AWS Trusted Advisor 지표를 모니터링하여 Amazon CloudWatch 경보 생성

다음 이메일 메시지는 경보가 IAM 액세스 키 교체 검사에 대한 변경 사항을 감지했음을 보여 줍니다.

You are receiving this email because your Amazon CloudWatch Alarm "IAMAcessKeyRotationCheckAlarm" in the US East (N. Virginia) region has entered the ALARM state, 
because "Threshold Crossed: 1 out of the last 1 datapoints [9.0 (26/03/21 22:44:00)] was greater than or equal to the threshold (1.0) (minimum 1 datapoint for OK -> ALARM transition)." at "Friday 26 March, 2021 22:49:42 UTC".

View this alarm in the AWS Management Console:
https://us-east-1.console.aws.amazon.com/cloudwatch/home?region=us-east-1#s=Alarms&alarm=IAMAcessKeyRotationCheckAlarm

Alarm Details:
- Name:                       IAMAcessKeyRotationCheckAlarm
- Description:                This alarm starts when one or more AWS access keys in my AWS account have not been rotated in the last 90 days.
- State Change:               INSUFFICIENT_DATA -> ALARM
- Reason for State Change:    Threshold Crossed: 1 out of the last 1 datapoints [9.0 (26/03/21 22:44:00)] was greater than or equal to the threshold (1.0) (minimum 1 datapoint for OK -> ALARM transition).
- Timestamp:                  Friday 26 March, 2021 22:49:42 UTC
- AWS Account:                123456789012
- Alarm Arn:                  arn:aws:cloudwatch:us-east-1:123456789012:alarm:IAMAcessKeyRotationCheckAlarm

Threshold:
- The alarm is in the ALARM state when the metric is GreaterThanOrEqualToThreshold 1.0 for 300 seconds. 

Monitored Metric:
- MetricNamespace:                     AWS/TrustedAdvisor
- MetricName:                          RedResources
- Dimensions:                          [CheckName = IAM Access Key Rotation]
- Period:                              300 seconds
- Statistic:                           Average
- Unit:                                not specified
- TreatMissingData:                    missing


State Change Actions:
- OK: 
- ALARM: [arn:aws:sns:us-east-1:123456789012:Default_CloudWatch_Alarms_Topic]
- INSUFFICIENT_DATA: 

다음 예제는 Trusted Advisor에 대한 모든 지표를 볼 수 있도록 AWS/TrustedAdvisor 네임스페이스를 지정합니다.

aws cloudwatch list-metrics --namespace AWS/TrustedAdvisor

출력은 다음과 같을 수 있습니다.

{
    "Metrics": [
        {
            "Namespace": "AWS/TrustedAdvisor", 
            "Dimensions": [
                {
                    "Name": "ServiceName", 
                    "Value": "EBS"
                }, 
                {
                    "Name": "ServiceLimit", 
                    "Value": "Magnetic (standard) volume storage (TiB)"
                }, 
                {
                    "Name": "Region", 
                    "Value": "ap-northeast-2"
                }
            ], 
            "MetricName": "ServiceLimitUsage"
        }, 
        {
            "Namespace": "AWS/TrustedAdvisor", 
            "Dimensions": [
                {
                    "Name": "CheckName", 
                    "Value": "Overutilized Amazon EBS Magnetic Volumes"
                }
            ], 
            "MetricName": "YellowResources"
        }, 
        {
            "Namespace": "AWS/TrustedAdvisor", 
            "Dimensions": [
                {
                    "Name": "ServiceName", 
                    "Value": "EBS"
                }, 
                {
                    "Name": "ServiceLimit", 
                    "Value": "Provisioned IOPS"
                }, 
                {
                    "Name": "Region", 
                    "Value": "eu-west-1"
                }
            ], 
            "MetricName": "ServiceLimitUsage"
        }, 
        {
            "Namespace": "AWS/TrustedAdvisor", 
            "Dimensions": [
                {
                    "Name": "ServiceName", 
                    "Value": "EBS"
                }, 
                {
                    "Name": "ServiceLimit", 
                    "Value": "Provisioned IOPS"
                }, 
                {
                    "Name": "Region", 
                    "Value": "ap-south-1"
                }
            ], 
            "MetricName": "ServiceLimitUsage"
        },
    ...
  ]
}

다음 예제에서는 지정된 AWS 리전에 사용 가능한 지표만 보도록 AWS/TrustedAdvisor 네임스페이스와 Region 차원을 지정합니다.

aws cloudwatch list-metrics --namespace AWS/TrustedAdvisor --dimensions Name=Region,Value=us-east-1

출력은 다음과 같을 수 있습니다.

{
    "Metrics": [
        {
            "Namespace": "AWS/TrustedAdvisor",
            "Dimensions": [
                {
                    "Name": "ServiceName",
                    "Value": "SES"
                },
                {
                    "Name": "ServiceLimit",
                    "Value": "Daily sending quota"
                },
                {
                    "Name": "Region",
                    "Value": "us-east-1"
                }
            ],
            "MetricName": "ServiceLimitUsage"
        },
        {
            "Namespace": "AWS/TrustedAdvisor",
            "Dimensions": [
                {
                    "Name": "ServiceName",
                    "Value": "AutoScaling"
                },
                {
                    "Name": "ServiceLimit",
                    "Value": "Launch configurations"
                },
                {
                    "Name": "Region",
                    "Value": "us-east-1"
                }
            ],
            "MetricName": "ServiceLimitUsage"
        },
        {
            "Namespace": "AWS/TrustedAdvisor",
            "Dimensions": [
                {
                    "Name": "ServiceName",
                    "Value": "CloudFormation"
                },
                {
                    "Name": "ServiceLimit",
                    "Value": "Stacks"
                },
                {
                    "Name": "Region",
                    "Value": "us-east-1"
                }
            ],
            "MetricName": "ServiceLimitUsage"
        },
    ...
  ]
}

다음 예제는 이 특정 지표의 결과만 보도록 AWS/TrustedAdvisor 네임스페이스와 RedResources 지표 이름을 지정합니다.

aws cloudwatch list-metrics --namespace AWS/TrustedAdvisor --metric-name RedResources

출력은 다음과 같을 수 있습니다.

{
    "Metrics": [
        {
            "Namespace": "AWS/TrustedAdvisor",
            "Dimensions": [
                {
                    "Name": "CheckName",
                    "Value": "Amazon RDS Security Group Access Risk"
                }
            ],
            "MetricName": "RedResources"
        },
        {
            "Namespace": "AWS/TrustedAdvisor",
            "Dimensions": [
                {
                    "Name": "CheckName",
                    "Value": "Exposed Access Keys"
                }
            ],
            "MetricName": "RedResources"
        },
        {
            "Namespace": "AWS/TrustedAdvisor",
            "Dimensions": [
                {
                    "Name": "CheckName",
                    "Value": "Large Number of Rules in an EC2 Security Group"
                }
            ],
            "MetricName": "RedResources"
        },
        {
            "Namespace": "AWS/TrustedAdvisor",
            "Dimensions": [
                {
                    "Name": "CheckName",
                    "Value": "Auto Scaling Group Health Check"
                }
            ],
            "MetricName": "RedResources"
        },
    ...
  ]
}