Skip to content

Commit b5b5d0c

Browse files
binarymattbinarymatt
authored
[exporter/awscloudwatchlogsexporter] add external id config for role assumption (#38062)
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue. Ex. Adding a feature - Explain what this achieves.--> #### Description When assuming a role in an external AWS account, there are cases where it's desirable to have an external id in the role assumption trust policy. This pull requests adds external id as an optional parameter when role assumption is used to retrieve AWS credentials. This is reopening this [pr](#36725) <!-- Issue number (e.g. #1234) or full URL to issue, if applicable. --> #### Link to tracking issue Fixes <!--Describe what testing was performed and which tests were added.--> #### Testing <!--Describe the documentation added.--> #### Documentation <!--Please delete paragraphs that you did not use before submitting.-->
1 parent 6a86096 commit b5b5d0c

File tree

7 files changed

+93
-29
lines changed

7 files changed

+93
-29
lines changed

‎.chloggen/awscloudwatchexporter_external_id.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Use this changelog template to create an entry for release notes.
2+
3+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
4+
change_type: enhancement
5+
6+
# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
7+
component: awscloudwatchlogsexporter, awsemfexporter, awsxrayexporter
8+
9+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
10+
note: Adding external id support when assuming a role for AWS credentials.
11+
12+
# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
13+
issues: [36725]
14+
15+
# (Optional) One or more lines of additional information to render under the primary note.
16+
# These lines will be padded with 2 spaces and then inserted directly into the document.
17+
# Use pipe (|) for multiline entries.
18+
subtext: AWS IAM Docs https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html#id_roles_third-party_external-id
19+
20+
# If your change doesn't affect end users or the exported elements of any package,
21+
# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
22+
# Optional: The change log or logs in which this entry should be included.
23+
# e.g. '[user]' or '[user, api]'
24+
# Include 'user' if the change is relevant to end users.
25+
# Include 'api' if there is a change to a library API.
26+
# Default: '[user]'
27+
change_logs: [user]

‎exporter/awscloudwatchlogsexporter/README.md

Lines changed: 34 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,19 @@ NOTE: OpenTelemetry Logging support is experimental, hence this exporter is subj
2121

2222
The following settings are required:
2323

24-
- `log_group_name`: The group name of the CloudWatch Logs. If it does not exist it will be created automatically.
24+
- `log_group_name`: The group name of the CloudWatch Logs. If it does not exist it will be created automatically.
2525
- `log_stream_name`: The stream name of the CloudWatch Logs. If it does not exist it will be created automatically.
2626

2727
The following settings can be optionally configured:
2828

2929
- `region`: The AWS region where the log stream is in. Region must be specified if it is not already set in the default credential chain.
3030
- `endpoint`: The CloudWatch Logs service endpoint which the requests are forwarded to. [See the CloudWatch Logs endpoints](https://docs.aws.amazon.com/general/latest/gr/cwl_region.html) for a list.
31-
- `log_retention`: LogRetention is the option to set the log retention policy for only newly created CloudWatch Log Groups. Defaults to Never Expire if not specified or set to 0. Possible values for retention in days are 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 2192, 2557, 2922, 3288, or 3653.
32-
- `tags`: Tags is the option to set tags for the CloudWatch Log Group. If specified, please add at most 50 tags. Input is a string to string map like so: { 'key': 'value' }. Keys must be between 1-128 characters and follow the regex pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]+)$`(alphanumerics, whitespace, and _.:/=+-!). Values must be between 1-256 characters and follow the regex pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`(alphanumerics, whitespace, and _.:/=+-!). [Link to tagging restrictions](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html#:~:text=Required%3A%20Yes-,tags,-The%20key%2Dvalue)
31+
- `log_retention`: LogRetention is the option to set the log retention policy for only newly created CloudWatch Log Groups. Defaults to Never Expire if not specified or set to 0. Possible values for retention in days are 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 2192, 2557, 2922, 3288, or 3653.
32+
- `tags`: Tags is the option to set tags for the CloudWatch Log Group. If specified, please add at most 50 tags. Input is a string to string map like so: { 'key': 'value' }. Keys must be between 1-128 characters and follow the regex pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]+)$`(alphanumerics, whitespace, and _.:/=+-!). Values must be between 1-256 characters and follow the regex pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]\*)$`(alphanumerics, whitespace, and \_.:/=+-!). [Link to tagging restrictions](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html#:~:text=Required%3A%20Yes-,tags,-The%20key%2Dvalue)
3333
- `raw_log`: Boolean default false. If set to true, only the log message will be exported to CloudWatch Logs. This needs to be set to true for [EMF logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Embedded_Metric_Format_Specification.html).
34-
- `sending_queue`: [Parameters for the sending queue](https://github.com/open-telemetry/opentelemetry-collector/blob/main/exporter/exporterhelper/README.md), where you can control parallelism and the size of the sending buffer. Obs.: this component will always have a sending queue enabled.
34+
- `role_arn`: IAM role to upload logs to a different account.
35+
- `external_id`: Shared identitier used when assuming an IAM role in an external AWS account. [See AWS IAM Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html#id_roles_third-party_external-id)
36+
- `sending_queue`: [Parameters for the sending queue](https://github.com/open-telemetry/opentelemetry-collector/blob/main/exporter/exporterhelper/README.md), where you can control parallelism and the size of the sending buffer. Obs.: this component will always have a sending queue enabled.
3537
- `num_consumers`: Number of consumers that will consume from the sending queue. This parameter controls how many consumers will consume from the sending queue in parallel.
3638
- `queue_size`: Maximum number of batches kept in memory before dropping; ignored if enabled is false
3739

@@ -57,15 +59,38 @@ exporters:
5759
region: "us-east-1"
5860
endpoint: "logs.us-east-1.amazonaws.com"
5961
log_retention: 365
60-
tags: { 'sampleKey': 'sampleValue'}
62+
tags: { "sampleKey": "sampleValue" }
6163
```
6264
63-
## Additional Notes
65+
## Additional Notes
6466
6567
- If the log group and/or log stream are specified in an EMF log, that EMF log will be exported to that log group and/or log stream (i.e. ignores the log group and log stream defined in the configuration)
6668
- The log group and log stream will also be created automatically if they do not already exist.
67-
- Example of an EMF log with log group and log stream:
69+
- Example of an EMF log with log group and log stream:
70+
6871
```json
69-
{"_aws":{"Timestamp":1574109732004,"LogGroupName":"Foo", "LogStreamName": "Bar", "CloudWatchMetrics":[{"Namespace":"MyApp","Dimensions":[["Operation"]],"Metrics":[{"Name":"ProcessingLatency","Unit":"Milliseconds","StorageResolution":60}]}]},"Operation":"Aggregator","ProcessingLatency":100}
70-
```
72+
{
73+
"_aws": {
74+
"Timestamp": 1574109732004,
75+
"LogGroupName": "Foo",
76+
"LogStreamName": "Bar",
77+
"CloudWatchMetrics": [
78+
{
79+
"Namespace": "MyApp",
80+
"Dimensions": [["Operation"]],
81+
"Metrics": [
82+
{
83+
"Name": "ProcessingLatency",
84+
"Unit": "Milliseconds",
85+
"StorageResolution": 60
86+
}
87+
]
88+
}
89+
]
90+
},
91+
"Operation": "Aggregator",
92+
"ProcessingLatency": 100
93+
}
94+
```
95+
7196
- Resource ARNs (Amazon Resource Name (ARN) of the AWS resource running the collector) are currently not supported with the CloudWatch Logs Exporter.

‎exporter/awsemfexporter/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ The following exporter configuration parameters are supported.
3939
| `proxy_address` | Upload Structured Logs to AWS CloudWatch through a proxy. | |
4040
| `region` | Send Structured Logs to AWS CloudWatch in a specific region. If this field is not present in config, environment variable "AWS_REGION" can then be used to set region. | determined by metadata |
4141
| `role_arn` | IAM role to upload segments to a different account. | |
42+
| `external_id` | Shared identitier used when assuming an IAM role in an external AWS account. | |
4243
| `max_retries` | Maximum number of retries before abandoning an attempt to post data. | 1 |
4344
| `dimension_rollup_option` | DimensionRollupOption is the option for metrics dimension rollup. Three options are available: `NoDimensionRollup`, `SingleDimensionRollupOnly` and `ZeroAndSingleDimensionRollup`. The default value is `ZeroAndSingleDimensionRollup`. Enabling feature gate `awsemf.nodimrollupdefault` will set default to `NoDimensionRollup`. |"ZeroAndSingleDimensionRollup" (Enable both zero dimension rollup and single dimension rollup)|
4445
| `resource_to_telemetry_conversion` | "resource_to_telemetry_conversion" is the option for converting resource attributes to telemetry attributes. It has only one config option- `enabled`. For metrics, if `enabled=true`, all the resource attributes will be converted to metric labels by default. See `Resource Attributes to Metric Labels` section below for examples. | `enabled=false` |

‎exporter/awsxrayexporter/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ comparable AWS X-Ray Daemon configuration values.
6565
| `local_mode` | Local mode to skip EC2 instance metadata check. | false |
6666
| `resource_arn` | Amazon Resource Name (ARN) of the AWS resource running the collector. | |
6767
| `role_arn` | IAM role to upload segments to a different account. | |
68+
| `external_id` | Shared identitier used when assuming an IAM role in an external AWS account. | |
6869
| `indexed_attributes` | List of attribute names to be converted to X-Ray annotations. | |
6970
| `index_all_attributes` | Enable or disable conversion of all OpenTelemetry attributes to X-Ray annotations. | false |
7071
| `aws_log_groups` | List of log group names for CloudWatch. | [] |

‎internal/aws/awsutil/awsconfig.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ type AWSSessionSettings struct {
2626
ResourceARN string `mapstructure:"resource_arn"`
2727
// IAM role to upload segments to a different account.
2828
RoleARN string `mapstructure:"role_arn"`
29+
// External ID to verify third party role assumption
30+
ExternalID string `mapstructure:"external_id"`
2931
}
3032

3133
func CreateDefaultSessionConfig() AWSSessionSettings {

0 commit comments

Comments
 (0)