AWS Integration requiring alot of access rights

Troubleshooting
1

CMK version:CEE2.3.0p30
OS version:Ubuntu 22.04

I’m trying to figure out what access rights checkmk actually needs to communicate with AWS.
The plugin works fine with the ReadOnlyAccess policy, but that policy feels a bit like a nuclear option.
I tried with these:

                "ec2:Get*",
                "ec2:Describe*",
                "s3:DescribeJob",
                "s3:Get*",
                "s3:List*",
                "cloudwatch:Describe*",
                "cloudwatch:GenerateQuery",
                "cloudwatch:Get*",
                "cloudwatch:List*"

but I guess something is still missing ass the agent just gives error code 1
([special_aws] Agent exited with code 1: (!!))

2

Without having looked into the matter i think the following is the case:

  • Get all information granted to obtain with the ReadOnlyAccess policy.
  • filter out in the agent what is needed/required to be monitored, drop the rest.

In my mind this is done just to the fact that gathering/grab all can be done with a single call.

If one (as a plugin-developer) were to have to query each section separately it will produce more (individual) calls per subsection, making an agent more complicated.

This approach makes sense in having all data obtainable available for possible future extension of a/the agent. (tbh, i also do this in a plugin/special agent i have written)

I do understand your concerns as to the amount of information obtained by the agent, however it is still under the ReadOnlyAccess policy, so from the monitoring side no alterations can be done.

  • Glowsome
3

Thanks for the insights, and yeah, main worry is if monitoring tools really need access to read customer data, or if it can be restricted from them somehow

4

As the plugin itself is supplied by CMK, besides my ‘interpretation/assumption’ as to the why i’m just gonna ping @Sara who could explain (or let it be explained by colleagues) this from the CMK-side.

  • Glowsome
5

Unfortunately, I would not be able to help here at the moment.

On the other hand, the error message could be investigated following some tips from this article to provide more useful information.