal · Accepted solution]

thanks you @dawid_kaszubski  for your suggestion.

[Prithvi_Mandal]

Hii @dawid_kaszubski ,

Some confusion that , activegate deployed on A account already in use to monitored other AWS account (ie C account. but I want to use same activegate to monitored B account.

Please find attached template , Is there any need to change this template.

[dawid_kaszubski]

Hi @Prithvi_Mandal , the CloudFormation template you attached is tailored to use only one `DynatraceMonitoringRole`.  It's defined in line :49.
`- !Sub 'arniam::${MonitoredAccountID}:role/${MonitoringRoleName}'
I've attached an example template for two accounts. If you want to monitor more accounts, you can configure it in the same manner. 

[p_devulapalli · Accepted solution]

@Prithvi_Mandal Here is some documentation you can refer to , look under "Deployment with existing ActiveGate"

https://docs.dynatrace.com/docs/shortlink/aws-monitoring-guide#aws-policy-and-authentication