Using monitors that depend on aws-cloudwatch-exts-commons/src/main/java/com/appdynamics/extensions/aws/collectors/RegionMetricStatisticsCollector.java has trouble on ECS Fargate

[npetter]

Hi,

I am trying to run the standalone machine agent with the Route53 monitor in AWS ECS Fargate Service/Task/Container. However, the monitor fails to acquire credentials, because
aws-cloudwatch-exts-commons/src/main/java/com/appdynamics/extensions/aws/collectors/RegionMetricStatisticsCollector.java uses the InstanceProfileCredentialsProvider rather than the DefaultCredentialsProvider:

Caused by: com.amazonaws.AmazonClientException: Unable to load credentials from Amazon EC2 metadata service
at com.amazonaws.auth.InstanceProfileCredentialsProvider.handleError(InstanceProfileCredentialsProvider.java:244)
at com.amazonaws.auth.InstanceProfileCredentialsProvider.loadCredentials(InstanceProfileCredentialsProvider.java:225)
at com.amazonaws.auth.InstanceProfileCredentialsProvider.getCredentials(InstanceProfileCredentialsProvider.java:124)
at com.amazonaws.services.cloudwatch.AmazonCloudWatchClient.invoke(AmazonCloudWatchClient.java:970)
at com.amazonaws.services.cloudwatch.AmazonCloudWatchClient.listMetrics(AmazonCloudWatchClient.java:429)
at com.appdynamics.extensions.aws.metric.processors.MetricsProcessorHelper.getMetrics(MetricsProcessorHelper.java:79)
at com.appdynamics.extensions.aws.metric.processors.MetricsProcessorHelper.getMetrics(MetricsProcessorHelper.java:70)
at com.appdynamics.extensions.aws.metric.processors.MetricsProcessorHelper.getFilteredMetrics(MetricsProcessorHelper.java:40)
at com.appdynamics.extensions.aws.route53.Route53MetricsProcessor.getMetrics(Route53MetricsProcessor.java:45)
at com.appdynamics.extensions.aws.collectors.RegionMetricStatisticsCollector.call(RegionMetricStatisticsCollector.java:85)

[satish-m]

Hi @npetter,

You can pass credentials to our AWS extensions in two ways.

1. You pass the access key and secret key in extensions config.yml. In this case it will create a StaticCredentialsProvider.
2. You run the extension in an EC2 instance and configure InstanceProfile for that EC2 instance. In this case it will use InstanceProfileCredentialsProvider.

Other than these two we don't support any other way to provide credentials at the moment. Let us know if you want us to add other ways to provide credentials.

Regards,
Satish M

[npetter]

Hi,
Thanks for responding quickly. I can work around this with access key and secret key, but I would prefer to have use the IAM role/policy for the Fargate Task. Would it be possible to start using the DefaultCredentialsProvider instead? (https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html)

[satish-m]

Hi @npetter,

Can you please create a helpdesk ticket with the details.

Regards,
Satish M