Integrate Amazon CloudWatch Metric Streams with Terraform

Set up your environment in CloudWatch and New Relic.

If you have any existing alerts, dashboards, or anything else that relies on your current polling of CloudWatch then you'll need to. 

• Make sure you deactivate any alerts or explicitly filter `collector.name != ‘cloudwatch-metric-streams’` to prevent duplication.
• Save any dashboards that use AWS data as JSON, just in case.

Then go to New Relic and create a new API key that you will use for CloudWatch Metric Streams. Save this key in an appropriate location (You might want to use Hashicorp Vault) and then add it to the locals.tf file that you are using.

Go to the AWS Create a Quick Stack and click Create change set. (You must be logged in for the link to work.)

Copy the change set YAML code into a file that you can use later.

Add the CloudWatch Stream data, but you won’t have anything to connect to just yet.

Now start building out the Terraform file you will be using.

1. If you don’t already have an AWS provider set up in Terraform, follow the docs using the AWS Provider.

2. Add the YAML that you saved previously into a variable in locals.tf.  Use the STACK string header and footer to wrap your YAML code. 

3. You’ll need to create an aws_cloudformation_stack resource for each region you want data to flow from, in a separate file.

TIP: You can create an aws_cloudformation_stack resource for each region you care about. Some parameters need unique names. In step 5, parameters that need to have unique naming are called out.

4. Add a provider for each region.

5. Also, be sure to add the parameters the resource expects:

• NewRelicLicenseKey
  • 40-character hexadecimal string
• NewRelicDatacenter
  • EU keys are prefixed with eu0x, otherwise US
  • Defaults to US
• CloudWatchMetricStreamName 
  • Defaults to NewRelic-Metric-Stream
  • Unique Name Across Regions
  • Must match FirehoseStreamName
• FirehoseStreamName 
  • Defaults to NewRelic-Metric-Stream
  • Unique Name Across Regions
  • Must match CloudWatchMetricStreamName
• S3BackupBucketName
  • Destination for failed events
  • Must be in lowercase, for example: cloudwatch-stream-backup-event-firehose
  • Unique Name Across Regions
• CreateConfigService
  • Optional to enrich metrics with resource metadata from AWS Config 
  • Defaults to false
• S3ConfigBucketName
  • Destination for delivery channel
  • Must be in lowercase, for example: cloudwatch-stream-config-s3
  • Unique Name Across Regions

6. Then set up permissions in AWS for the Terraform CloudFormation stack resource and for the CloudWatch Metric Stream. Make sure to focus on Firehose, S3, CloudFormation, and CloudWatch, because you need these permissions for both Terraform and CloudWatch. You need to figure out which permissions you want. You might grant more than you need initially to get the stack created and then dial them back.

After the Terraform plan works, and you apply it, you should be ready to go.

Verify the integration and clean up your dashboards and alerts.

1. Go to the Amazon Metric Streams status page (one.newrelic.com > Infrastructure > AWS) to make sure you are seeing data.
2. Now unlink the old polling API. (You can ignore this step if you are just starting out and didn’t already create an API integration.)
3. Update any dashboards or alerts that you have to use the new streaming metrics from CloudWatch Metric Streams. Here is a handy table of the new dimensional metrics you can use and their provider counterparts.