Improve operational performance by enabling Amazon DevOps Guru across multiple AWS Regions, accounts, and OUs with the AWS CDK

Configure AWS named profiles.

Set up your AWS named profiles as follows to deploy stacks in a multi-account environment.

For the administrator account:

$aws configure --profile administrator
AWS Access Key ID [****]: <your-administrator-access-key-ID>
AWS Secret Access Key [****]: <your-administrator-secret-access-key>
Default region name [None]: <your-administrator-region>
Default output format [None]: json

For the target account:

$aws configure --profile target
AWS Access Key ID [****: <your-target-access-key-ID>
AWS Secret Access Key [****]: <your-target-secret-access-key>
Default region name [None]: <your-target-region>
Default output format [None]: json

For more information, see Using named profiles in the AWS CLI documentation.

Verify AWS profile configurations.

(Optional) You can verify your AWS profile configurations in the credentials and config files by following the instructions in Set and view configuration settings in the AWS CLI documentation.

Verify the AWS CDK version.

Verify the version of the AWS CDK Toolkit by running the following command:

$cdk --version

This pattern requires version 1.107.0 or later. If you have an earlier version of the AWS CDK, follow the instructions in the AWS CDK documentation to update it.

Clone the project code.

Clone the GitHub repository for this pattern by using the command:

$git clone https://github.com/aws-samples/amazon-devopsguru-cdk-samples.git

Install package dependencies and compile the TypeScript files.

Install the package dependencies and compile the TypeScript files by running the following commands:

$cd amazon-devopsguru-cdk-samples
$npm install
$npm fund

These commands install all the packages from the sample repository.

$npm ci

—or—

$npm install -g @aws-cdk/<package-name>

You can find the list of package names and versions in the Dependencies section of the /amazon-devopsguru-cdk-samples/package.json file. For more information, see npm ci and npm install in the npm documentation.

Configure an email address for Amazon SNS notifications.

Follow these steps to provide an email address for Amazon SNS notifications:

Build the project code.

Build the project code and synthesize the stacks by running the command:

npm run build && cdk synth 

You should see output similar to the following: 

$npm run build && cdk synth
> cdk-devopsguru@0.1.0 build
> tsc
Successfully synthesized to ~/amazon-devopsguru-cdk-samples/cdk.out
Supply a stack id (CdkDevopsGuruStackMultiAccReg,CdkDevopsGuruStackMultiAccRegSpecStacks, CdkDevopsguruStackOrgUnit, CdkInfrastructureStack, CdkStackSetAdminRole, CdkStackSetExecRole) to display its template.

For more information and steps, see Your first AWS CDK app in the AWS CDK documentation.

List the AWS CDK stacks.

Run the following command to list all AWS CDK stacks:

$cdk list

The command displays the following list:

CdkDevopsGuruStackMultiAccReg
CdkDevopsGuruStackMultiAccRegSpecStacks
CdkDevopsguruStackOrgUnit
CdkInfrastructureStack
CdkStackSetAdminRole
CdkStackSetExecRole

Deploy the AWS CDK stacks for creating IAM roles.

This pattern uses AWS CloudFormation StackSets to perform stack operations across multiple accounts. If you are creating your first stack set, you must create the following IAM roles to get the required permissions set up in your AWS accounts:

For more information, see Grant self-managed permissions in the AWS CloudFormation documentation.

Deploy the AWS CDK stack for enabling DevOps Guru across multiple accounts.

The AWS CDK CdkDevopsGuruStackMultiAccReg stack creates stack sets to deploy stack instances across multiple accounts and Regions. To deploy the stack, run the following CLI command with the specified parameters:

$cdk deploy CdkDevopsGuruStackMultiAccReg \
  --profile administrator \
  --parameters AdministratorAccountId=<administrator-account-ID> \
  --parameters TargetAccountId=<target-account-ID> \
  --parameters RegionIds="<region-1>,<region-2>"

Currently Amazon DevOps Guru is available in the AWS Regions listed in the DevOps Guru FAQ.

Extract OU IDs.

On the AWS Organizations console, identify the IDs of the organizational units where you want to enable DevOps Guru.

Enable service-managed permissions for OUs.

If you're using AWS Organizations for account management, you must grant service-managed permissions to enable DevOps Guru. Instead of creating the IAM roles manually, use organization-based trusted access and service-linked roles (SLRs).

Deploy the AWS CDK stack for enabling DevOps Guru across OUs.

The AWS CDK CdkDevopsguruStackOrgUnit stack enables DevOps Guru service across OUs. To deploy the stack, run the following command with the specified parameters:

$cdk deploy CdkDevopsguruStackOrgUnit \
  --profile administrator \ 
  --parameters RegionIds="<region-1>,<region-2>" \
  --parameters OrganizationalUnitIds="<OU-1>,<OU-2>"

Deploy the AWS CDK stacks for creating IAM roles.

If you haven't already created the required IAM roles shown in the first option, do that first:

For more information, see Grant self-managed permissions in the AWS CloudFormation documentation.

Delete existing stacks.

If you already used the first option to enable DevOps Guru for all stack resources, you can delete the old stack by using the following command:

$cdk destroy CdkDevopsGuruStackMultiAccReg --profile administrator 

Or, you can change the RegionIds parameter when you redeploy the stack to avoid a Stacks already exist error.

Update the AWS CDK stack with a stack list.

Deploy the AWS CDK stack for enabling DevOps Guru for specific stack resources across multiple accounts.

The AWS CDK CdkDevopsGuruStackMultiAccRegSpecStacks stack enables DevOps Guru for specific stack resources across multiple accounts. To deploy the stack, run the following command:

$cdk deploy CdkDevopsGuruStackMultiAccRegSpecStacks \
  --profile administrator  \
  --parameters AdministratorAccountId=<administrator-account-ID> \
  --parameters TargetAccountId=<target-account-ID> \
  --parameters RegionIds="<region-1>,<region-2>"

Deploy the sample serverless infrastructure stack.

The AWS CDK CdkInfrastructureStack stack deploys serverless components such as API Gateway, Lambda, and a DynamoDB table to demonstrate DevOps Guru insights. To deploy the stack, run the following command: 

$cdk deploy CdkInfrastructureStack --profile administrator

Insert sample records in DynamoDB.

Run the following command to populate the DynamoDB table with sample records. Provide the correct path for the populate-shops-dynamodb-table.json script.

$aws dynamodb batch-write-item \
  --request-items file://scripts/populate-shops-dynamodb-table.json \
  --profile administrator

The command displays the following output:

{
    "UnprocessedItems": {}
}

Verify inserted records in DynamoDB.

To verify that the DynamoDB table includes the sample records from the populate-shops-dynamodb-table.json file, access the URL for the ListRestApiEndpointMonitorOperator API, which is published as an output of the AWS CDK stack. You can also find this URL in the Outputs tab of the AWS CloudFormation console for the CdkInfrastructureStack stack. The AWS CDK output would look similar to the following:

CdkInfrastructureStack.CreateRestApiMonitorOperatorEndpointD1D00045 = https://oure17c5vob.execute-api.<your-region>.amazonaws.com/prod/

CdkInfrastructureStack.ListRestApiMonitorOperatorEndpointABBDB8D8 = https://cdff8icfrn4.execute-api.<your-region>.amazonaws.com/prod/

Wait for resources to complete baselining.

This serverless stack has a few resources. We recommend that you wait for 2 hours before you carry out the next steps. If you deployed this stack in a production environment, it might take up to 24 hours to complete baselining, depending on the number of resources you selected to monitor in DevOps Guru.

Update the AWS CDK infrastructure stack.

To try out DevOps Guru insights, you can make some configuration changes to reproduce a typical operational issue.

Inject HTTP requests on the API.

Inject ingress traffic in the form of HTTP requests on the ListRestApiMonitorOperatorEndpointxxxx API:

Review DevOps Guru insights.

Under standard conditions, the DevOps Guru dashboard displays zero in the ongoing insights counter. If it detects an anomaly, it raises an alert in the form of an insight. In the navigation pane, choose Insights to see the details of the anomaly, including an overview, aggregated metrics, relevant events, and recommendations. For more information about reviewing insights, see the Gaining operational insights with AIOps using Amazon DevOps Guru blog post.

Clean up and delete resources.

After you walk through this pattern, you should remove the resources you created to avoid incurring any further charges. Run these commands:

$cdk destroy CdkDevopsGuruStackMultiAccReg --profile administrator
$cdk destroy CdkDevopsguruStackOrgUnit --profile administrator
$cdk destroy CdkDevopsGuruStackMultiAccRegSpecStacks --profile administrator
$cdk destroy CdkInfrastructureStack --profile administrator
$cdk destroy CdkStackSetAdminRole --profile administrator
$cdk destroy CdkStackSetExecRole --profile administrator
$cdk destroy CdkStackSetExecRole --profile target