USER MANUALS

Log Configuration

When configuring your Agora subscription, you can provide a S3 bucket to store logs from two sources:

Note

The S3 Bucket must exist beforehand.

  • Denodo Monitor Logs: Published by the Solution Manager instance in Denodo’s AWS account.

  • Execution Plane Logs: Published by the instances provisioned within your own AWS account.

Configuring the S3 Bucket in Agora Console

During provisioning, you will be prompted for an IAM Role and an optional S3 bucket.

Where to configure your S3 bucket

To obtain the S3 URI of your bucket you can go to the details of your S3 bucket in AWS, check the checkbox next to the desired folder and press the Copy S3 URI button. The S3 URI must contain a folder.

How to obtain the S3 URI of your bucket's folder

You will also have to specify the region of the bucket which you can obtain from the Properties section of the bucket in the AWS console.

Permissions of your S3 bucket

As we have mentioned earlier the publishing of Denodo Monitor logs is done by the Solution Manager instance running in Denodo’s account. The Solution Manager obtains credentials through the assumed IAM Role created during the configuration of the subscription.

The Execution Plane instances publish their own services’ logs and obtains credentials through their instance profile that only holds S3 permissions to write to Denodo’s bucket and the client’s bucket. This instance profile can be obtained by going to the section Roles in the IAM service of your AWS dashboard and looking for “denodo-agora-<UUID>” once you have configured your Agora subscription.

We recommend configuring the S3 bucket policy to only allow access to the IAM Role assumed by Solution Manager and the instance profile of the Execution Plane instances. If you have a custom bucket policy add allow sentences for the Execution Plance instance profile role and the role assumed by the Solution Manager. The following json is an example policy restricting access exclusively to these two roles.

customer_bucket_policy.json
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "BucketPermissions",
              "Effect": "Deny",
              "Principal": "*",
              "Action": [
                  "s3:GetBucketLocation"
              ],
              "Resource": "arn:aws:s3:::agora.client.bucket",
              "Condition": {
                  "ArnNotLike": {
                      "aws:PrincipalArn": [
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:role/<EP_INSTANCE_PROFILE_IAM_ROLE>",
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:role/<AGORA_IAM_ROLE_ASSUMED_BY_SOLUTION_MANAGER>",
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:role/<AGORA_DEVELOPER_ROLE_WITH_ACCESS_TO_LOGS_BUCKET>",
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:root"
                      ]
                  }
              }
          },
          {
              "Sid": "FolderPermissions",
              "Effect": "Deny",
              "Principal": "*",
              "Action": [
                  "s3:GetObject",
                  "s3:PutObject"
              ],
              "Resource": "arn:aws:s3:::agora.client.bucket/*",
              "Condition": {
                  "ArnNotLike": {
                      "aws:PrincipalArn": [
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:role/<EP_INSTANCE_PROFILE_IAM_ROLE>",
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:role/<AGORA_IAM_ROLE_ASSUMED_BY_SOLUTION_MANAGER>",
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:role/<AGORA_DEVELOPER_ROLE_WITH_ACCESS_TO_LOGS_BUCKET>",
                          "arn:aws:iam::<CLIENT_AWS_ACCOUNT>:root"
                      ]
                  }
              }
          }
      ]
  }
Add feedback