1. Docs
  2. Reference
  3. API
  4. SignalFx
  5. aws
  6. ExternalIntegration

ExternalIntegration

SignalFx AWS CloudWatch integrations using Role ARNs. For help with this integration see Connect to AWS CloudWatch.

NOTE When managing integrations you’ll need to use an admin token to authenticate the SignalFx provider.

WARNING This resource implements a part of a workflow. You must use it with signalfx.aws.Integration. Check with SignalFx support for your realm’s AWS account id.

Example Usage

using Pulumi;
using Aws = Pulumi.Aws;
using SignalFx = Pulumi.SignalFx;

class MyStack : Stack
{
    public MyStack()
    {
        var awsMyteamExtern = new SignalFx.Aws.ExternalIntegration("awsMyteamExtern", new SignalFx.Aws.ExternalIntegrationArgs
        {
        });
        var signalfxAssumePolicy = Aws.Iam.GetPolicyDocument.InvokeAsync(new Aws.Iam.GetPolicyDocumentArgs
        {
            Statement = 
            {
                
                {
                    { "actions", 
                    {
                        "sts:AssumeRole",
                    } },
                    { "principals", 
                    {
                        
                        {
                            { "type", "AWS" },
                            { "identifiers", 
                            {
                                awsMyteamExtern.SignalfxAwsAccount,
                            } },
                        },
                    } },
                    { "condition", 
                    {
                        
                        {
                            { "test", "StringEquals" },
                            { "variable", "sts:ExternalId" },
                            { "values", 
                            {
                                awsMyteamExtern.ExternalId,
                            } },
                        },
                    } },
                },
            },
        });
        var awsSfxRole = new Aws.Iam.Role("awsSfxRole", new Aws.Iam.RoleArgs
        {
            Description = "signalfx integration to read out data and send it to signalfxs aws account",
            AssumeRolePolicy = signalfxAssumePolicy.Apply(signalfxAssumePolicy => signalfxAssumePolicy.Json),
        });
        var awsReadPermissions = new Aws.Iam.Policy("awsReadPermissions", new Aws.Iam.PolicyArgs
        {
            Description = "farts",
            Policy = @"{
 ""Version"": ""2012-10-17"",
 ""Statement"": [
     {
         ""Action"": [
             ""dynamodb:ListTables"",
         ""dynamodb:DescribeTable"",
         ""dynamodb:ListTagsOfResource"",
         ""ec2:DescribeInstances"",
         ""ec2:DescribeInstanceStatus"",
         ""ec2:DescribeVolumes"",
         ""ec2:DescribeReservedInstances"",
         ""ec2:DescribeReservedInstancesModifications"",
         ""ec2:DescribeTags"",
         ""organizations:DescribeOrganization"",
         ""cloudwatch:ListMetrics"",
         ""cloudwatch:GetMetricData"",
         ""cloudwatch:GetMetricStatistics"",
         ""cloudwatch:DescribeAlarms"",
         ""sqs:ListQueues"",
         ""sqs:GetQueueAttributes"",
         ""sqs:ListQueueTags"",
         ""elasticmapreduce:ListClusters"",
         ""elasticmapreduce:DescribeCluster"",
         ""kinesis:ListShards"",
         ""kinesis:ListStreams"",
         ""kinesis:DescribeStream"",
         ""kinesis:ListTagsForStream"",
         ""rds:DescribeDBInstances"",
         ""rds:ListTagsForResource"",
         ""elasticloadbalancing:DescribeLoadBalancers"",
         ""elasticloadbalancing:DescribeTags"",
         ""elasticache:describeCacheClusters"",
         ""redshift:DescribeClusters"",
         ""lambda:GetAlias"",
         ""lambda:ListFunctions"",
         ""lambda:ListTags"",
         ""autoscaling:DescribeAutoScalingGroups"",
         ""s3:ListAllMyBuckets"",
         ""s3:ListBucket"",
         ""s3:GetBucketLocation"",
         ""s3:GetBucketTagging"",
         ""ecs:ListServices"",
         ""ecs:ListTasks"",
         ""ecs:DescribeTasks"",
         ""ecs:DescribeServices"",
         ""ecs:ListClusters"",
         ""ecs:DescribeClusters"",
         ""ecs:ListTaskDefinitions"",
         ""ecs:ListTagsForResource"",
         ""apigateway:GET"",
         ""cloudfront:ListDistributions"",
         ""cloudfront:ListTagsForResource"",
         ""tag:GetResources"",
         ""es:ListDomainNames"",
         ""es:DescribeElasticsearchDomain""
         ],
         ""Effect"": ""Allow"",
         ""Resource"": ""*""
     }
 ]
}
",
        });
        var sfx_read_attach = new Aws.Iam.RolePolicyAttachment("sfx-read-attach", new Aws.Iam.RolePolicyAttachmentArgs
        {
            Role = awsSfxRole.Name,
            PolicyArn = awsReadPermissions.Arn,
        });
        var awsMyteam = new SignalFx.Aws.Integration("awsMyteam", new SignalFx.Aws.IntegrationArgs
        {
            Enabled = true,
            IntegrationId = awsMyteamExtern.Id,
            ExternalId = awsMyteamExtern.ExternalId,
            RoleArn = awsSfxRole.Arn,
            Regions = 
            {
                "us-east-1",
            },
            PollRate = 300,
            ImportCloudWatch = true,
            EnableAwsUsage = true,
        });
    }

}

Coming soon!

import pulumi
import pulumi_aws as aws
import pulumi_signalfx as signalfx

aws_myteam_extern = signalfx.aws.ExternalIntegration("awsMyteamExtern")
signalfx_assume_policy = aws.iam.get_policy_document(statement=[{
    "actions": ["sts:AssumeRole"],
    "principals": [{
        "type": "AWS",
        "identifiers": [aws_myteam_extern.signalfx_aws_account],
    }],
    "condition": [{
        "test": "StringEquals",
        "variable": "sts:ExternalId",
        "values": [aws_myteam_extern.external_id],
    }],
}])
aws_sfx_role = aws.iam.Role("awsSfxRole",
    description="signalfx integration to read out data and send it to signalfxs aws account",
    assume_role_policy=signalfx_assume_policy.json)
aws_read_permissions = aws.iam.Policy("awsReadPermissions",
    description="farts",
    policy="""{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:ListTables",
            "dynamodb:DescribeTable",
            "dynamodb:ListTagsOfResource",
            "ec2:DescribeInstances",
            "ec2:DescribeInstanceStatus",
            "ec2:DescribeVolumes",
            "ec2:DescribeReservedInstances",
            "ec2:DescribeReservedInstancesModifications",
            "ec2:DescribeTags",
            "organizations:DescribeOrganization",
            "cloudwatch:ListMetrics",
            "cloudwatch:GetMetricData",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:DescribeAlarms",
            "sqs:ListQueues",
            "sqs:GetQueueAttributes",
            "sqs:ListQueueTags",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:DescribeCluster",
            "kinesis:ListShards",
            "kinesis:ListStreams",
            "kinesis:DescribeStream",
            "kinesis:ListTagsForStream",
            "rds:DescribeDBInstances",
            "rds:ListTagsForResource",
            "elasticloadbalancing:DescribeLoadBalancers",
            "elasticloadbalancing:DescribeTags",
            "elasticache:describeCacheClusters",
            "redshift:DescribeClusters",
            "lambda:GetAlias",
            "lambda:ListFunctions",
            "lambda:ListTags",
            "autoscaling:DescribeAutoScalingGroups",
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation",
            "s3:GetBucketTagging",
            "ecs:ListServices",
            "ecs:ListTasks",
            "ecs:DescribeTasks",
            "ecs:DescribeServices",
            "ecs:ListClusters",
            "ecs:DescribeClusters",
            "ecs:ListTaskDefinitions",
            "ecs:ListTagsForResource",
            "apigateway:GET",
            "cloudfront:ListDistributions",
            "cloudfront:ListTagsForResource",
            "tag:GetResources",
            "es:ListDomainNames",
            "es:DescribeElasticsearchDomain"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}
""")
sfx_read_attach = aws.iam.RolePolicyAttachment("sfx-read-attach",
    role=aws_sfx_role.name,
    policy_arn=aws_read_permissions.arn)
aws_myteam = signalfx.aws.Integration("awsMyteam",
    enabled=True,
    integration_id=aws_myteam_extern.id,
    external_id=aws_myteam_extern.external_id,
    role_arn=aws_sfx_role.arn,
    regions=["us-east-1"],
    poll_rate=300,
    import_cloud_watch=True,
    enable_aws_usage=True)
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as signalfx from "@pulumi/signalfx";

const awsMyteamExtern = new signalfx.aws.ExternalIntegration("awsMyteamExtern", {});
const signalfxAssumePolicy = aws.iam.getPolicyDocument({
    statement: [{
        actions: ["sts:AssumeRole"],
        principals: [{
            type: "AWS",
            identifiers: [awsMyteamExtern.signalfxAwsAccount],
        }],
        condition: [{
            test: "StringEquals",
            variable: "sts:ExternalId",
            values: [awsMyteamExtern.externalId],
        }],
    }],
});
const awsSfxRole = new aws.iam.Role("awsSfxRole", {
    description: "signalfx integration to read out data and send it to signalfxs aws account",
    assumeRolePolicy: signalfxAssumePolicy.json,
});
const awsReadPermissions = new aws.iam.Policy("awsReadPermissions", {
    description: "farts",
    policy: `{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:ListTables",
            "dynamodb:DescribeTable",
            "dynamodb:ListTagsOfResource",
            "ec2:DescribeInstances",
            "ec2:DescribeInstanceStatus",
            "ec2:DescribeVolumes",
            "ec2:DescribeReservedInstances",
            "ec2:DescribeReservedInstancesModifications",
            "ec2:DescribeTags",
            "organizations:DescribeOrganization",
            "cloudwatch:ListMetrics",
            "cloudwatch:GetMetricData",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:DescribeAlarms",
            "sqs:ListQueues",
            "sqs:GetQueueAttributes",
            "sqs:ListQueueTags",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:DescribeCluster",
            "kinesis:ListShards",
            "kinesis:ListStreams",
            "kinesis:DescribeStream",
            "kinesis:ListTagsForStream",
            "rds:DescribeDBInstances",
            "rds:ListTagsForResource",
            "elasticloadbalancing:DescribeLoadBalancers",
            "elasticloadbalancing:DescribeTags",
            "elasticache:describeCacheClusters",
            "redshift:DescribeClusters",
            "lambda:GetAlias",
            "lambda:ListFunctions",
            "lambda:ListTags",
            "autoscaling:DescribeAutoScalingGroups",
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation",
            "s3:GetBucketTagging",
            "ecs:ListServices",
            "ecs:ListTasks",
            "ecs:DescribeTasks",
            "ecs:DescribeServices",
            "ecs:ListClusters",
            "ecs:DescribeClusters",
            "ecs:ListTaskDefinitions",
            "ecs:ListTagsForResource",
            "apigateway:GET",
            "cloudfront:ListDistributions",
            "cloudfront:ListTagsForResource",
            "tag:GetResources",
            "es:ListDomainNames",
            "es:DescribeElasticsearchDomain"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}
`,
});
const sfx_read_attach = new aws.iam.RolePolicyAttachment("sfx-read-attach", {
    role: awsSfxRole.name,
    policyArn: awsReadPermissions.arn,
});
const awsMyteam = new signalfx.aws.Integration("awsMyteam", {
    enabled: true,
    integrationId: awsMyteamExtern.id,
    externalId: awsMyteamExtern.externalId,
    roleArn: awsSfxRole.arn,
    regions: ["us-east-1"],
    pollRate: 300,
    importCloudWatch: true,
    enableAwsUsage: true,
});

Create a ExternalIntegration Resource

new ExternalIntegration(name: string, args?: ExternalIntegrationArgs, opts?: CustomResourceOptions);
def ExternalIntegration(resource_name, opts=None, name=None, named_token=None, __props__=None);
func NewExternalIntegration(ctx *Context, name string, args *ExternalIntegrationArgs, opts ...ResourceOption) (*ExternalIntegration, error)
public ExternalIntegration(string name, ExternalIntegrationArgs? args = null, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args ExternalIntegrationArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
opts ResourceOptions
A bag of options that control this resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args ExternalIntegrationArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args ExternalIntegrationArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

ExternalIntegration Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The ExternalIntegration resource accepts the following input properties:

Name string

The name of this integration

NamedToken string

A named token to use for ingest

Name string

The name of this integration

NamedToken string

A named token to use for ingest

name string

The name of this integration

namedToken string

A named token to use for ingest

name str

The name of this integration

named_token str

A named token to use for ingest

Outputs

All input properties are implicitly available as output properties. Additionally, the ExternalIntegration resource produces the following output properties:

ExternalId string

The external ID to use with your IAM role and with signalfx.aws.Integration.

Id string
The provider-assigned unique ID for this managed resource.
SignalfxAwsAccount string

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

ExternalId string

The external ID to use with your IAM role and with signalfx.aws.Integration.

Id string
The provider-assigned unique ID for this managed resource.
SignalfxAwsAccount string

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

externalId string

The external ID to use with your IAM role and with signalfx.aws.Integration.

id string
The provider-assigned unique ID for this managed resource.
signalfxAwsAccount string

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

external_id str

The external ID to use with your IAM role and with signalfx.aws.Integration.

id str
The provider-assigned unique ID for this managed resource.
signalfx_aws_account str

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

Look up an Existing ExternalIntegration Resource

Get an existing ExternalIntegration resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ExternalIntegrationState, opts?: CustomResourceOptions): ExternalIntegration
static get(resource_name, id, opts=None, external_id=None, name=None, named_token=None, signalfx_aws_account=None, __props__=None);
func GetExternalIntegration(ctx *Context, name string, id IDInput, state *ExternalIntegrationState, opts ...ResourceOption) (*ExternalIntegration, error)
public static ExternalIntegration Get(string name, Input<string> id, ExternalIntegrationState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

ExternalId string

The external ID to use with your IAM role and with signalfx.aws.Integration.

Name string

The name of this integration

NamedToken string

A named token to use for ingest

SignalfxAwsAccount string

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

ExternalId string

The external ID to use with your IAM role and with signalfx.aws.Integration.

Name string

The name of this integration

NamedToken string

A named token to use for ingest

SignalfxAwsAccount string

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

externalId string

The external ID to use with your IAM role and with signalfx.aws.Integration.

name string

The name of this integration

namedToken string

A named token to use for ingest

signalfxAwsAccount string

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

external_id str

The external ID to use with your IAM role and with signalfx.aws.Integration.

name str

The name of this integration

named_token str

A named token to use for ingest

signalfx_aws_account str

The AWS Account ARN to use with your policies/roles, provided by SignalFx.

Package Details

Repository
https://github.com/pulumi/pulumi-signalfx
License
Apache-2.0
Notes
This Pulumi package is based on the signalfx Terraform Provider.