{ "componentChunkName": "component---src-templates-issues-tsx", "path": "/issues/622", "result": {"data":{"issuesJson":{"id":"c990c638-ece2-5371-aaf6-b2bfb0cfa7ee","title":"nerdswords/yet-another-cloudwatch-exporter: AWS CloudWatch 的 Prometheus 导出器 - 通过 AWS 标签发现服务，获取 CloudWatch 指标数据，并以 AWS 标签作为标签，将其作为 Prometheus 指标提供","number":622,"bodyHTML":"
\n



\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Reposnerdswords/yet-another-cloudwatch-exporter
Views\"views\"
Stars\"stars\"
Forks\"forks\"
License\"license\"
UpdatedAt\"last-commit\"
CreatedAt\"create-at\"
\n\n

\"\"

\n\n
\n

YACE - yet another cloudwatch exporter

\n

\"Container
\n\"Container

\n

YACE, or yet another cloudwatch exporter, is a Prometheus exporter for AWS CloudWatch metrics. It is written in Go and uses the official AWS SDK.

\n

News

\n

As of November 2024, YACE is part of prometheus-community. Read more about it in these announcement posts:

\n\n

Alternatives

\n

Consider using the official CloudWatch Exporter if you prefer a Java implementation.

\n

Project Status

\n

While YACE is at version less than 1.0.0, expect that any new release might introduce breaking changes. We'll document changes in CHANGELOG.md.

\n

Where feasible, features will be deprecated instead of being immediately changed or removed. This means that YACE will continue to work but might log warning messages. Expect deprecated features to be permanently changed/removed within the next 2/3 releases.

\n

Security

\n

Read more how to report a security vulnerability in SECURITY.md.

\n

Supported Versions

\n

Only the latest version gets security updates. We won't support older versions.

\n

Features

\n\n

Feature flags

\n

To provide backwards compatibility, some of YACE's new features or breaking changes might be guarded under a feature flag. Refer to docs/feature_flags.md for details.

\n

Installing and running

\n

Refer to the installation guide.

\n

Authentication

\n

The exporter will need to be running in an environment which has access to AWS. The exporter uses the AWS SDK for Go and supports providing authentication via AWS's default credential chain. Regardless of the method used to acquire the credentials, some permissions are needed for the exporter to work.

\n

As a quick start, the following IAM policy can be used to grant the all permissions required by YACE

\n
{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": [\n        \"tag:GetResources\",\n        \"cloudwatch:GetMetricData\",\n        \"cloudwatch:GetMetricStatistics\",\n        \"cloudwatch:ListMetrics\",\n        \"apigateway:GET\",\n        \"aps:ListWorkspaces\",\n        \"autoscaling:DescribeAutoScalingGroups\",\n        \"dms:DescribeReplicationInstances\",\n        \"dms:DescribeReplicationTasks\",\n        \"ec2:DescribeTransitGatewayAttachments\",\n        \"ec2:DescribeSpotFleetRequests\",\n        \"shield:ListProtections\",\n        \"storagegateway:ListGateways\",\n        \"storagegateway:ListTagsForResource\",\n        \"iam:ListAccountAliases\"\n      ],\n      \"Effect\": \"Allow\",\n      \"Resource\": \"*\"\n    }\n  ]\n}
\n

If you would like to remove certain permissions based on your needs the policy can be adjusted based the CloudWatch namespaces you are scraping

\n

These are the bare minimum permissions required to run Static and Discovery Jobs

\n
\"tag:GetResources\",\n\"cloudwatch:GetMetricData\",\n\"cloudwatch:GetMetricStatistics\",\n\"cloudwatch:ListMetrics\"
\n

This permission is required to discover resources for the AWS/ApiGateway namespace

\n
\"apigateway:GET\"
\n

This permission is required to discover resources for the AWS/AutoScaling namespace

\n
\"autoscaling:DescribeAutoScalingGroups\"
\n

These permissions are required to discover resources for the AWS/DMS namespace

\n
\"dms:DescribeReplicationInstances\",\n\"dms:DescribeReplicationTasks\"
\n

This permission is required to discover resources for the AWS/EC2Spot namespace

\n
\"ec2:DescribeSpotFleetRequests\"
\n

This permission is required to discover resources for the AWS/Prometheus namespace

\n
\"aps:ListWorkspaces\"
\n

These permissions are required to discover resources for the AWS/StorageGateway namespace

\n
\"storagegateway:ListGateways\",\n\"storagegateway:ListTagsForResource\"
\n

This permission is required to discover resources for the AWS/TransitGateway namespace

\n
\"ec2:DescribeTransitGatewayAttachments\"
\n

This permission is required to discover protected resources for the AWS/DDoSProtection namespace

\n
\"shield:ListProtections\"
\n

The AWS IAM API supports creating account aliases, which are human-friendly names that can be used to easily identify accounts. An account can have at most a single alias, see (docs). Each alias must be unique across an AWS network partition (docs). The following permission is required to get the alias for an account, which is exported as a label in the aws_account_info metric:

\n
\"iam:ListAccountAliases\"
\n

If running YACE inside an AWS EC2 instance, the exporter will automatically attempt to assume the associated IAM Role. If this is undesirable behavior turn off the use the metadata endpoint by setting the environment variable AWS_EC2_METADATA_DISABLED=true.

\n

Configuration

\n

Refer to the configuration docs.

\n

Metrics Examples

\n
### Metrics with exportedTagsOnMetrics\naws_ec2_cpuutilization_maximum{dimension_InstanceId=\"i-someid\", name=\"arn:aws:ec2:eu-west-1:472724724:instance/i-someid\", tag_Name=\"jenkins\"} 57.2916666666667\n\n### Info helper with tags\naws_elb_info{name=\"arn:aws:elasticloadbalancing:eu-west-1:472724724:loadbalancer/a815b16g3417211e7738a02fcc13bbf9\",tag_KubernetesCluster=\"production-19\",tag_Name=\"\",tag_kubernetes_io_cluster_production_19=\"owned\",tag_kubernetes_io_service_name=\"nginx-ingress/private-ext\",region=\"eu-west-1\"} 0\naws_ec2_info{name=\"arn:aws:ec2:eu-west-1:472724724:instance/i-someid\",tag_Name=\"jenkins\"} 0\n\n### Track cloudwatch requests to calculate costs\nyace_cloudwatch_requests_total 168\n
\n

Query Examples without exportedTagsOnMetrics

\n
# CPUUtilization + Name tag of the instance id - No more instance id needed for monitoring\naws_ec2_cpuutilization_average + on (name) group_left(tag_Name) aws_ec2_info\n\n# Free Storage in Megabytes + tag Type of the elasticsearch cluster\n(aws_es_free_storage_space_sum + on (name) group_left(tag_Type) aws_es_info) / 1024\n\n# Add kubernetes / kops tags on 4xx elb metrics\n(aws_elb_httpcode_backend_4_xx_sum + on (name) group_left(tag_KubernetesCluster,tag_kubernetes_io_service_name) aws_elb_info)\n\n# Availability Metric for ELBs (Successful requests / Total Requests) + k8s service name\n# Use nilToZero on all metrics else it won't work\n((aws_elb_request_count_sum - on (name) group_left() aws_elb_httpcode_backend_4_xx_sum) - on (name) group_left() aws_elb_httpcode_backend_5_xx_sum) + on (name) group_left(tag_kubernetes_io_service_name) aws_elb_info\n\n# Forecast your elasticsearch disk size in 7 days and report metrics with tags type and version\npredict_linear(aws_es_free_storage_space_minimum[2d], 86400 * 7) + on (name) group_left(tag_type, tag_version) aws_es_info\n\n# Forecast your cloudwatch costs for next 32 days based on last 10 minutes\n# 1.000.000 Requests free\n# 0.01 Dollar for 1.000 GetMetricStatistics Api Requests (https://aws.amazon.com/cloudwatch/pricing/)\n((increase(yace_cloudwatch_requests_total[10m]) * 6 * 24 * 32) - 100000) / 1000 * 0.01\n
\n

Override AWS endpoint urls

\n

to support local testing all AWS urls can be overridden with by setting an environment variable AWS_ENDPOINT_URL

\n
docker run -d --rm -v $PWD/credentials:/exporter/.aws/credentials -v $PWD/config.yml:/tmp/config.yml \\\n-e AWS_ENDPOINT_URL=http://localhost:4766 -p 5000:5000 --name yace quay.io/prometheuscommunity/yet-another-cloudwatch-exporter:latest
\n

Options

\n

RoleArns

\n

Multiple roleArns are useful, when you are monitoring multi-account setup, where all accounts are using same AWS services. For example, you are running yace in monitoring account and you have number of accounts (for example newspapers, radio and television) running ECS clusters. Each account gives yace permissions to assume local IAM role, which has all the necessary permissions for Cloudwatch metrics. On this kind of setup, you could simply list:

\n
apiVersion: v1alpha1\nsts-region: eu-west-1\ndiscovery:\n  jobs:\n    - type: AWS/ECS\n      regions:\n        - eu-north-1\n      roles:\n        - roleArn: \"arn:aws:iam::1111111111111:role/prometheus\" # newspaper\n        - roleArn: \"arn:aws:iam::2222222222222:role/prometheus\" # radio\n        - roleArn: \"arn:aws:iam::3333333333333:role/prometheus\" # television\n      metrics:\n        - name: MemoryReservation\n          statistics:\n            - Average\n            - Minimum\n            - Maximum\n          period: 600\n          length: 600
\n

Additionally, if the IAM role you want to assume requires an External ID you can specify it this way:

\n
  roles:\n    - roleArn: \"arn:aws:iam::1111111111111:role/prometheus\"\n      externalId: \"shared-external-identifier\"
\n

Requests concurrency

\n

The flags 'cloudwatch-concurrency' and 'tag-concurrency' define the number of concurrent request to cloudwatch metrics and tags. Their default value is 5.

\n

Setting a higher value makes faster scraping times but can incur in throttling and the blocking of the API.

\n

Decoupled scraping

\n

The exporter scraped cloudwatch metrics in the background in fixed interval.
\nThis protects from the abuse of API requests that can cause extra billing in AWS account.

\n

The flag 'scraping-interval' defines the seconds between scrapes.
\nThe default value is 300.

\n

Embedding YACE in your application

\n

YACE can be used as a library and embedded into your application, see the embedding guide.

\n

Troubleshooting / Debugging

\n

Help my metrics are intermittent

\n\n

My metrics only show new values after 5 minutes

\n\n

Contribute

\n

Development Setup / Guide

\n

Thank you

\n","updatedAt":"2025-05-22T01:53:58Z","upvoteCount":null,"author":{"login":"eryajf","avatarUrl":"https://avatars.githubusercontent.com/u/33259379?u=e4a4090a38ac2473aaed4ef9945233636776c6c3&v=4","url":"https://github.com/eryajf"},"category":null,"labels":{"edges":[{"node":{"name":"更多","color":"25B472"}},{"node":{"name":"Prometheus-Exporter","color":"367acb"}},{"node":{"name":"nerdswords","color":"6f2d1d"}}]},"comments":{"edges":[]}}},"pageContext":{"number":622,"previous":{"title":"cookieY/Yearning: 简单, 高效的 MySQL 审计平台","number":621},"next":{"title":"mikefarah/yq: 款基于 go 语言编写类似 jq 的处理 yaml 文件的工具","number":623}}}, "staticQueryHashes": ["151096407","2861350382"]}