ARCHIVED - How do I instrument Windows AWS instances using SSM?

For the first instance

For subsequent instances

These instructions apply to instrumenting Windows Guests on AWS in bulk, using SSM. This uses the recommended AWS CloudWatch agent.

For the first instance:

1. You will need two IAM roles - one for monitoring (pushing results to CloudWatch) and one for configuring (pushing config to the Parameter Store). Unless you already have two appropriate IAM roles and servers, create them as follows:
   
   
   • Create the server configuration role:
     1. From the AWS IAM Console, go to Roles > Create Role > select EC2 Allows EC2 instances to call AWS services on your behalf > Next: Permissions
     2. Tick the check boxes for "CloudWatchAgentAdminPolicy", "AmazonEC2RoleforSSM" and "AmazonSSMFullAccess".
     3. Click Next: Review
     4. Provide a name for the role, e.g. "CloudWatchServerAgentConfigRole".
     5. Click Create Role.
        
        
   • Create the server agent monitoring role:
     1. From the AWS IAM Console, go to Roles > Create Role > select EC2 Allows EC2 instances to call AWS services on your behalf > Next: Permissions.
     2. Tick the check boxes for "CloudWatchAgentServerPolicy", "AmazonEC2RoleforSSM" and "AmazonSSMFullAcccess".
     3. Click Next: Review.
     4. Provide a name for the role, e.g. "CloudWatchServerAgentMonitoringRole".
     5. Click Create Role.
        
        
   • Create the server agent configuration user (needed to push config into Parameter Store):
     1. From the AWS IAM Console, go to Users > Add User > provide name, e.g. "CloudWatchConfigUser".
     2. Click Programmatic access > Permissions > Attach existing policies directly.
     3. In the list of policies, select "CloudWatchAgentAdminPolicy", "AmazonEC2RoleforSSM" and "AmazonSSMFullAccess".
     4. Click Review > Create User.
     5. Next to the name of the new user, choose Show and make a note of the new access key and secret key.
     6. Click Close.
        
        
   • Create the server agent monitoring user:
     1. From the AWS IAM Console, go to Users > Add User > provide name, e.g. "CloudWatchMonitoringUser".
     2. Click Programmatic access > Permissions > Attach existing policies directly.
     3. In the list of policies, select "CloudWatchAgentServerPolicy", "AmazonEC2RoleforSSM" and "AmazonSSMFullAccess".
     4. Click Review > Create User.
     5. Next to the name of the new user, choose Show and make a note of the new access key and secret key.
     6. Click Close.
        
        
2. Install CloudWatch Agent on the first instance:
   1. Attach SSM capable IAM role to the instance, e.g. CloudWatchServerAgentConfigRole (from above).
   2. Go to AWS > EC2 > Systems Manager Services > Run Command > Run a command.
   3. Select "AWS-ConfigureAWSPackage".
   4. Select the instance (Note, if the IAM role has only just been assigned to the instance, it might take several minutes before it appears in the "select instances" list).
   5. Set Action to Install.
   6. In Name, type "AmazonCloudWatchAgent".
   7. Check Version is "latest".
   8. Click Run.
   9. Click View Result.
   10. Wait until status changed from "In Progress" to "Success" or "Failed". If failed, check the output of the job to see what went wrong.
       
       
3. Configure the first instance:
   1. Connect to the instance (RDP)
   2. Create C:\ProgramData\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.json and change contents to: 

      {
            "agent": {
              "metrics_collection_interval": 60,
              "logfile": "c:\\ProgramData\\Amazon\\AmazonCloudWatchAgent\\Logs\\amazon-cloudwatch-agent.log",
              "debug": true
            },
            "metrics": {
              "metrics_collected": {
                "LogicalDisk": {
                 "measurement": [
                    {"name": "% Free Space",   "rename": "Instance Logical Disk % Free Space", "unit": "Percent"},
                    {"name": "Free Megabytes", "rename": "Instance Logical Disk Free Megabytes"}
                  ],
                  "resources": [
                    "*"
                  ]
                },
                "Memory": {
                  "measurement": [
                    {"name": "Available MBytes", "rename": "Instance Memory Available MBytes"}
                  ]
                }
              },
              "append_dimensions": {
                "InstanceId": "${aws:InstanceId}"         }
            }     
          }

4. On the instance, Enable CloudWatch Monitoring > Enable Detailed Monitoring (right click action from instances list).
   
   
5. Install AWS CLI in the instance from:
   • https://s3.amazonaws.com/aws-cli/AWSCLI64.msi; or
   • https://s3.amazonaws.com/aws-cli/AWSCLI32.msi, depending on the architecture.
     
     
6. Run aws configure, e.g. (using CloudWatchConfigUser from above): 

   C:\ProgramData\Amazon\AmazonCloudWatchAgent>"C:\Program Files (x86)\Amazon\AWSCLI\aws.exe" configure       <-  if 64 bit

   C:\ProgramData\Amazon\AmazonCloudWatchAgent>"C:\Program Files\Amazon\AWSCLI\aws.exe" configure             <-  if 32 bit

   AWS Access Key ID [None]: <INSERT KEY HERE>

   AWS Secret Access Key [None]: <INSERT KEY HERE>

   Default region name [None]: eu-central-1

   Default output format [None]:

    

   C:\ProgramData\Amazon\AmazonCloudWatchAgent>

7. Then upload config from the instance to SSM Parameter Store: 

   (32bit):

   C:\ProgramData\Amazon\AmazonCloudWatchAgent>"C:\Program Files (x86)\Amazon\AWSCLI\aws.exe" ssm put-parameter --name "CloudWatchConfigWin" --type "String" --value file://c:\ProgramData\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.json  --overwrite
   {
       "Version": 1
   }

    

   (64 bit):

   C:\ProgramData\Amazon\AmazonCloudWatchAgent>"C:\Program Files\Amazon\AWSCLI\aws.exe" ssm put-parameter --name "CloudWatchConfigWin" --type "String" --value file://c:\ProgramData\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.json  --overwrite
   {
      "Version": 1
   }

8. Then in SSM, configure the agent (to check that config pull works):
   1. Run command: "AmazonCloudWatch-ManageAgent"
   2. Select instance.
   3. Action: configure
   4. Mode: ec2
   5. Optional Configuration Source: ssm
   6. Optional Configuration Location: CloudWatchConfigWin
   7. Optional Restart: yes
   8. Click Run.
      
      
9. Check CloudWatch metrics. Browse Metrics and CW Agent:
   • InstanceId, Instance, ObjectName for disks.
   • InstanceId, ObjectName for memory.
     
     
10. Check that the full set of metrics appear in Entuity - CPU, guest memory, disks' names and utilization %, network traffic in and out, bytes and packet.

For subsequent instances:

1. For the instance, assign an IAM role with SSM and CloudWatch rights - e.g. "CloudWatchServerAgentMonitoringRole" above.
   
   
2. On the instance - enable CloudWatch Monitoring > Enable Detailed Monitoring (right click action from instances list).
   
   
3. Go to AWS > EC2 > Systems Manager Services > Run Command > Run a command:
   1. Choose AWS-ConfigureAWSPackage
   2. Select the instance(s) (Note, if the IAM role has only just been assigned to the instance, it might take several minutes before it appears in the "select instances" list).
   3. Set Action to "Install".
   4. In Name, type "AmazonCloudWatchAgent".
   5. Check Version is "Latest".
   6. Click Run.
   7. Click View Result.
   8. Wait until status changes from "In Progress" to "Success" or "Failed". If failed, check output of the job to see what went wrong.
      
      
4. Then in SSM configure the agent (to check the config pull works):
   1. Run command: "AmazonCloudWatch-ManageAgent".
   2. Select instance(s).
   3. Action: configure.
   4. Mode: ec2.
   5. Optional Configuration Source: ssm.
   6. Optional Configuration Location: CloudWatchConfigWin.
   7. Optional Restart: yes
   8. Click Run.
      
      
5. Check CloudWatch metrics. Browse Metrics and CW Agent:
• InstanceId, Instance, ObjectName for disks.
• InstanceId, ObjectName for memory.
  
  
6. Check that the full set of metrics appear in Entuity - CPU, guest memory, disks' names and utilization %, network traffic in and out, bytes and packet.