Deploying Grafana and Monitoring your AWS environment

Today I deployed Grafana in my lab environment.  I am hoping to to get this pulling from FortiAnalyzer in the future or “directly” to the Fortigate using SNMP.  There is a way of doing it in an article I read using Prometheus but I do not want to install another solution.  More to follow.  Lets get started.

“Grafana is open source visualization and analytics software. It allows you to query, visualize, alert on, and explore your metrics no matter where they are stored.
In plain English, it provides you with tools to turn your time-series database (TSDB) data into beautiful graphs and visualizations.” ~ Grafana Website

After deploying a standard Ubuntu Server (I will not cover the install here), I installed Grafana.  Here is the step-by-step.

Once the Ubuntu server is deployed and you have assigned an IP address (I have an article on changing from DHCP to Static) you can get started on installing Grafana.

Run the following commands:

sudo apt-get install -y adduser libfontconfig1

You will need to check the Grafana website to see what the lates version is.  You will need it for the next section.  You will need to cd to a directory / folder where you will download the file.  I used ~ which is …

wget https://dl.grafana.com/oss/release/grafana_6.7.1_amd64.deb

Once you have the file downloaded with wget you need to install the package

sudo dpkg -i grafana_6.7.1_amd64.deb

Next we want to start the services

sudo systemctl daemon-reload
sudo systemctl start grafana-server
sudo systemctl status grafana-server

Next we want to make sure the Grafana service starts at boot up.

sudo service grafana-server start
sudo service grafana-server status

Now you are ready to connect to the Grafana GUI

You can connect to the GUI by browsing to http://X.X.X.X:30000 (where X.X.X.X is the IP address you assigned to the Grafana Ubuntu server)

The initial login is admin password is admin

You will be forced to change the password

Create your new password and hit save

Choose the cog icon and choose Data Sources

You can now Add Data Source .  I have already added my cloud watch in this screenshot, but yours will be blank.

You should have the credentials to your AWS environment.  In my case, I am using IAM and it will provide an access key and secret access key

Here is the JSON for the IAM Policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadingMetricsFromCloudWatch",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:DescribeAlarmsForMetric",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:GetMetricData"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowReadingTagsInstancesRegionsFromEC2",
      "Effect": "Allow",
      "Action": ["ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeRegions"],
      "Resource": "*"
    },
    {
      "Sid": "AllowReadingResourcesForTags",
      "Effect": "Allow",
      "Action": "tag:GetResources",
      "Resource": "*"
    }
  ]
}

Hope this helps someone