AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
A custom connector to CloudWatch data source does not return data when is attached to VPC
I am configuring a custom connector to a CloudWatch data source but, per customer requirements, this connector needs to be attached to a VPC. That said, I attached that to VPC but I am unable to query metrics (if I detach from VPC, I can quickly pull metrics).
Aspects validated:
- The security groups associated to that AWS Lambda function has the inbound and outbound rules validated.
- There are one VPC endpoint configured so I can query metrics from CloudWatch.
- The IAM permission set for that Lambda function is ok
- Timeout, memory and other settings have been validated.
Logs are clean and there aren't much info to help troubleshooting. Any ideas ?
- Language
- English
asked 2 years ago278 views
- Newest
- Most votes
- Most comments
Hello.
Is the data source RDS?
Is it possible for you to share the code used in Lambda?
I'll have to look at the Lambda code, but I'm guessing that you probably need a different VPC endpoint rather than CloudWatch's VPC endpoint.
If the data source is RDS, you will need an RDS VPC endpoint and a SecretsManager VPC endpoint.
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_MultiDataSources-Connect.html#MultiDataSources-Amazon_RDS_PostGre_SQL
If your data source is only accessible in a VPC, you must include the VPC configuration for the connector, as described in Connect to a prebuilt data source with a wizard. If the data source is to connect to the VPC for credentials, the endpoint must be configured in the VPC. For more information, see Using an AWS Secrets Manager VPC endpoint.
Additionally, you must create a VPC endpoint for the Amazon RDS service. For more information, see Amazon RDS API and interface VPC endpoints (AWS PrivateLink).
Also, if I set up a NAT Gateway instead of a VPC endpoint, can I communicate?
Hello ! No, my data source is not an RDS.
I actually tried a NAT Gateway instead but no success. Here is the code:
https://github.com/aws-samples/cloudwatch-data-source-samples/blob/main/src/timeshift/index.js
answered 2 years ago
After reviewing this carefully, there was a misconfiguration withing the security group associated to the VPC endpoint (com.amazonaws.us-east-1.monitoring).
Thanks for the support !
answered 2 years ago
Relevant content
asked a year ago
asked 3 years ago
Looking at the code, I thought it could be used if the CloudWatch VPC endpoint (com.amazonaws.region.monitoring) was set. By the way, does the security group for the VPC endpoint allow HTTPS? Also, is private DNS enabled for the VPC endpoint? https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html
It's strange that even after setting up a NAT Gateway, it doesn't work. In the case of a VPC endpoint, it is possible that the security group of the VPC endpoint does not allow HTTPS, etc., but in the case of a NAT Gateway, if routing is performed normally, it should be possible to communicate with CloudWatch.