DocsCloud
Connect AWS, Azure and Google Cloud
Televane reads the metrics your cloud provider already collects, using read-only credentials. Nothing is installed in your cloud and nothing there is changed. Open Cloud in the portal (or Add data › Cloud), create the credentials with the commands below, and paste them in. Televane tests them before saving and stores the secret encrypted.
What is read
| Provider | Services | Metric names |
|---|---|---|
| AWS (CloudWatch) | EC2, RDS, Application Load Balancers, Lambda, SQS | aws_ec2_cpu_utilization, aws_rds_free_storage_bytes, aws_alb_requests, … |
| Azure (Azure Monitor) | Virtual machines, Azure SQL, PostgreSQL and MySQL flexible servers, App Service and Functions, Storage accounts, Azure Cache for Redis | azure_vm_percentage_cpu, azure_sql_cpu_percent, azure_app_service_requests, … |
| Google Cloud (Cloud Monitoring) | Compute Engine, Cloud SQL, Cloud Run | gcp_compute_cpu_utilization, gcp_cloudsql_connections, gcp_cloud_run_requests_per_second, … |
Each metric has the labels resource (the VM, database, load balancer or function), region or zone, and account (the name you gave the account). The values are per minute. They appear under Metrics › Custom metrics, work in dashboards and alert rules, and can be queried with PromQL, for example avg by (resource) (aws_ec2_cpu_utilization). Each connected account has a Create dashboard button that makes a ready-made overview.
Azure
In Azure Cloud Shell, create an app registration with the read-only Monitoring Reader role on the subscription:
az ad sp create-for-rbac --name televane-monitoring \
--role "Monitoring Reader" --scopes /subscriptions/<SUBSCRIPTION_ID>Enter tenant as the Tenant ID, appId as the Client ID, the subscription ID, and password as the client secret. Client secrets expire (after one year by default); when one does, the account shows Credentials refused until you enter a new secret.
AWS
In AWS CloudShell, create a user that can only read CloudWatch, and an access key for it:
aws iam create-user --user-name televane-monitoring
aws iam attach-user-policy --user-name televane-monitoring \
--policy-arn arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess
aws iam create-access-key --user-name televane-monitoringEnter the AccessKeyId, the SecretAccessKey and the regions to read (for example ap-south-1 us-east-1).
Google Cloud
In Cloud Shell, create a service account with the Monitoring Viewer role and a key for it:
gcloud iam service-accounts create televane-monitoring --project <PROJECT_ID>
gcloud projects add-iam-policy-binding <PROJECT_ID> \
--member serviceAccount:televane-monitoring@<PROJECT_ID>.iam.gserviceaccount.com \
--role roles/monitoring.viewer
gcloud iam service-accounts keys create televane-key.json \
--iam-account televane-monitoring@<PROJECT_ID>.iam.gserviceaccount.comPaste the whole contents of televane-key.json, then delete the file. Some organizations block service account keys with an organization policy; an administrator can allow them for this project.
Good to know
- Interval: every 5 minutes by default (1 to 60). Cloud providers publish metrics a few minutes late, so the newest data is about 5 minutes old.
- Cost on your cloud bill: providers can charge for metric reads. AWS CloudWatch charges about $0.01 per 1,000 metrics requested; for example 20 EC2 instances read every 5 minutes is about 690,000 metrics, around $7 a month. A longer interval lowers the cost.
- Limits: up to 300 resources per account are read on each pass.
- Plan: cloud integrations are part of Pro and above and of the 14-day Pro trial. On the Free plan, connected accounts are paused.
- Security: only administrators can connect accounts. Secrets are never shown again, and every change is in the audit log. To revoke access, delete the app registration, IAM user or service account key in your cloud.