})
})
})
Once the above files are configured, you can run Terraform against your scripts by executing the following CLI commands in sequence: ``` diff --git a/docs/dashboards/explore-view.md b/docs/dashboards/explore-view.md index 2478cd5b818..08dda93070f 100644 --- a/docs/dashboards/explore-view.md +++ b/docs/dashboards/explore-view.md @@ -34,7 +34,7 @@ Monitoring dashboards are available for the following apps and solutions. ### AWS Observability -AWS Observability provides an intuitive dashboard framework that mirrors industry-standard AWS hierarchies. You can quickly navigate across multiple AWS accounts and view resources hosted in multiple locations worldwide. From this tab, you can quickly navigate across multiple AWS accounts and view resources hosted in multiple locations worldwide. [Learn more](/docs/observability/aws/deploy-use-aws-observability/view-dashboards.md).
})
+AWS Observability provides an intuitive dashboard framework that mirrors industry-standard AWS hierarchies. You can quickly navigate across multiple AWS accounts and view resources hosted in multiple locations worldwide. From this tab, you can quickly navigate across multiple AWS accounts and view resources hosted in multiple locations worldwide. [Learn more](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/view-dashboards.md).
### Kubernetes Views
diff --git a/docs/manage/manage-subscription/fedramp-capabilities.md b/docs/manage/manage-subscription/fedramp-capabilities.md
index b5494f051f5..e254546c7f4 100644
--- a/docs/manage/manage-subscription/fedramp-capabilities.md
+++ b/docs/manage/manage-subscription/fedramp-capabilities.md
@@ -47,7 +47,7 @@ The following table shows the capabilities included with Sumo Logic’s FedRAMP
| Collection - Amazon Web Services | [AWS Elastic Load Balancing](/docs/send-data/hosted-collectors/amazon-aws/aws-elastic-load-balancing-source/) | ✓ | ✓ |
| Collection - Amazon Web Services | [AWS Kinesis Firehose for Logs](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source/) | ✓ | ✓ |
| Collection - Amazon Web Services | [AWS Kinesis Firehose for Metrics](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source/) | ✓ | ✓ |
-| Collection - Amazon Web Services | [AWS Inventory](/docs/observability/aws/deploy-use-aws-observability/resources/) | ✓ | |
+| Collection - Amazon Web Services | [AWS Inventory](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/resources/) | ✓ | |
| Collection - Amazon Web Services | [AWS Metadata](/docs/send-data/hosted-collectors/amazon-aws/aws-metadata-tag-source/) | ✓ | ✓ |
| Collection - Amazon Web Services | [CSE AWS EC2 Inventory](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source/) | ✓ | |
| Collection - Archive | [AWS S3 archive](/docs/manage/data-archiving/archive) | ✓ | ✓ |
diff --git a/docs/observability/aws/about.md b/docs/observability/aws/about.md
index 695b9c07271..a4c2266b1ed 100644
--- a/docs/observability/aws/about.md
+++ b/docs/observability/aws/about.md
@@ -46,7 +46,7 @@ Sumo Logic provides an AWS CloudFormation templates (CFN) and Terraform scripts
* **Sumo Logic AWS Observability** supports the following AWS services: EC2, ECS, Amazon RDS, Amazon ElastiCache, Amazon API Gateway, AWS Lambda, Amazon DynamoDB, Classic ELB, Application ELB, Network ELB, Amazon SNS, and Amazon SQS.
-After you have [prepared](/docs/observability/aws/deploy-use-aws-observability/before-you-deploy) and [deployed](/docs/observability/aws/deploy-use-aws-observability) the solution, you can [add and configure additional AWS services](/docs/observability/aws/other-configurations-tools/add-new-aws-service) as your infrastructure grows.
+After you have [prepared](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy) and [deployed](/docs/observability/aws/deploy-use-aws-observability) the solution, you can [add and configure additional AWS services](/docs/observability/aws/other-configurations-tools/add-new-aws-service) as your infrastructure grows.
})
@@ -63,7 +63,7 @@ This new metadata can also be used in ad hoc logs and metrics searches.
})
-You can navigate from overview dashboards of the infrastructure and drill down into account, AWS Region, service, or entity views. The intuitive navigation enables you to quickly resolve issues, minimize downtime, and improve system availability. See [View AWS Observability Solution Dashboards](/docs/observability/aws/deploy-use-aws-observability/view-dashboards) for details.
+You can navigate from overview dashboards of the infrastructure and drill down into account, AWS Region, service, or entity views. The intuitive navigation enables you to quickly resolve issues, minimize downtime, and improve system availability. See [View AWS Observability Solution Dashboards](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/view-dashboards) for details.
})
diff --git a/docs/observability/aws/deploy-use-aws-observability/index.md b/docs/observability/aws/deploy-use-aws-observability/index.md
index 3fade2c80d1..5edd37ac943 100644
--- a/docs/observability/aws/deploy-use-aws-observability/index.md
+++ b/docs/observability/aws/deploy-use-aws-observability/index.md
@@ -5,89 +5,41 @@ description: Learn about Sumo Logic's AWS Observability Solution, how to deploy
---
import useBaseUrl from '@docusaurus/useBaseUrl';
-import Iframe from 'react-iframe';
AWS Observability Solution is a framework to simplify the monitoring and troubleshooting of your AWS cloud infrastructure. You can use the Sumo Logic observability app dashboards to isolate and solve problems faster.
-These topics have information about Sumo Logic's AWS Observability Solution, how to deploy it, and how to get started with it.
-
-import DocCardList from '@theme/DocCardList';
-import {useCurrentSidebarCategory} from '@docusaurus/theme-common';
-
-:::training Micro Lesson
-
-Watch a micro lesson on deploying the AWS Observability Solution.
-
-
-
-:::
-
-
-In this section, we'll introduce the following concepts:
+The AWS Observability Solution is available in two versions. Choose the version that matches the release you're deploying:
- })
Before You Deploy
-Learn prerequisites and guidelines for deploying the AWS Observability Solution to a single AWS account and region.
+v3.0.0 (latest)
+Deploy and use the latest version of the AWS Observability Solution.
-
Deploy with AWS CloudFormation
-Learn about the process of executing the AWS CloudFormation template to set up the AWS Observability Solution for a single AWS region and account combination.
+v2.15.0
+Deploy and use version 2.15.0 of the AWS Observability Solution.
-
-
-
-Deploy with Terraform
-Learn how to deploy AWS Observability Solution using Terraform.
-
-
-
-
-Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform
-Learn how to migrate CloudWatch Source to Kinesis Firehose Source using Terraform.
-
-
-
-
-View AWS Observability Solution Dashboards
-Learn how to navigate your AWS Observability infrastructure, as well as provide links to the app dashboards.
-
-
+
+## Migrate from v2.x to v3.0.0
+
+If you already run AWS Observability v2.x, use the following guides to migrate your CloudFormation deployment to v3.0.0.
+
+
-
Configure AWS Observability Alerts
-Sumo Logic has provided out-of-the-box alerts to help you quickly determine if a particular AWS service is available and performing as expected.
-
-
Update the AWS Observability Stack
-Learn how to update the AWS Observability stack.
+Migrate AWS Observability from v2.x to v3.0.0 (CloudFormation)
+Learn how to migrate your existing AWS Observability CloudFormation stack from v2.x to v3.0.0 using the migration script.
-
AWS Observability Resources
-Learn more about AWS Observability resources created and modified at deployment using Terraform and CloudFormation.
+Manually Migrate AWS Observability from v2.x to v3.0.0 (CloudFormation)
+Learn how to manually migrate your existing AWS Observability CloudFormation stack from v2.x to v3.0.0 step by step.
-
-
-
AWS Observability Terraform script and CloudFormation Changelog
-This section provides details on the available versions of the AWS Observability CloudFormation template.
-})
+
+5. Click through the remaining steps and submit the update.
+6. Wait for the stack to reach `UPDATE_COMPLETE` before proceeding.
+
+## Step 2: Delete the v2.x stack
+
+1. Go to **AWS Console > CloudFormation > Stacks**.
+2. Select your v2.x stack and click **Delete**.
+3. Confirm the deletion.
+4. Wait for the stack to reach `DELETE_COMPLETE`. If the deletion gets stuck in `DELETE_FAILED`, this is expected — the S3 bucket cannot be deleted because it contains logs. In this case, use **Force delete** to complete the deletion while leaving the bucket intact.
+
+## Step 3: Verify your Sumo Logic resources are intact
+
+After the stack is deleted, verify that your collector and sources are still present in Sumo Logic:
+
+1. Go to **Manage Data > Collection > Collection**.
+2. Find the collector named `aws-observability-| v2.x Parameter | +v3.0.0 Parameter | +Notes | +
|---|---|---|
Section1aSumoLogicDeployment | Section1aSumoLogicDeployment | Same value |
Section1bSumoLogicAccessID | Section1bSumoLogicAccessID | Same value |
Section1cSumoLogicAccessKey | Section1cSumoLogicAccessKey | Same value (re-enter — masked in CFN) |
Section1dSumoLogicOrganizationId | Section1dSumoLogicOrganizationId | Same value |
Section1eSumoLogicResourceRemoveOnDeleteStack | Section1eSumoLogicResourceRemoveOnDeleteStack | Set to false |
Section1fSumoLogicSendTelemetry | Section1fSumoLogicSendTelemetry | Same value |
Section2aAccountAlias | Section2aAccountAlias | Same value |
Section2bAccountAliasMappingS3URL | Section2bAccountAliasMappingS3URL | Same value |
Section3aInstallObservabilityApps | Section3aInstallObservabilityApps | Same value |
Section4aCreateMetricsSourceOptions | Section4aCreateMetricsSourceOptions | Same value |
Section4bMetricsNameSpaces | Section4bMetricsNameSpaces | Same value |
Section4cCloudWatchExistingSourceAPIUrl | Section4cCloudWatchExistingSourceAPIUrl | Leave empty (create new) |
Section4dAWSMetricsTagFilters | Section4dAWSMetricsTagFilters | Same value |
Section5aAutoEnableS3LogsALBResourcesOptions | Section5aAutoEnableS3LogsALBResourcesOptions | Same value |
Section5bALBCreateLogSource | Section5bALBCreateLogSource | Same value |
Section5cALBLogsSourceUrl | Section5cALBLogsSourceUrl | Leave empty (create new) |
Section5dALBS3LogsBucketName | Section5dALBS3LogsBucketName | Use the existing bucket name from your v2.x stack |
Section5eALBS3BucketPathExpression | Section5eALBS3BucketPathExpression | Same value |
Section6aCreateCloudTrailLogSource | Section6aCreateCloudTrailLogSource | Same value |
Section6bCloudTrailLogsSourceUrl | Section6bCloudTrailLogsSourceUrl | Leave empty (create new) |
Section6cCloudTrailLogsBucketName | Section6cCloudTrailLogsBucketName | Use the existing bucket name from your v2.x stack |
Section6dCloudTrailBucketPathExpression | Section6dCloudTrailBucketPathExpression | Same value |
Section7aLambdaCreateCloudWatchLogsSourceOptions | Section7aCreateCloudWatchLogsSourceOptions | Renamed — drop Lambda from key name |
Section7bLambdaCloudWatchLogsSourceUrl | Section7bCloudWatchLogsSourceUrl | Renamed — drop Lambda; leave empty (create new) |
Section7cAutoSubscribeLogGroupsOptions | Section7cAutoSubscribeLogGroupsOptions | Same value |
Section7dAutoSubscribeLogGroupPattern | Section7dAutoSubscribeLogGroupPattern | Same value |
Section7eAutoSubscribeLogGroupByTags | Section7eAutoSubscribeLogGroupByTags | Same value |
Section9aAutoEnableS3LogsELBResourcesOptions | Section8aAutoEnableS3LogsELBResourcesOptions | Renamed — Section 9 → Section 8 |
Section9bELBCreateLogSource | Section8bELBCreateLogSource | Renamed — Section 9 → Section 8 |
Section9cELBLogsSourceUrl | Section8cELBLogsSourceUrl | Renamed — Section 9 → Section 8; leave empty (create new) |
Section9dELBS3LogsBucketName | Section8dELBS3LogsBucketName | Renamed — Section 9 → Section 8; use existing bucket name |
Section9eELBS3BucketPathExpression | Section8eELBS3BucketPathExpression | Renamed — Section 9 → Section 8 |
Section10aAppInstallLocation | (removed) | Removed in v3.0.0 — do not include |
Section10bShare | (removed) | Removed in v3.0.0 — do not include |
})
+
+3. In the `CreateCommonResources` stack, go to the **Resources** tab and search for `SumoLogicSourceRole`. Click the **Physical ID** link to open the IAM role.
+
+})
+
+4. On the IAM role page, copy the **ARN** shown in the Summary section.
+
+})
+
+### Update the role ARN in Sumo Logic
+
+For each S3-based source on your collector (`alb-logs`, `classic-lb-logs`, `cloudtrail-logs`):
+
+1. Go to **Manage Data > Collection > Collection**.
+2. Find your AWSO collector and click on the source.
+3. Update the **AWS Role ARN** field with the new ARN from the step above.
+4. Save the source.
+
+## Step 8: Verify the migration
+
+1. Go to **Manage Data > Collection > Collection** and confirm all 5 sources show a green status.
+2. Check that logs and metrics are flowing into Sumo Logic by running a search:
+ - `_sourceCategory=aws/observability/cloudtrail/logs`
+ - `_sourceCategory=aws/observability/cloudwatch/metrics`
+
+## Troubleshooting
+
+| Issue | Cause | Resolution |
+|:--|:--|:--|
+| Stack deletion stuck in `DELETE_FAILED` | S3 bucket is non-empty and cannot be deleted by CloudFormation | Use **Force delete** on the stack — the bucket will be preserved. |
+| v3.0.0 deploy fails with `fer:invalid_extraction_rule` | AWSO Field Extraction Rules from v2.x still exist | Complete [Step 4](#step-4-clean-up-field-extraction-rules) and retry. |
+| v3.0.0 deploy fails with `metrics:rule_already_exists` | AWSO Metric Rules from v2.x still exist | Complete [Step 5](#step-5-clean-up-metric-rules) and retry. |
+| Sources show errors after migration | Sources still reference the old deleted IAM role ARN | Complete [Step 7](#step-7-update-source-iam-role-arns). |
+| Collector or sources not found after stack deletion | `RemoveOnDeleteStack` was `true` when the stack was deleted | Resources cannot be recovered — redeploy v3.0.0 with fresh sources. |
diff --git a/docs/observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy.md
new file mode 100644
index 00000000000..f3cfa4b7df4
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy.md
@@ -0,0 +1,201 @@
+---
+id: before-you-deploy
+title: Before You Deploy
+sidebar_label: Before You Deploy
+description: Learn prerequisites and guidelines for deploying the AWS Observability Solution to a single AWS account and region.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+This page describes prerequisites and guidelines for deploying Sumo Logic’s AWS Observability Solution.
+
+:::info
+If you are already collecting AWS metrics, logs, and/or events, we recommend that you override the default settings. By overriding the configuration sources, we prevent them from being re-created in the AWS infrastructure or Sumo Logic.
+:::
+
+## Prerequisites
+
+* **Sumo Logic Metrics**. The AWS Observability Solution leverages both logs and metrics to provide comprehensive monitoring and troubleshooting of your AWS cloud infrastructure. If you do not already have Metrics, contact your Sumo Logic account representative. AWS Observability integrates with the [AWS Observability view](/docs/dashboards/explore-view/#aws-observability) by populating metadata and only shows entities with metrics coming in. If you do not see expected entities, make sure configurations are correct to collect and receive metrics including the [CloudWatch Namespace](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation) for CloudFormation Template.
+* Make sure you have access to the Sumo Logic console and as a user that is associated with Sumo Logic role and required role capabilities.
+* [**Role capabilities**](/docs/manage/users-roles/roles/role-capabilities/). Make sure you have a Sumo Logic role that have the following capabilities:
+ * Manage Field Extraction Rules
+ * Manage Connections
+ * View Account Overview
+ * View Fields
+ * View Field Extraction Rules
+ * Manage Content
+ * Manage Collectors
+ * View Collectors
+ * Manage Fields
+ * Manage Monitors
+ * Manage Metrics Rules
+ * View Monitors
+ * Manage Entity Type Configs
+ * Create access keys
+ * [**Sumo Logic Access ID and Key**](/docs/manage/security/access-keys/#create-an-access-key). When you deploy the solution, you’ll need to supply a Sumo Logic Access ID and Access Key, which enable you to use Sumo Logic APIs. Make sure you select default scope and have the role capabilities listed above before generating the Access ID and Key. })
+ :::note
+ For the AWS Observability Solution, you must use the default scope when generating the Access ID and Key; custom scopes are not supported.
+ :::
+* **[Disabled allowlist](/docs/manage/security/create-allowlist-ip-cidr-addresses/) for login and APIs**. During the installation/upgrade of the AWSO solution, the allowlist for login and APIs must remain disabled because the solution creates Lambda functions that uses AWS-managed public network infrastructure. When this Lambda makes outbound calls (such as to Sumo Logic APIs), the traffic is routed through AWS public IP address ranges, which are dynamic and cannot be fixed or predicted.
+* The AWS Observability solution comes with [pre-packaged alerts](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/configure-alerts/) in the form of Sumo Logic Monitors. To understand more about their capabilities, please visit the [Monitors page](/docs/alerts/monitors/).
+* **AWS credentials**. To deploy the solution, you will need to log onto the AWS Console. For the CloudFormation template deployment option, your AWS role must have the permissions described by this [JSON file](https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/AWSObservabilityCFTemplatePermissions.json). As necessary, you may add JSON text to an existing or a new policy associated with an AWS IAM role as described in the [AWS documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-and-attach-iam-policy.html). For Terraform deployment options, see the \*.tmpl files in this folder [aws-observability-terraform/source-module/templates/](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability-terraform/source-module/templates).
+* Set up the [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) and configure the AWS CLI as described in the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) if you would like to use an AWS profile for Terraform script based deployment.
+* For AWS services exporting to CloudWatch Logs, make sure logs are exported to log groups:
+ * RDS - Enable publishing of logs to CloudWatch by following instructions in [Collect Amazon RDS CloudTrail logs](/docs/integrations/amazon-aws/rds/#collect-amazon-rds-cloudwatch-logs).
+ * API Gateway - Enable Access Logs for each respective API by following instructions in Step 3 of [Collect access logs for AWS API Gateway](/docs/integrations/amazon-aws/api-gateway/#collect-aws-api-gateway-access-logs). Make sure you have the following prefix `/aws/apigateway/})
+1. Click **Create Stack.**
+1. Verify that the AWS CloudFormation template has executed successfully in a CREATE_COMPLETE status.
+ * This indicates that you have all the right permissions on both the Sumo Logic and the AWS side to proceed with the installation of the solution.
+ * All the resources (Sumo Logic and AWS) created by template are also deleted.})
+1. If the AWS CloudFormation template has not executed successfully, identify and fix any permission errors till the stack completes with a `CREATE_COMPLETE` status.
+1. Once the AWS CloudFormation stack has executed successfully, delete the AWS CloudFormation Stack.
diff --git a/docs/observability/aws/deploy-use-aws-observability/changelog.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/changelog.md
similarity index 100%
rename from docs/observability/aws/deploy-use-aws-observability/changelog.md
rename to docs/observability/aws/deploy-use-aws-observability/v2.15.0/changelog.md
diff --git a/docs/observability/aws/deploy-use-aws-observability/configure-alerts.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/configure-alerts.md
similarity index 100%
rename from docs/observability/aws/deploy-use-aws-observability/configure-alerts.md
rename to docs/observability/aws/deploy-use-aws-observability/v2.15.0/configure-alerts.md
diff --git a/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/automatic-installation-script.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/automatic-installation-script.md
new file mode 100644
index 00000000000..6400c236813
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/automatic-installation-script.md
@@ -0,0 +1,97 @@
+---
+id: automatic-installation-script
+title: AWS Observability Automatic Installation Script
+sidebar_label: Automatic Installation Script
+description: Sumo Logic provides POSIX and PowerShell scripts to trigger the CloudFormation template for creating a stack to deploy AWS Observability Solution.
+---
+
+Sumo Logic provides [POSIX](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability/scripts/AWSOAutoSetupScript/DeployAWSOPosix.sh) and [PowerShell](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability/scripts/AWSOAutoSetupScript/DeployAWSOWin.ps1) scripts to trigger the CloudFormation template for creating a stack to deploy AWS Observability Solution.
+
+This is a simplified method of deploying AWS Observability using default parameters with just one quick command. Use it for a quick start or when you are happy with the defaults (see [table below](#appendix-i)). For more advanced use cases, when any of the default needs to be adjusted, fall back to [Terraform](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform) or [CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation) installation steps.
+
+:::tip Multi-account and region
+If you need to add support for multiple AWS accounts or multiple regions, refer to the Sumo Logic documentation for [CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation) or [Terraform](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform).
+:::
+
+## Prerequisites
+
+AWS CLI should be pre-installed on the system where the script is supposed to be executed.
+
+* Set up the [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html).
+* [Configure AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) to use AWS profiles.
+* Select/change the enabled [AWS region](https://docs.aws.amazon.com/cli/latest/reference/configure/set.html#examples) where you want to deploy the solution. For example, if you wanted to change your default AWS region to us-west-1:
+ ```
+ aws configure set region us-west-1
+ ```
+
+## Input parameters
+
+The script takes two inputs:
+
+1. **Sumo Logic Access ID** - Provide the Sumo Logic Access ID from your respective Sumo Logic Account where you want to install AWS Observability Solution. See [Access Keys](/docs/manage/security/access-keys) for more information.
+2. **Sumo Logic Access key** - Provide the Sumo Logic Access Key from your respective Sumo Logic Account where you want to install AWS Observability Solution. See [Access Keys](/docs/manage/security/access-keys) for more information.
+
+**AWS_PROFILE** can be set as an environment variable from the command line before executing the script. If it is not set, the “default” aws profile will be used.
+
+
+## CloudFormation parameters
+
+The script above will take only two inputs, the Sumo Logic access ID and Access Key. And internally it will trigger a CloudFormation template. This CloudFormation template requires some additional parameters. But all of these parameters will take the default value. When using this script one cannot override these values. Refer to the table in **Appendix I** for all the parameters and the respective default values which will be used as part of this installation. Learn details about each parameter in detail [here](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation).
+
+
+### PowerShell script command execution
+
+Below is an example to run the PowerShell script with the required parameters.
+
+```
+$uri="https://raw.githubusercontent.com/SumoLogic/sumologic-solution-templates/master/aws-observability/scripts/AWSOAutoSetupScript/DeployAWSOWin.ps1";$path=".\DeployAWSOWin.ps1";(New-Object System.Net.WebClient).DownloadFile($uri, $path);
+.\DeployAWSOWin.ps1 **Important:** Account Aliases should be alphanumeric and cannot include special characters such as “-, $, _” etc.
Leave this blank If you're using CloudFormation StackSets to deploy the solution in multiple AWS accounts. | +| S3 URL of a CSV file that maps AWS Account IDs to an Account Alias | This parameter is applicable only If you're using CloudFormation StackSets to deploy the solution in multiple AWS accounts.
The S3 URL of the CSV file should have public read access when deploying or updating the solution.
Enter the S3 URL of a CSV file which contains the mapping of AWS Account IDs to an Account Alias in the following format:
**accountid,alias**
For example:
**1234567,dev**
**9876543,prod** | + +## Step 4: Install Apps + +Perform the following steps to install apps. + +1. Complete the prerequisites for StackSets as described in the [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html). +1. Install the apps by running the AWS CloudFormation Stack once in any given account and region. Use the configuration below to set up only app dashboards. +1. Install AWS Observability Apps as **Yes**.
})
+1. Select the Sumo Logic Metrics Sources to create as **None**. })
+1. Enable ALB Access logging as **None** and Create Sumo Logic ALB Logs Source as **No**. })
+1. Create Sumo Logic CloudTrail Logs Source as **No**. })
+1. Select Sumo Logic CloudWatch Logs Source as **None**.})
+1. Enable ELB Classic Access logging as **None** and Create Sumo Logic ELB Classic Logs Source as **No**. })
+1. Location where you want the App to be Installed as **Personal Folder**. And for **Do you want to share App with whole organization**, set as **True**.})
+
+## Step 5: Determine account aliases
+
+If you are going to deploy the solution in multiple AWS accounts, we highly recommend that you prepare a CSV file that maps your AWS account IDs to account aliases. These aliases should be something that makes it easy for you to identify what this AWS account is being used for (for example, dev, prod, billing, and marketplace). These names will appear in the Sumo Logic Explorer View, metrics, and logs and can be queried using the “account field”.
+
+The following are examples of the CSV file format to use (`accountid,alias`):
+* `234234234324,dev`
+* `214324324324,prod`
+
+Upload this file to an Amazon S3 bucket and make it accessible to the account from where you are going to run the CloudFormation template.
+
+In case you do not provide a CSV file or if we detect that it does not have the right format, the AWS `account-id` will be used as the alias and this value will be used for the “account” field in Sumo Logic.
+
+### Use the AWS CloudFormation template with StackSets
+
+1. Go to [StackSets](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacksets) in your AWS account.
+1. Click **Create StackSet**.})
+1. Paste the URL `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.15.0/sumologic_observability.master.template.yaml` in the Amazon S3 URL option and click **Next**. If you'd like to download or inspect this or other versions of this template, see the [Changelog](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/changelog/).})
+1. Provide a StackSet Name and supply the values for each of the prompts listed as per instructions in the [Deploy and Use AWS Observability](/docs/observability/aws/deploy-use-aws-observability/v2.15.0) section with the following exception:
+ 1. Leave the field “Alias for AWS Account Identification” blank. })
+ 1. Provide the S3 Object URL of a CSV file that maps AWS Account IDs to an Account Alias in Section 2 of the template “AWS Account Alias”. })
+ 1. Answer **No** in Section 3 of the template "Install AWS Observability Apps". })
+ 1. Click **Next**.
+1. Add Tags, select the Administrator role defined in the prerequisites above, and click **Next**.})
+1. Provide a single AWS account number only and select a list of regions in the account where you would like to deploy the AWS CloudFormation template as shown in the screenshot below. You will need to select all the regions in the current account where you would like to deploy the template.})
+1. Increasing the **Maximum concurrent actions** to be more than 1 is not recommended and can cause your StackSet deployment to fail. Stack sets should be deployed one at a time, sequentially. Click **Next**. })
+1. Review the details, select the capabilities and click **Submit**. })
+1. Once you hit submit, the AWS CloudFormation template will execute in the provided account and regions sequentially.
+
+## Add more accounts to the same StackSet
+
+1. Select **Add new stacks to StackSet**.})
+1. In ‘**Set deployment options**’, Enter the account number and regions you want to deploy the stack. })
+1. Verify the S3 mapping file contains the mapping for the new Account ID.
+1. Review the details, select the capabilities, and click **Submit**.
diff --git a/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/index.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/index.md
new file mode 100644
index 00000000000..1f759661fb8
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/index.md
@@ -0,0 +1,274 @@
+---
+slug: /observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation
+title: Deploy with AWS CloudFormation
+description: Learn about the process of executing the AWS CloudFormation template to set up the AWS Observability Solution for a single AWS region and account combination.
+---
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+This section walks you through the process of executing the AWS CloudFormation template to set up the AWS Observability Solution for a **single AWS region and account** combination.
+
+:::note
+If you are ready to deploy the solution to multiple AWS regions and accounts, see [Deploy to Multiple Accounts and Regions](deploy-multiple-accounts-regions.md).
+:::
+
+:::tip
+Click [here](https://youtu.be/aqngY0lUWUI) to view a microlesson on deploying the AWS Observability Solution with the AWS CloudFormation template.
+:::
+
+## Before you start
+
+:::info
+If you are already collecting AWS metrics, logs, and/or events, we recommend that you override the default settings. By overriding the configuration sources, we prevent them from being re-created in the AWS infrastructure or Sumo Logic.
+:::
+
+If this is the first time you've deployed the AWS Observability Solution, read the [Before You Deploy](../before-you-deploy.md) topic for information about:
+
+* Prerequisites for installing the solution.
+* Things you should keep in mind before you run the CloudFormation template.
+* Instructions for setting up Sumo Logic Host Metric Sources on your EC2 hosts.
+
+## Review required inputs
+
+The sections below describe the configuration prompts in the CloudFormation template and the information you need to supply. Before you start filling out the template, it’s a good idea to review each section to make sure you know which sections you want to fill out, and that you have the information you need to proceed.
+
+AWS Observability integrates with the [AWS Observability view](/docs/dashboards/explore-view/#aws-observability) by populating metadata and only shows entities with metrics coming in. If you do not see expected entities, make sure configurations are correct to collect and receive metrics. For example, metrics for Lambda functions must be coming in for those entities to show in the view. If you do not see Lambda functions, verify the CloudFormation stack is correctly configured including the AWS/Lambda namespace to collect metrics.
+
+`AWS Observability Apps-\+ :::note + Download this or other versions of this template from [Changelog](../changelog.md). + ::: + :::note + - To change the Collector Name and Source Categories of Sumo Logic sources, you must download CloudFormation template version 2.1.0 or greater and follow the instructions in the [Modify the source categories](#modify-the-source-categories) section. + - The Global Intelligence for AWS CloudTrail DevOps app is planned for deprecation in the near future and has therefore been removed from the AWS Observability Solution. With this removal, the app will no longer be backed up or maintained during future solution upgrades. + ::: +1. Select the AWS Region where you want to deploy the AWS CloudFormation template. + :::danger + This step is critical: if you do not select the correct region, you will deploy the solution in the wrong region. + ::: +1. Proceed to [Step 2](#step-2-sumo-logic-access-configuration), below. + +## Step 2: Sumo Logic access configuration + +The table below displays the response for each text box in this section. + +| Prompt | Guideline | +|:--|:--| +| Sumo Logic Deployment Name | Enter au, ca, ch, de, esc, eu, jp, us2, fed, kr, or us1. See [Sumo Logic endpoints by deployment and firewall security](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for more information on Sumo Logic deployments. | +| Sumo Logic Access ID | Sumo Logic Access ID. See [Access Keys](/docs/manage/security/access-keys) for more information. | +| Sumo Logic Access Key | Sumo Logic Access Key. This key is used for Sumo Logic API calls. | +| Sumo Logic Organization ID | You can find your org on the [Preferences](/docs/get-started/account-settings-preferences/#accessing-preferences) page in the Sumo Logic UI. Your org ID will be used to configure the IAM Role for Sumo Logic AWS Sources. | +| Delete Sumo Logic Resources when stack is deleted | To delete collectors, sources, and apps in Sumo Logic when the stack is deleted, set this parameter to "True". If this is set to "False", Sumo Logic resources are not deleted when the AWS CloudFormation stack is deleted. Deletion of updated resources will be skipped. | +| Send telemetry to Sumo Logic | To send solution telemetry to Sumo Logic. This will help to troubleshoot the issues occurring during solution installation. To opt-out, change this to `false`. The default value is `true`. | + +## Step 3: AWS account alias + +The table below displays the response for each text box in this section. + +| Prompt | Guideline | +|:--|:--| +| Alias for your AWS account | Enter an account alias for the AWS environment from which you are collecting data. This alias should be something that makes it easy for you to identify what this AWS account is being used for (for example, dev, prod, billing, and marketplace). This name will appear in metrics and logs, and can be queried via the “account field”.
**Important:** Account Aliases should be alphanumeric and cannot include special characters such as “-, $, _” etc.
Leave this blank If you're using CloudFormation StackSets to deploy the solution in multiple AWS accounts. | +| S3 URL of a CSV file that maps AWS Account IDs to an Account Alias | This parameter is applicable only If you're using CloudFormation StackSets to deploy the solution in multiple AWS accounts.
The S3 URL of the CSV file should have public read access when deploying or updating the solution.
Enter the S3 URL of a CSV file which contains the mapping of AWS Account IDs to an Account Alias in the following format:
**accountid,alias**
For example:
**1234567,dev**
**9876543,prod** | + + +## Step 4: Sumo Logic AWS Observability apps and alerts + +You should only install the AWS Observability apps and alerts the first time you run the template.
The table below displays the response for each text box in this section. + +| Prompt | Guideline | +|:--|:--| +| Install AWS Observability apps and alerts |
- **Yes** - This installs the following:
- AWS EC2, AWS Application Load Balancer, Amazon RDS, AWS API Gateway, AWS Lambda, Amazon DynamoDB, AWS ECS, Amazon ElastiCache, Amazon Classic Load Balancer, AWS NLB, Amazon SNS, and Amazon SQS.
- Alerts for the AWS Observability Solution.
These apps will be installed in the Sumo Logic **AWS Observability Personal** folder, while the alerts will be installed in the Monitors folder. - **No** – Skips the installation of the apps.
- **CloudWatch Metrics Source** - Creates Sumo Logic AWS CloudWatch Metrics Sources.
- **Kinesis Firehose Metrics Source (Recommended)** - Creates a Sumo Logic AWS Kinesis Firehose for Metrics Source.
**Note:** This new source has cost and performance benefits over the CloudWatch Metrics Source is therefore recommended. - **None** - Skips the Installation of both the Sumo Logic Sources.
The default will be AWS/ApplicationELB, AWS/ApiGateway, AWS/DynamoDB, AWS/Lambda, AWS/RDS, AWS/ECS, AWS/ElastiCache, AWS/ELB, AWS/NetworkELB, AWS/SQS, AWS/SNS, and AWS/EC2. You can provide both AWS as well as custom namespaces.
Supported namespaces are based on the type of CloudWatch Metrics Source you have selected above. See the relevant docs for the [AWS Kinesis Firehose for Metrics Source](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source.md) and the [Amazon CloudWatch Source for Metrics](/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudwatch-source-metrics.md) for details on which namespaces they support. | +| Existing Sumo Logic Metrics Source API URL | You must supply this URL if you are already collecting CloudWatch Metrics. Provide the existing Sumo Logic Metrics Source API URL. The account field will be added to the Source. For information on how to determine the URL, see [View or Download Source JSON Configuration](/docs/send-data/use-json-configure-sources/local-configuration-file-management/view-download-source-json-configuration.md).| +| Sumo Logic AWS Metrics Tag Filters | Provide JSON format of the namespaces with its tags values to add filters to your metrics. Use semicolons to separate multiple values for the same tag key. AWS Tag Filters will be added to the Source. See JSON format example: ```json {"AWS/ELB":{"tags":["env=prod;dev"]},"AWS/EC2":{"tags":["env=dev","creator=john"]},"AWS/RDS":{"tags":["env=prod;dev","creator=himan"]},"All":{"tags":["env=dev"]}}``` .
Filters are not supported for custom metrics.| + +## Step 6: Sumo Logic AWS ALB Log Source + +The table below displays the response for each text box in this section. + +| Prompt | Guideline | +|:--|:--| +| Enable ALB Access logging |
- **New** - Automatically enables collection of logs via Amazon S3 when new Application Load Balancers are created. This does not affect ALB resources already collecting logs.
- **Existing** - Enables collection of logs via Amazon S3 for existing Application Load Balancers only.
- **Both** - Enables collection of logs for new and existing Application Load Balancers
- **None** - Does not enable collection of logs for Application Load Balancers
- **Yes** - Creates a Sumo Logic ALB Log Source that collects ALB logs from an existing bucket or a new bucket.
- **No** - Select this if you already have an ALB source configured in Sumo Logic.
- **Yes** - Creates a Sumo Logic CloudTrail Log Source that collects CloudTrail logs from an existing bucket or new bucket.
- **No** - If you already have a CloudTrail Log Source collecting CloudTrail logs.
- **Lambda Log Forwarder** - Creates a Sumo Logic CloudWatch Log Source that collects CloudWatch logs via a Lambda function.
- **Kinesis Firehose Log Source** - Creates a Sumo Logic Kinesis Firehose Source to collect CloudWatch logs.
- **Both** (Switch from Lambda Log Forwarder to Kinesis Firehose Log Source) - Use this option if you would like to switch from using the Lambda Log Forwarder to the new Kinesis Firehose Log Source. If you select this option, the template will subscribe all existing log groups to the new Kinesis Firehose logs Source. To remove the old source please rerun the template by selecting the Kinesis Firehose Log Source in this option. (Check the CloudWatch Logs for Lambda Log groups subscriber which should have a message “All Log Groups are subscribed to Destination Type”.)
- **None** - Skips installation of both sources.
- **New** - Automatically subscribes new AWS Lambda log groups to Lambda, to send logs to Sumo Logic.
- **Existing** - Automatically subscribes existing log groups to Lambda, to send logs to Sumo Logic.
- **Both** - Automatically subscribes new and existing log groups.
- **None** - Skips automatic subscription of log groups.
With default value, log group names matching with lambda or rds will be subscribed and ingesting cloudwatch logs into Sumo Logic.
Enter a regex for matching log group names. For more information, see [Configuring parameters](/docs/send-data/collect-from-other-data-sources/autosubscribe-arn-destination/#configuringparameters) in the *Auto-Subscribe ARN (Amazon Resource Name) Destination* topic. +| Tags for filtering CloudWatch Log Groups | Enter comma separated key value pairs for filtering logGroups using tags. Ex KeyName1=string,KeyName2=string. This is optional leave it blank if tag based filtering is not needed. Visit [Configuring parameters](/docs/send-data/collect-from-other-data-sources/autosubscribe-arn-destination/#configuringparameters). | + + :::note + * Don't use forward slashes (`/`) to encapsulate the regex. While normally they are needed for raw code, it's not necessary here. + * Use regex `.*` for auto-subscribing all log groups. + * CloudTrail must be enabled for EventBridge to capture `CreateLogGroup` events, since these events are recorded and delivered through CloudTrail. + ::: + +## Step 9: Sumo Logic AWS ELB Classic Log Source + +The table below displays the response for each text box in this section. + +| Prompt | Guideline | +|:--|:--| +| Enable ELB Classic Access logging |
- **New** - Automatically enables collection of logs via Amazon S3 when new Classic Load Balancers are created. This does not affect ELB classic resources already collecting logs.
- **Existing** - Enables collection of logs via Amazon S3 for existing Classic Load Balancers only.
- **Both** - Enables collection of logs for new and existing Classic Load Balancers
- **None** - Does not enable collection of logs for Classic Load Balancers
- **Yes** - Creates a Sumo Logic ELB classic Log Source that collects ELB Classic logs from an existing bucket or a new bucket.
- **No** - Select this if you already have an ELB Classic source configured in Sumo Logic.
- **Personal Folder** - Installs app in user's Personal folder.
- **Admin Recommended Folder** - Installs app in Admin Recommended Folder
- **True** - Installed app will have view permission to all members of the organization.
- **False** - Installed app will be visible only to user installing the solution.
})
+1. Click **Create Stack**.
+1. Verify that the AWS CloudFormation template has executed successfully in a CREATE_COMPLETE status. This indicates that all the resources have been created successfully in both Sumo Logic and AWS.
+1. If the AWS CloudFormation template has not run successfully, identify and fix any permission errors till the stack completes with a CREATE_COMPLETE status. See [Troubleshooting](#troubleshooting) for assistance with how to resolve these errors.
+
+## Modify the source categories
+
+The AWS Observability CloudFormation template creates collectors and sources with pre-configured names and source categories. The capability to update the source categories has been added from version v2.1.0 and above.
+
+:::note
+Do not update the source names as created by the CloudFormation template in Sumo Logic. Updating the source name will break the FERs and impact the AWS Observability dashboards.
+:::
+
+Follow the steps below to change the default source categories
+
+1. Download the template version 2.1.0 or later from the [changelog](../changelog.md) page.
+1. Modify the source categories in the `Mappings` section of the CloudFormation template.})
+1. Deploy the CloudFormation template.
+
+## Troubleshooting
+
+While deploying the template, you may receive error messages such as `CREATE_FAILED` status or `ROLLBACK_COMPLETE` status for various reasons. This section provides information on how to troubleshoot such AWS CloudFormation installation failures.
+
+### Determine the cause of a CloudFormation installation failure
+
+This section walks you through the process of troubleshooting an AWS CloudFormation installation failure.
+
+To debug an AWS CloudFormation installation failure, do the following:
+
+1. After the stack rollback is complete and the status is ROLLBACK_COMPLETE, go to the parent stack. In the parent stack, look for the first failure as shown in the following example. The failure can be a direct reason or can point to a nested stack.})
+1. Look for direct reasons for the failure that is available in the parent stack, as shown in the following example.})
+1. To find indirect reasons for the failure, go to the nested stack mentioned in the status reason, as shown in the following example. Take note of the resources mentioned in the reason.})
+1. Select the deleted option to find the nested stacks, as shown in the following example.})
+1. Go to the nested stack and look for the resource mentioned in the previous step to identify the reason, as shown in the following example.})
+
+### Optimize CloudTrail log ingest
+
+By default, the AWS Observability solution collects AWS CloudTrail logs for all AWS services. To reduce ingestion volume, you can define processing rules that limit log collection to only the logs that are relevant to dashboards provided by the AWS Observability solution.
+
+Define the processing rules for the Sumo Logic AWS CloudTrail Source that was created when you ran the CloudFormation template.
+
+For instructions, see [Create a Processing Rule](/docs/send-data/collection/processing-rules/create-processing-rule/). Create the following rules, selecting Include messages that match as the rule type, using these regular expressions:
+
+```
+.*\"eventSource\":\"elasticloadbalancing\.amazonaws\.com\".*
+.*\"eventSource\":\"dynamodb\.amazonaws\.com\".*
+.*\"eventSource\":\"ec2\.amazonaws\.com\".*
+.*\"eventSource\":\"rds\.amazonaws\.com\".*
+.*\"eventSource\":\"lambda\.amazonaws\.com\".*
+.*\"eventSource\":\"apigateway\.amazonaws\.com\".*
+.*\"eventSource\":\"ecs\.amazonaws\.com\".*
+.*\"eventSource\":\"elasticache\.amazonaws\.com\".*
+.*\"eventsource\":\"sns\.amazonaws\.com\".*
+.*\"eventsource\":\"sqs\.amazonaws\.com\".*
+```
+
+### Common errors
+
+Below are some common errors that can occur while using the CloudFormation template.
+
+| Error | Description | Resolution |
+|:--|:--|:--|
+| The API rate limit for this user has been exceeded. | This error indicates that AWS CloudFormation execution has exceeded the API rate limit set on the Sumo Logic side. It can occur if you install the AWS CloudFormation template in multiple regions or accounts using the same Access Key and Access ID. | - Re-deploy the deployment stack without updating the stack in the template. Re-running will detect the drift and create remaining resources. - If the throttling problem persists, try to break down the multi-region deployment into parts and use distinct access IDs and access keys for each part. | +| S3 Bucket already exists. | The error can occur if:
- An S3 bucket with the same name exists in S3, or
- The S3 Bucket is not present in S3 but is referenced by some other AWS CloudFormation stack that created it. | - Remove the S3 bucket from S3 or select “No” in the AWS CloudFormation template for S3 bucket creation.
- Remove the AWS CloudFormation Stack which references the S3 bucket. | +| The S3 bucket you tried to delete is not empty. | The error can occur when deleting the stack with a non-empty S3 bucket. | Delete the S3 bucket manually if you do not need the bucket or its content in the future. | +| Invalid IAM role OR AccessDenied. | This error can occur when Sumo Logic access keys are disabled or do not have the required permissions. | - Refer to [Edit, activate/deactivate, rotate, or delete access keys](/docs/manage/security/access-keys/#edit-activatedeactivate-rotate-or-delete-access-keys) for access keys activation.
- Refer to [Role capabilities](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy/#prerequisites) for permissions related issues. | +| Subscription filters are not applied to newly created log groups. | This error can occur when CloudTrail is not enabled for EventBridge to capture `CreateLogGroup` events. | CloudTrail must be enabled for EventBridge to capture `CreateLogGroup` events, since these events are recorded and delivered through CloudTrail. | +| Access logs are not enabled for the Load Balancer. | This error can occur when CloudTrail is not enabled for EventBridge to capture `CreateLoadBalancer` events. | CloudTrail must be enabled for EventBridge to capture `CreateLoadBalancer` events, since these events are recorded and delivered through CloudTrail. | + +### Rolling back the AWS Observability Solution + +When you roll back the AWS Observability Solution, all the [resources](../resources.md) that were created with the AWS CloudFormation stack are deleted. The resources deleted with a rollback include AWS Observability Solution apps, collectors, sources, S3 buckets, Lambda functions, IAM roles, bucket policy, SNS topic, and SNS subscriptions. + +Rolling back the AWS Observability Solution deletes the main AWS CloudFormation stack, including the nested stack and associated Sumo Logic and AWS resources. The following rollback guidelines apply: + +* Sumo Logic resources are deleted based on the “Delete Sumo Logic Resources when the stack is deleted” flag provided during the AWS CloudFormation configuration. These resources include apps, collectors, and sources. +* AWS resources are deleted by default, regardless of the flag provided. These resources include S3 buckets, Lambda functions, IAM roles, bucket policy, SNS topic, and SNS subscription. + +To uninstall the AWS Observability Solution: + +1. Log in to your AWS account and go to CloudFormation. +1. Select the main stack you want to delete. +1. Select **Delete**.
})
+
+### Remove the account from AWS Observability hierarchy
+
+AWS Observability hierarchy is auto-populated based on the metrics ingested into Sumo Logic with an account tag on the metric source. To remove any AWS account from the AWS Observability hierarchy, you need to remove the data sources ingesting metrics data or remove the account tag from the same metric source. After this, the account will be removed automatically in the next 24 hours. Follow the steps below to remove the account from the AWS Observability hierarchy:
+
+1. Identify the account that you want to remove from the AWS Observability hierarchy. For example, let's assume you want to remove `mobilebankingprod` from the hierarchy.})
+1. Run the required metric query to identify from which source and collector data is being ingested. For this example, enter the metric query below:
+ ```sumo
+ account= mobilebankingprod | count by _collector , _source
+ ```
+ })
+1. Delete the source or remove the account tag from the same metric source. After this, the account will be automatically removed from the AWS Observability hierarchy in the next 24 hours.
+ :::note
+ Removing the account tag will not stop the metrics ingestion.
+ :::
+
+### Redeploying the AWS Observability CloudFormation template with existing Sumo Logic resources from a previous deployment
+
+**Ensure that you delete the Sumo Logic resources completely prior to redeployment.** If you have **Delete Sumo Logic Resources when stack is deleted** set to "True", then the Sumo Logic resources will automatically be removed while deleting the AWS Observability CloudFormation template. If you have **Delete Sumo Logic Resources when stack is deleted** set to "False", then the Sumo Logic resources **will not** be removed while deleting the AWS Observability CloudFormation template. If you do not delete the Sumo Logic resources prior to redeployment (that is, collectors and sources), then subsequent deployments may attempt to use the existing resources, which can result in collection issues. This is not recommended.
diff --git a/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform.md
new file mode 100644
index 00000000000..8f11e286544
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform.md
@@ -0,0 +1,1738 @@
+---
+id: deploy-with-terraform
+title: Deploy with Terraform
+sidebar_label: Deploy with Terraform
+description: Learn how to deploy AWS Observability Solution using Terraform.
+---
+
+These instructions help you deploy our AWS Observability Solution using a Terraform script. For more information about how to use Terraform in your Sumo Logic environment, see [Use Terraform with Sumo Logic](/docs/api/about-apis/terraform-with-sumo-logic).
+
+To set up the AWS Observability solution using Terraform, complete the following steps described in this documentation.
+
+Additional parameter overrides are available in an appendix section for [Source](#override-source-parameters) and [App Content](#override-app-content-parameters).
+
+## Prerequisites
+
+:::info
+If you are already collecting AWS metrics, logs, and/or events, we recommend that you override the default settings. By overriding the configuration sources, we prevent them from being re-created in the AWS infrastructure or Sumo Logic.
+:::
+
+:::note
+
+
+
+
+:::
+
+:::note
+The [Global Intelligence for AWS CloudTrail DevOps](/docs/integrations/amazon-aws/global-intelligence-cloudtrail-devops/) app is planned for deprecation in the near future and has therefore been removed from the AWS Observability Solution. With this removal, the app will no longer be backed up or maintained during future solution upgrades.
+:::
+
+
+For this setup, complete the following:
+
+1. Set up the [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html).
+1. [Configure AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) to use AWS profiles.
+1. To use multiple AWS accounts, [configure AWS account profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) for each AWS account you want to deploy the AWS Observability solution. The [AWS account profile names](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) you create will be used in [Step 3: Determine which AWS Account/Regions to Deploy](#step-3-determine-which-aws-accountregions-to-deploy).
+1. Install [Git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git).
+
+## AWS Observability Solution script
+
+The AWS Observability solution script is organized into the following groups of files and folders:
+
+* Main Configuration file: [main.auto.tfvars](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/main.auto.tfvars)
+* The Resource Creation file [main.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/main.tf) internally invokes two modules:
+ * **app-module**: This module provides a mechanism to set up all the AWS Observability apps and associated content like Fields, Field Extraction Rules, Metric Rules, apps, monitors and the explore hierarchy in your Sumo Logic account.
+ * **source-module**: This module sets up the hosted collector, sources (for logs and metrics) and associated tags to Sumo Logic sources as required for the solution.
+
+:::note
+Using main.tf, only apps can be installed with the "sumo-module" module by keeping the "collection-module" module commented.
+:::
+
+System files:
+
+* [versions.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/versions.tf): Provides the Terraform block that specifies the required provider version and required Terraform version for this configuration. See [Lock and upgrade provider versions](https://learn.hashicorp.com/tutorials/terraform/provider-versioning) for more information.
+* [providers.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/providers.tf): Provides Terraform configurations to declare the providers they require to have Terraform install and use them. See [Providers](https://www.terraform.io/docs/language/providers/index.html) for more information.
+* [variables.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/variables.tf): Provides parameters for a Terraform module, allowing aspects of the module to be customized without altering the module's own source code, and allowing modules to be shared between different configurations. See [Use input variables to add module arguments](https://www.terraform.io/docs/language/values/variables.html) for more information.
+* [output.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/output.tf): Provides specific return values for a Terraform module. See [Use outputs to expose module data](https://www.terraform.io/docs/language/values/outputs.html) for more information.
+* [field.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/field.tf): Creates fields and FERs in the Sumo Logic field schema.
+* [fields.sh](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/fields.sh): This script imports the existing fields and FERs (required by AWS Observability Solution) already present in your Sumo Logic account.
+
+## Step 1: Set up the Terraform environment
+
+Before you run the Terraform script, perform the following actions on a server machine of your choice:
+
+1. Install [Terraform](https://www.terraform.io/) version [1.6.0](https://releases.hashicorp.com/terraform/) or later. To check the installed Terraform version, run the following command:
+ ```bash
+ terraform --version
+ ```
+1. Install the latest version of [curl](https://curl.haxx.se/download.html). To check the installed curl version, run the following command:
+ ```bash
+ curl --version
+ ```
+1. Install [Python](https://www.python.org/) version 3.11 or later.
+1. Install the latest version of [jq](https://github.com/stedolan/jq/wiki/Installation) command-line JSON parser. This is required for running the `fields.sh` batch file. To check the installed jq version, run the following command:
+ ```bash
+ jq --version
+ ```
+1. Install Sumo Logic Python SDK using the following command. Click [here](https://pypi.org/project/sumologic-sdk/) to learn more.
+ ```bash
+ pip install sumologic-sdk
+ ```
+
+## Step 2: Configure the Terraform script
+
+1. Clone the repository https://github.com/SumoLogic/sumologic-solution-templates:
+ ```bash
+ git clone https://github.com/SumoLogic/sumologic-solution-templates
+ ```
+1. Initialize the Terraform working directory by navigating to the directory [sumologic-solution-templates/aws-observability-terraform](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability-terraform) and running:
+ ```bash
+ terraform init
+ ```
+ This will install the required Terraform providers, including [Null](https://www.terraform.io/docs/providers/null/index.html), [Sumo Logic Provider](https://www.terraform.io/docs/providers/sumologic/index.html), [AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs), [Time Provider](https://registry.terraform.io/providers/hashicorp/time/latest/docs), [Random Provider](https://registry.terraform.io/providers/hashicorp/random/latest/docs).
+ :::note
+ Note that templates located at [sumologic-solution-templates/aws-observability-terraform](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability-terraform) directory contain references to files from the [sumologic-solution-templates/aws-observability](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability) directory.
+ :::
+1. Configure the following mandatory parameters in the **main.auto.tfvars** file.
+ * `sumologic_environment`: This input specifies the Sumo Logic deployment that you want to use. Refer to [Sumo Logic endpoints by deployment and firewall security](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for a list of available deployments. Possible values include `au`, `ca`, `ch`, `de`, `esc`, `eu`, `jp`, `us2`, `fed`, `kr`, or `us1`.
+ * `sumologic_access_id`: This input specifies the Sumo Logic access ID that you want to use. For more information on how to obtain an access ID, refer to the [Access Keys](/docs/manage/security/access-keys) documentation.
+ * `sumologic_access_key`: [Sumo Logic Access Key](/docs/manage/security/access-keys) is used for Sumo Logic API calls.
+ * `sumologic_organization_id`: Sumo Logic Organization ID. You can find your organization ID on the [Preferences](/docs/get-started/account-settings-preferences/#my-profile) page in the Sumo Logic UI. Your org ID will be used to configure the IAM Role for Sumo Logic AWS Sources.
+ * `aws_account_alias`: The name/alias for the AWS environment from which you are collecting data. This name will appear in the metrics and and logs. Leave this blank if you are going to deploy the solution in multiple AWS accounts. Do not include special characters in the alias.
+ :::note
+ See the [variables.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/variables.tf) file and [README](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability-terraform#readme) in that folder for configuration information with permissible values for these variables.
+ :::
+1. As part of configuring the AWS Observability solution, we need to [create fields and FERs](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/resources/) in the Sumo Logic org. To import any fields and or FERs that are already present in the Sumo Logic org into our Terraform state, we need to run a script. To do so, navigate to the **sumologic-solution-templates/aws-observability-terraform** folder and do the following:
+ 1. Set the following environment variables using the commands below:
+ ```bash
+ export SUMOLOGIC_ENV="YOUR_SUMOLOGIC_DEPLOYMENT"
+ export SUMOLOGIC_ACCESSID="YOUR_SUMOLOGIC_ACCESS_ID"
+ export SUMOLOGIC_ACCESSKEY="YOUR_SUMOLOGIC_ACCESS_KEY"
+ ```
+ Provide your Sumo Logic deployment for the `SUMOLOGIC_ENV` variable. For example: `au`, `ca`, `ch`, `de`, `esc`, `eu`, `jp`, `us2`, `fed`, `kr`, or `us1`. For more information on Sumo Logic deployments, see [Sumo Logic endpoints by deployment and firewall security](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security).
+ 1. Run fields.sh using this command:
+ ```bash
+ sh fields.sh
+ ```
+
+:::important
+Going forward, do not modify these fields outside of Terraform.
+:::
+
+## Step 3: Determine which AWS Account/Regions to Deploy
+
+You have three options to configure the AWS Account/Region:
+
+* [Option 1: Deploy to a single AWS account and region](#option-1-deploy-to-a-single-aws-account-and-region)
+* [Option 2: Deploy to multiple regions within an AWS account](#option-2-deploy-to-multiple-regions-within-an-aws-account)
+* [Option 3: Deploy to multiple AWS accounts and regions](#option-3-deploy-to-multiple-aws-accounts-and-regions)
+
+This section details how to connect the [AWS account profile(s)](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) you set up in your AWS account(s) in a **providers.tf** file, which will be used to authenticate with your AWS account(s).
+
+### Option 1: Deploy to a single AWS account and region
+
+To deploy the AWS Observability Solution for one AWS account and region combination **based on an AWS account profile defined in the AWS CLI**, configure providers in the **providers.tf** file.
+
+In the **providers.tf** file, create a provider for the AWS region you want to monitor AWS services for. This provider will be associated with a profile from the AWS CLI that is associated with an AWS account.
+
+The Terraform script uses "us-east-1" and the active AWS CLI profile by default. If you want to use a different region or another AWS CLI profile, change the **providers.tf** file as shown in the below. Provide an alias that tells Terraform how to identify this account-region
+combination.
+
+**Task:** Example collection setup for the us-east-2 region and for the production AWS account profile.
+
+```bash title="Collection Set Up"
+# Region us-east-2, for AWS Account profile production
+provider "aws" {
+ profile = "production"
+ region = "us-east-2"
+ alias = "production-us-east-2"
+}
+```
+
+### Option 2: Deploy to multiple regions within an AWS account
+
+Use this option to install the AWS Observability Solution for multiple regions within a given AWS account. To do so, add providers for each AWS region in the **providers.tf** as shown below.
+
+#### Provide alias for account-region
+Given that we have multiple providers, we need to provide an alias that tells Terraform how to identify each account-region combination.
+
+1. Comment out the existing provider information in **providers.tf**.
+
+ ```bash title="Comment out using #"
+ #provider "aws" {
+ # region = "us-east-1"
+ #
+ # Below properties should be added when you would like to onboard more than one region and account
+ # More Information regarding AWS Profile can be found at -
+ #
+ # Access configuration
+ #
+ # profile = +If you've previously set up our AWS Observability Solution with CloudFormation and want to move to Terraform, we recommend following these instructions (click to expand). +
+ +1. Start with an existing AWS account and region combination (preferably a non-production dev/test account), delete the AWS Observability CloudFormation stack associated with it, then on-board that account-region combination using Terraform scripts. +1. Once you confirm that the solution has been deployed successfully, you can then repeat the process for additional AWS accounts and regions. +1. By default, the **AWS Observability Apps** folder will be available in the personal library and will be shared with the Sumo Logic org of the user that the Sumo Logic access keys belong to. ++1. Get Hierarchy-id list of existing hierarchies and keep it noted. Learn [more](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security) for apiendpoint.
+ ```sumo + curl -s -H 'Content-Type: application/json' --user
+ ```sumo + curl -s -H 'Content-Type: application/json' --user
Refer to the [`admin_mode` module](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs#authentication). + +### Invalid function argument +#### Error Message + +``` +Error: Invalid function argument +on.terraform/modules/sumo-module.overview_app.overview_module/sumologic/sumologic.tf line 67, in resource "sumologic_content" "SumoLogicApps": +67: config = file(each.value.content_json) +``` +#### Solution +Verify app [JSON location](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability/json) and align your custom terraform script accordingly. + +### Error creating Serverless Application Repository CloudFormation Stack + +#### Error Message + +While upgrading AWS Observability Solution (Terraform), upgrade failed with the following error. + +`Error: error creating Serverless Application Repository CloudFormation Stack (arn:aws:cloudformation:us-east-1:XXXXXXXXX:stack/serverlessrepo-serverless-hello-world-test/7a6ef230-35a6-11zb-98ff-0ab512dce13f) change set: unexpected state 'FAILED', wanted target 'CREATE_COMPLETE'. last error: %!s()` + +Resource `aws_serverlessapplicationrepository_cloudformation_stack` is not able to store values of `var.auto_enable_access_logs` (as specified in our code). On each subsequent terraform apply resource detects it as change and creates a new stack-set. When the AWS API is called with a new stack-set it fails abruptly which causes the whole solution to fail while upgrading. + +#### Solution + +:::info +For time being, consider the procedure listed below to rectify the error. This error has already [reported](https://github.com/hashicorp/terraform-provider-aws/issues/23874) to AWS. +::: + +Navigate to the location where you have installed the AWS Observability Terraform solution and replace the existing code with the new code given below. + +1. Go to `cd .terraform/modules/collection-module.classic_lb_module/aws/elasticloadbalancing/elb.tf` +2. Replace the code with the code give below. + ```sumo + resource "aws_serverlessapplicationrepository_cloudformation_stack" "auto_enable_access_logs" { + for_each = toset(local.auto_enable_access_logs ? ["auto_enable_access_logs"] : []) + + name = "Auto-Enable-Access-Logs-${var.auto_enable_access_logs_options.auto_enable_logging}-${random_string.aws_random.id}" + application_id = "arn:aws:serverlessrepo:us-east-1:956882708938:applications/sumologic-s3-logging-auto-enable" + semantic_version = var.app_semantic_version + capabilities = data.aws_serverlessapplicationrepository_application.app.required_capabilities + parameters = { + BucketName = local.bucket_name + BucketPrefix = var.auto_enable_access_logs_options.bucket_prefix + AutoEnableLogging = var.auto_enable_access_logs_options.auto_enable_logging + AutoEnableResourceOptions = var.auto_enable_access_logs + FilterExpression = var.auto_enable_access_logs_options.filter + RemoveOnDeleteStack = var.auto_enable_access_logs_options.remove_on_delete_stack + } + lifecycle { + ignore_changes = [ + parameters,tags + ] + } + } + ``` +3. Go to `cd .terraform/modules/collection-module.elb_module/aws/elb/elb.tf` +4. Replace the code with the code provided below. + ```sumo + resource "aws_serverlessapplicationrepository_cloudformation_stack" "auto_enable_access_logs" { + for_each = toset(local.auto_enable_access_logs ? ["auto_enable_access_logs"] : []) + + name = "Auto-Enable-Access-Logs-Elb-${random_string.aws_random.id}" + application_id = "arn:aws:serverlessrepo:us-east-1:956882708938:applications/sumologic-s3-logging-auto-enable" + semantic_version = "1.0.2" + capabilities = data.aws_serverlessapplicationrepository_application.app.required_capabilities + parameters = { + BucketName = local.bucket_name + BucketPrefix = "elasticloadbalancing" + AutoEnableLogging = "ALB" + AutoEnableResourceOptions = var.auto_enable_access_logs + FilterExpression = var.auto_enable_access_logs_options.filter + RemoveOnDeleteStack = var.auto_enable_access_logs_options.remove_on_delete_stack + } + lifecycle { + ignore_changes = [ + parameters,tags + ] + } + } +``` diff --git a/docs/observability/aws/deploy-use-aws-observability/v2.15.0/index.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/index.md new file mode 100644 index 00000000000..9591ec72b2e --- /dev/null +++ b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/index.md @@ -0,0 +1,94 @@ +--- +slug: /observability/aws/deploy-use-aws-observability/v2.15.0 +title: Deploy and Use AWS Observability v2.15.0 +sidebar_label: v2.15.0 +description: Learn about Sumo Logic's AWS Observability Solution, how to deploy it, and how to get started with it. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; +import Iframe from 'react-iframe'; + +AWS Observability Solution is a framework to simplify the monitoring and troubleshooting of your AWS cloud infrastructure. You can use the Sumo Logic observability app dashboards to isolate and solve problems faster. + +These topics have information about Sumo Logic's AWS Observability Solution, how to deploy it, and how to get started with it. + +import DocCardList from '@theme/DocCardList'; +import {useCurrentSidebarCategory} from '@docusaurus/theme-common'; + +:::training Micro Lesson + +Watch a micro lesson on deploying the AWS Observability Solution. + + + +::: + + +In this section, we'll introduce the following concepts: + +
+
\ No newline at end of file
diff --git a/docs/observability/aws/deploy-use-aws-observability/v2.15.0/migration-strategy-using-terraform.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/migration-strategy-using-terraform.md
new file mode 100644
index 00000000000..5694af5c462
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/migration-strategy-using-terraform.md
@@ -0,0 +1,109 @@
+---
+id: migration-strategy-using-terraform
+title: Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform
+sidebar_label: Migration Strategy using Terraform
+description: Learn how to migrate CloudWatch Source to Kinesis Firehose Source using Terraform.
+---
+
+This document will help you to migrate CloudWatch Source to Kinesis Firehose Source using Terraform. There are two approaches which you can follow for the migration. Refer to [AWS Kinesis Firehose for Logs Source](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source/) and [AWS Kinesis Firehose for Metrics Source](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source/) to learn about the migration benefits.
+
+## Approach 1: Enable forwarding of data to Sumo Logic using Kinesis Firehose for the Log and Metrics source
+
+1. Add a **new-collection-module** where only logs and metrics collection is enabled.
+1. Disable all other collections in this block.
+1. Run `terraform init` and `terraform apply`.
+ ```sumo
+ module "new-collection-module" {
+ source = "./source-module"
+
+ aws_account_alias = var.aws_account_alias
+ sumologic_organization_id = var.sumologic_organization_id
+ access_id = var.sumologic_access_id
+ access_key = var.sumologic_access_key
+ environment = var.sumologic_environment
+ sumologic_collector_details = {
+ "collector_name": "AWS Observability Prod",
+ "description": "This collector is created using Sumo Logic terraform AWS Observability module.",
+ "fields": {}
+ }
+ collect_cloudwatch_logs = "Kinesis Firehose Log Source"
+ collect_cloudwatch_metrics = "Kinesis Firehose Metrics Source"
+ collect_cloudtrail_logs = "false"
+ collect_classic_lb_logs = "false"
+ collect_elb_logs = "false"
+ }
+ ```
+1. Verify the following:
+ 1. Log group and metrics subscription.
+ 1. Logs and metrics ingested into Sumo Logic via Kinesis Firehose sources.
+1. Once verified, delete the old CloudWatch log sources (HTTP) and metrics sources with other associated resources like Lambdas, subscription, and more.
+ 1. Disable logs and metrics collection in the original collection block and run `terraform apply` again to clean up the redundant resources.
+ ```sumo
+ module "old-collection-module" {
+ source = "./source-module"
+
+ aws_account_alias = var.aws_account_alias
+ sumologic_organization_id = var.sumologic_organization_id
+ access_id = var.sumologic_access_id
+ access_key = var.sumologic_access_key
+ environment = var.sumologic_environment
+ collect_cloudwatch_logs = "None"
+ collect_cloudwatch_metrics = "None"
+ }
+ ```
+
+:::note
+This approach will create an additional collector with Kinesis logs and metrics sources.
+:::
+
+### Advantages
+
+- No loss of logs and metrics during migration.
+
+### Disadvantages
+
+- Duplicate logs and metrics will be ingested.
+
+## Approach 2: Update existing collection module
+
+1. Update `collect_cloudwatch_logs` from **Lambda Log Forwarder** to **Kinesis Firehose Log Source**.
+1. Update `collect_cloudwatch_metrics` from **CloudWatch Metrics Source** to **Kinesis Firehose Metrics Source**.
+ ```sumo
+ collect_cloudwatch_logs = "Kinesis Firehose Log Source"
+ collect_cloudwatch_metrics = "Kinesis Firehose Metrics Source"
+ ```
+1. Run `terraform apply`.
+ - Forwarding of logs and metrics will start to Sumo Logic using Kinesis Firehose for Logs and Kinesis Firehose for Metrics.
+ - Old CloudWatch log source (HTTP) and metrics source along with other associated resources such as Lambdas, subscription, and more will also be deleted.
+
+### Advantages
+
+- No ingestion of duplicate logs and metrics.
+
+### Disadvantages
+
+- Logs and metrics will be lost during migration.
+
+## Troubleshooting
+
+### Error
+
+`A resource with the same name already exists`
+
+### Cause
+
+When you try to migrate CloudWatch Source to Kinesis Firehose Source using [Approach 2](#approach-2-update-existing-collection-module), migration will fail. This is because Terraform tries to create a Kinesis source with the same name before deleting the existing CloudWatch Source.
+
+### Solution
+
+1. Run `terraform apply` again to create a Kinesis Firehose log source.
+1. Wait until the migration gets completed.
+1. Verify your subscription and log + metrics ingestion into Sumo Logic.
+
+### Error
+
+`Error: error creating Serverless Application Repository CloudFormation Stack (arn:aws:cloudformation:us-east-1:XXXXXXXXX:stack/serverlessrepo-serverless-hello-world-test/7a6ef230-35a6-11zb-98ff-0ab512dce13f) change set: unexpected state 'FAILED', wanted target 'CREATE_COMPLETE'. last error: %!s()`
+
+### Solution
+
+To resolve this issue, refer to [Creating Serverless Application Repository CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform/#troubleshooting).
diff --git a/docs/observability/aws/deploy-use-aws-observability/v2.15.0/resources.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/resources.md
new file mode 100644
index 00000000000..e615dc152da
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/resources.md
@@ -0,0 +1,333 @@
+---
+id: resources
+title: AWS Observability Resources
+sidebar_label: Resources
+description: Learn more about AWS Observability resources created and modified at deployment using Terraform and CloudFormation.
+---
+
+
+The CloudFormation template creates a number of resources at deployment in AWS and Sumo Logic. You will use the template when setting up the solution. See [Before You Deploy](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy) for prerequisites and instructions to configure.
+
+For more information on the solution and features, see [About Sumo Logic AWS Observability](/docs/observability/aws/about).
+
+
+## Resources created in AWS
+
+Executing the Terraform script and the AWS CloudFormation template creates or modifies the following resources in the AWS account if you are not already collecting data from those AWS services. If you are, the AWS CloudFormation template will simply integrate with your existing collector sources.
+
+In the table below, the "Applicable AWS Observability Dashboards" column lists the app dashboards that make use of the data source in the "AWS Data Source" column.
+
+
+
+
+
+Before You Deploy
+Learn prerequisites and guidelines for deploying the AWS Observability Solution to a single AWS account and region.
+
+
+
+
+Deploy with AWS CloudFormation
+Learn about the process of executing the AWS CloudFormation template to set up the AWS Observability Solution for a single AWS region and account combination.
+
+
+
+
+Deploy with Terraform
+Learn how to deploy AWS Observability Solution using Terraform.
+
+
+
+
+Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform
+Learn how to migrate CloudWatch Source to Kinesis Firehose Source using Terraform.
+
+
+
+
+View AWS Observability Solution Dashboards
+Learn how to navigate your AWS Observability infrastructure, as well as provide links to the app dashboards.
+
+
+
+
+Configure AWS Observability Alerts
+Sumo Logic has provided out-of-the-box alerts to help you quickly determine if a particular AWS service is available and performing as expected.
+
+
+
+
+Update the AWS Observability Stack
+Learn how to update the AWS Observability stack.
+
+
+
+
+AWS Observability Resources
+Learn more about AWS Observability resources created and modified at deployment using Terraform and CloudFormation.
+
+
+
+
+AWS Observability Terraform script and CloudFormation Changelog
+This section provides details on the available versions of the AWS Observability CloudFormation template.
+| AWS Data Source | +AWS Resources Created | +Applicable AWS Observability Dashboards | +
| AWS CloudTrail Logs | +S3 Bucket +SNS Topic +AWS Trail +SNS Subscription +AWS Lambda +IAM Roles |
+ AWS API Gateway +AWS Lambda +Amazon DynamoDB +Amazon RDS +Amazon ECS +Amazon ElastiCache +Amazon SNS +Amazon SQS +AWS EC2 |
+
| Amazon CloudWatch Metrics Source |
+ IAM Roles | +AWS API Gateway +Amazon DynamoDB +AWS Application Load Balancer +Amazon RDS +Amazon ECS +Amazon ElastiCache +AWS Network Load Balancer +Amazon SNS +Amazon SQS +Amazon EC2 |
+
| Amazon Kinesis Firehose Metric Source | +Kinesis Firehose +CloudWatch Metrics Stream |
+ AWS API Gateway +AWS Lambda +Amazon DynamoDB +AWS Application Load Balancer +Amazon RDS +Amazon ECS +Amazon ElastiCache +AWS Network Load Balancer +Amazon SNS +Amazon SQS +AWS EC2 |
+
| Amazon Application Load Balancer logs | +S3 Bucket +SNS Topic +SNS Subscription +AWS Lambda +IAM Role |
+ AWS Application Load Balancer | +
| Lambda Log Forwarder (AWS CloudWatch logs) | +AWS Lambda IAM Roles |
+ AWS Lambda | +
| Kinesis Firehose Log source (AWS CloudWatch logs) | +Kinesis Firehose S3 Bucket* |
+ AWS Lambda | +
| AWS Classic Load Balancer Logs | +S3 Bucket +SNS Topic +SNS Subscription +AWS Lambda +IAM Role |
+ AWS Classic Load Balancer | +
| Source | +Metadata tags applied | +Common fields created via FERs | +
| CloudWatch Metrics | +Account | +Not Applicable | +
| Host Metrics | +Account, Namespace | +Not Applicable | +
| CloudTrail Logs | +Account | +Account ID, Region, Namespace | +
| CloudWatch Logs | +Account, Account ID, Region | +Namespace | +
| Load Balancer Access Logs | +Account, Account ID, Region | +Namespace | +
| Resource | +CF Name | +TF Name | +
| App folder | +AWS Observability-<Version> <Date of installation> | +AWS Observability Apps | +
| Alerts | +AWS Observability <Version> <Date and Time of Installation> | +AWS Observability Monitors | +
| Hosted Collector | +aws-observability-<AccountAlias>-<AccountID> | +AWS Observability <AccountAlias> <AccountID> | +
| Field Extraction Rule | +AwsObservabilityAlbAccessLogsFER +AwsObservabilityApiGatewayAccessLogsFER +AwsObservabilityApiGatewayCloudTrailLogsFER +AwsObservabilityDynamoDBCloudTrailLogsFER +AwsObservabilityEC2CloudTrailLogsFER +AwsObservabilityECSCloudTrailLogsFER +AwsObservabilityElastiCacheCloudTrailLogsFER +AwsObservabilityElbAccessLogsFER +AwsObservabilityFieldExtractionRule +AwsObservabilityGenericCloudWatchLogsFER +AwsObservabilityLambdaCloudWatchLogsFER +AwsObservabilityRdsCloudTrailLogsFER +AwsObservabilitySNSCloudTrailLogsFER +AwsObservabilitySQSCloudTrailLogsFER |
+ AwsObservabilityAlbAccessLogsFER +AwsObservabilityApiGatewayAccessLogsFER +AwsObservabilityApiGatewayCloudTrailLogsFER +AwsObservabilityDynamoDBCloudTrailLogsFER +AwsObservabilityEC2CloudTrailLogsFER +AwsObservabilityECSCloudTrailLogsFER +AwsObservabilityElastiCacheCloudTrailLogsFER +AwsObservabilityElbAccessLogsFER +AwsObservabilityFieldExtractionRule +AwsObservabilityGenericCloudWatchLogsFER +AwsObservabilityLambdaCloudWatchLogsFER +AwsObservabilityRdsCloudTrailLogsFER +AwsObservabilitySNSCloudTrailLogsFER +AwsObservabilitySQSCloudTrailLogsFER |
+
| Explorer View | +AWS Observability | +AWS Observability | +
| Metric Rules | +AwsObservabilityApiGatewayApiNameMetricsEntityRule +AwsObservabilityRDSClusterMetricsEntityRule +AwsObservabilityRDSInstanceMetricsEntityRule +AwsObservabilityNLBMetricsEntityRule |
+ AwsObservabilityApiGatewayApiNameMetricsEntityRule +AwsObservabilityRDSClusterMetricsEntityRule +AwsObservabilityRDSInstanceMetricsEntityRule +AwsObservabilityNLBMetricsEntityRule |
+
| CloudTrail source | +cloudtrail-logs-<AWS::Region> | +CloudTrail Logs <AWS::Region> | +
| CloudWatch logs (HTTP) source | +cloudwatch-logs-<AWS::Region> | +CloudWatch Logs <AWS::Region> | +
| Kinesis Firehose for Metrics | +cloudwatch-metrics-<AWS::Region> | +CloudWatch Metrics <AWS::Region> | +
| CloudWatch Metrics source | +cloudwatch-metrics-<AWS::Region>-ApplicationELB +cloudwatch-metrics-<AWS::Region>-ApiGateway +cloudwatch-metrics-<AWS::Region>-DynamoDB +cloudwatch-metrics-<AWS::Region>-Lambda +cloudwatch-metrics-<AWS::Region>-EC2 +cloudwatch-metrics-<AWS::Region>-ELB +cloudwatch-metrics-<AWS::Region>-RDS +cloudwatch-metrics-<AWS::Region>-ECS +cloudwatch-metrics-<AWS::Region>-NetworkELB +cloudwatch-metrics-<AWS::Region>-ElastiCache +cloudwatch-metrics-<AWS::Region>-SQS +cloudwatch-metrics-<AWS::Region>-SNS |
+ CloudWatch Metrics <AWS::Region> <AWS Service name> | +
| Amazon S3 Alb log source | +alb-logs-<AWS::Region> | +Elb Logs <AWS::Region> | +
| Amazon S3 Classic Load Balancer log source | +classic-lb-logs-<AWS::Region> | +Classic lb Logs <AWS::Region> | +
| Kinesis Firehose for Logs | +kinesis-firehose-cloudwatch-logs-<AWS::Region> | +CloudWatch Logs <AWS::Region> | +
| S3 Bucket Name | +aws-observability-logs-<UniqueKey> | +aws-observability-logs-<UniqueKey> | +
| Fields | +account +accountid +apiid +apiname +cacheclusterid +clustername +dbclusteridentifier +dbidentifier +dbinstanceidentifier +functionname +instanceid +loadbalancer +loadbalancername +namespace +networkloadbalancer +region +tablename +topicname +queuename |
+ account +accountid +apiid +apiname +cacheclusterid +clustername +dbclusteridentifier +dbidentifier +dbinstanceidentifier +functionname +instanceid +loadbalancer +loadbalancername +namespace +networkloadbalancer +region +tablename +topicname +queuename |
+
})
+1. Select **Replace Current Template**, paste the URL `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.15.0/sumologic_observability.master.template.yaml` in the Amazon S3 URL option, and then select **Next**.
+ :::note
+ If you would like to download or inspect this or other versions of this template, visit the [Changelog](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/changelog/) page.
+ :::
+ })
+1. Keep parameters that you selected before when you created the stack and click **Next**.
+1. Review all the changes listed on the **Change Set Review** and make sure you're comfortable with these changes.
+1. Select the capabilities and Click **Submit**. })
+1. After the update is complete, the stacks that have been updated successfully will be set to a `UPDATE_COMPLETE` status.
diff --git a/docs/observability/aws/deploy-use-aws-observability/view-dashboards.md b/docs/observability/aws/deploy-use-aws-observability/v2.15.0/view-dashboards.md
similarity index 100%
rename from docs/observability/aws/deploy-use-aws-observability/view-dashboards.md
rename to docs/observability/aws/deploy-use-aws-observability/v2.15.0/view-dashboards.md
diff --git a/docs/observability/aws/deploy-use-aws-observability/before-you-deploy.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy.md
similarity index 95%
rename from docs/observability/aws/deploy-use-aws-observability/before-you-deploy.md
rename to docs/observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy.md
index 658e4922a02..dee5ed21160 100644
--- a/docs/observability/aws/deploy-use-aws-observability/before-you-deploy.md
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy.md
@@ -15,7 +15,7 @@ If you are already collecting AWS metrics, logs, and/or events, we recommend tha
## Prerequisites
-* **Sumo Logic Metrics**. The AWS Observability Solution leverages both logs and metrics to provide comprehensive monitoring and troubleshooting of your AWS cloud infrastructure. If you do not already have Metrics, contact your Sumo Logic account representative. AWS Observability integrates with the [AWS Observability view](/docs/dashboards/explore-view/#aws-observability) by populating metadata and only shows entities with metrics coming in. If you do not see expected entities, make sure configurations are correct to collect and receive metrics including the [CloudWatch Namespace](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation) for CloudFormation Template.
+* **Sumo Logic Metrics**. The AWS Observability Solution leverages both logs and metrics to provide comprehensive monitoring and troubleshooting of your AWS cloud infrastructure. If you do not already have Metrics, contact your Sumo Logic account representative. AWS Observability integrates with the [AWS Observability view](/docs/dashboards/explore-view/#aws-observability) by populating metadata and only shows entities with metrics coming in. If you do not see expected entities, make sure configurations are correct to collect and receive metrics including the [CloudWatch Namespace](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation) for CloudFormation Template.
* Make sure you have access to the Sumo Logic console and as a user that is associated with Sumo Logic role and required role capabilities.
* [**Role capabilities**](/docs/manage/users-roles/roles/role-capabilities/). Make sure you have a Sumo Logic role that have the following capabilities:
* Manage Field Extraction Rules
@@ -37,7 +37,7 @@ If you are already collecting AWS metrics, logs, and/or events, we recommend tha
For the AWS Observability Solution, you must use the default scope when generating the Access ID and Key; custom scopes are not supported.
:::
* **[Disabled allowlist](/docs/manage/security/create-allowlist-ip-cidr-addresses/) for login and APIs**. During the installation/upgrade of the AWSO solution, the allowlist for login and APIs must remain disabled because the solution creates Lambda functions that uses AWS-managed public network infrastructure. When this Lambda makes outbound calls (such as to Sumo Logic APIs), the traffic is routed through AWS public IP address ranges, which are dynamic and cannot be fixed or predicted.
-* The AWS Observability solution comes with [pre-packaged alerts](/docs/observability/aws/deploy-use-aws-observability/configure-alerts/) in the form of Sumo Logic Monitors. To understand more about their capabilities, please visit the [Monitors page](/docs/alerts/monitors/).
+* The AWS Observability solution comes with [pre-packaged alerts](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/configure-alerts/) in the form of Sumo Logic Monitors. To understand more about their capabilities, please visit the [Monitors page](/docs/alerts/monitors/).
* **AWS credentials**. To deploy the solution, you will need to log onto the AWS Console. For the CloudFormation template deployment option, your AWS role must have the permissions described by this [JSON file](https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/AWSObservabilityCFTemplatePermissions.json). As necessary, you may add JSON text to an existing or a new policy associated with an AWS IAM role as described in the [AWS documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-and-attach-iam-policy.html). For Terraform deployment options, see the \*.tmpl files in this folder [aws-observability-terraform/source-module/templates/](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability-terraform/source-module/templates).
* Set up the [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) and configure the AWS CLI as described in the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) if you would like to use an AWS profile for Terraform script based deployment.
* For AWS services exporting to CloudWatch Logs, make sure logs are exported to log groups:
@@ -52,11 +52,11 @@ If you are already collecting AWS metrics, logs, and/or events, we recommend tha
You can deploy AWS Observability to a single AWS account and region, or to all of your accounts in all regions. We provide instructions for both alternatives.
-Typically you would first deploy the solution to a single AWS account and region, kick the tires, and then expand the deployment. See [Deploy and Use AWS Observability](/docs/observability/aws/deploy-use-aws-observability) for a limited deployment. [See Deploy to Multiple Accounts and Regions](deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md) for a broader deployment.
+Typically you would first deploy the solution to a single AWS account and region, kick the tires, and then expand the deployment. See [Deploy and Use AWS Observability](/docs/observability/aws/deploy-use-aws-observability/v3.0.0) for a limited deployment. [See Deploy to Multiple Accounts and Regions](deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md) for a broader deployment.
You have two options for deploying:
-* Deploy using an [AWS CloudFormation template](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation)
+* Deploy using an [AWS CloudFormation template](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation)
* Deploy using a [Terraform Script](deploy-with-terraform.md)
The Sumo Logic AWS Observability solution supports the following AWS regions:
@@ -137,7 +137,7 @@ Perform these steps for each EC2 host.
A default Scan Interval of 1 minute is recommended. You can set it to a higher or lower interval as needed. Faster intervals may result in increased consumption cost.
:::
-To automate the above, see [Add Fields to Existing Host Metrics Sources](../other-configurations-tools/add-fields-to-existing-host-metrics-sources.md).
+To automate the above, see [Add Fields to Existing Host Metrics Sources](../../other-configurations-tools/add-fields-to-existing-host-metrics-sources.md).
Going forward, you can also build your EC2 AMI machine image with these fields and settings. For instructions, see [this blog](https://www.sumologic.com/blog/packer-and-sumo-logic).
diff --git a/docs/observability/aws/deploy-use-aws-observability/v3.0.0/changelog.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/changelog.md
new file mode 100644
index 00000000000..2fa61dfb4fc
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/changelog.md
@@ -0,0 +1,345 @@
+---
+id: changelog
+title: AWS Observability Terraform script and CloudFormation Changelog
+sidebar_label: Changelog
+description: This section provides details on the available versions of the AWS Observability CloudFormation template.
+---
+
+This section provides details on the available versions of the AWS Observability Terraform script and CloudFormation template. The details also include all AWS and Sumo Logic resources that will be updated, as well as the bugs encountered when upgrading the existing version of the Terraform script or CloudFormation template to the latest version. For more information about how to use Terraform in your Sumo Logic environment, see [Use Terraform with Sumo Logic](/docs/api/about-apis/terraform-with-sumo-logic).
+
+To install or upgrade to the required version of the CloudFormation template, use the Amazon S3 URL for the YAML file corresponding to the correct version number in the AWS CloudFormation section of the AWS Management Console. See [Create a stack from the CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) for more information.
+
+### AWSO lifecycle
+
+| Release (AWSO) | Release Date | Active Support | Additional Notes |
+|:--|:---------------|:--|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 2.15.0 | 28th May, 2026 | Yes | AWSO deployment is not supported in the AWS European Sovereign Cloud and Sumo Logic ESC environments due to the unavailability of the Serverless Application Repository. |
+| 2.14.0 | 14th Apr, 2026 | Yes | AWSO is not supported in the AWS Zurich region, as the Serverless Application Repository is not available there. |
+| 2.13.0 | 7th Oct, 2025 | Yes | |
+| 2.12.0 | 1st Apr, 2025 | Yes | |
+| 2.11.0 | 24th Jan, 2025 | No - Ends on 1st May, 2026 | AWS Lambda runtime Node.js 20.x will be deprecated by AWS ([Lambda Runtimes Documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html)) on 30th Apr, 2025 |
+| 2.10.0 | 4th Sep, 2024 | No - Ends on 1st May, 2026 | AWS Lambda runtime Node.js 20.x will be deprecated by AWS ([Lambda Runtimes Documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html)) on 30th Apr, 2025 |
+| 2.9.0 | 2nd Aug, 2024 | No - Ends on 1st May, 2026 | AWS Lambda runtime Node.js 20.x will be deprecated by AWS ([Lambda Runtimes Documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html)) on 30th Apr, 2025 |
+| 2.8.0 or Less | 17th May, 2024 | No | AWS Lambda runtime Node.js 18.x was deprecated by AWS ([Lambda Runtimes Documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-deprecated)) |
+
+
+## v2.15.0, 28-May-2026
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.15.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+Updates:
+* Updated Apps queries.
+* Addressed CVEs.
+* Upgraded Lambda runtimes to Node.js v24.x and Python 3.14 from Node.js v22.x and Python 3.13.
+* Upgraded SAM app versions:
+ - sumologic-app-utils → 2.0.23
+ - sumologic-s3-logging-auto-enable → 1.0.19
+ - sumologic-loggroup-connector → v1.0.16
+
+Deprecation:
+* AWS Observability Solution versions that rely on deprecated AWS Lambda runtimes are also considered deprecated. Since Node.js 20.x was deprecated on April 30, 2026, all AWS Observability versions up to and including 2.11.0 are now deprecated.
+[Lambda Runtimes Documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-deprecated)
+
+## v2.14.0, 14-April-2026
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.14.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+New Features:
+* AWS Observability solution now supports Sumo Logic Zurich deployment.
+
+Updates:
+* Updated and enhanced 9 AWS-related apps:
+ * AWS API Gateway
+ * AWS Application Load Balancer
+ * AWS Classic Load Balancer
+ * AWS Network Load Balancer
+ * Amazon EC2
+ * Amazon ElastiCache
+ * Amazon RDS
+ * Amazon SNS
+ * AWS Lambda
+* Updated FERs for Load Balancer (ALB, NLB).
+
+## v2.13.0, 07-Oct-2025
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.13.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+New Features:
+* Added tag support for AWS resources created with Terraform-based AWS Observability (AWSO) Solution.
+
+Updates:
+* Enhanced feature for installing apps in the Admin Recommended folder and sharing them.
+* Integrated updated EC2, Lambda, and RDS apps with AWSO Solution.
+* Upgraded AWS provider version to support `>= 5.16.2, < 7.0.0`.
+* Updated Terraform minimum required version to 1.5.7.
+* Addressed CVEs identified in Python and Go modules.
+* Upgraded SAM app versions:
+ - sumologic-app-utils → 2.0.21
+ - sumologic-s3-logging-auto-enable → 1.0.18
+
+Deprecation:
+* The Global Intelligence for AWS CloudTrail DevOps app is scheduled for deprecation in the near future and, as a result, has been removed from the AWS Observability Solution.
+* AWS Observability Solution versions that rely on deprecated AWS Lambda runtimes are also considered deprecated. Since Nodejs18.x was deprecated on September 1st, 2025, all AWS Observability versions up to and including 2.8.0 are now deprecated.
+
+## v2.12.0, 01-Apr-2025
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.12.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+Updates:
+* Updated the SAM Lambda runtime from Node.js v20.x to v22.x.
+* Updated the Lambda runtime to Node.js v22.x in the CloudFormation template for `AWS CloudWatch Logs with Dead Letter Queue Support`.
+* Updated the SecurityHub SAM Lambda runtime from Python v3.11 to v3.13.
+* Discontinued support for Mumbai deployment.
+* Updated Lambda runtime to Python v3.13 in the CloudFormation template for `Kinesis Metric Collection`
+* Updated 9 apps and 4 monitors to accommodate new threat intel feed: AWS Application Load Balancer, AWS API Gateway, AWS Classic Load Balancer, AWS DynamoDB, AWS EC2, AWS Lambda, Amazon RDS, Amazon SNS, Amazon SQS.
+
+## v2.11.0, 24-Jan-2025
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.11.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+New Feature:
+* Amazon RDS app - Added support to analyze and monitor RDS Oracle CloudWatch and CloudTrail logs.
+* Amazon Load Balancer apps - Added support to analyze and monitor CloudTrail audit event logs for Application Load Balancer, Classic Load Balancer, and Network Load Balancer.
+* Added out-of-the-box monitors for RDS Oracle DB, Application Load Balancer, Classic Load Balancer, and Network Load Balancer. Solution now supports 78 out-of-the-box monitors.
+* Added support to collect custom metrics namespaces.
+* Added support to subscribe to CloudWatch log groups based on AWS tags to Sumo Logic.
+* Added support to filter AWS CloudWatch metrics based on AWS tags.
+
+Updates:
+* Updated cloudformation helper function with Lambda Runtime to Python v3.13.
+* Updated SAM Lambda runtime to Python v3.13 with latest library updates.
+* Updated Telemetry Lambda Runtime to Python v3.13 with latest library updates.
+
+## v2.10.0, 4-Sept-2024
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.10.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+Updates:
+
+* All Python Lambda runtimes have been updated to version 3.12, along with the required libraries.
+* AWS Observability solution now supports Sumo Logic Korea deployment.
+
+## v2.9.0, 02-Aug-2024
+
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.9.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+New Feature:
+* Amazon RDS app - Added support to analyze and monitor RDS MS SQL CloudWatch logs.
+* Amazon RDS app - New monitors added for RDS MS SQL CloudWatch logs. Solution now supports 70 out-of-the-box monitors.
+* By default, the solution now sends CloudFormation deployment telemetry to Sumo Logic. Users can opt out of this telemetry.
+
+Updates:
+* Reduced the installation time for the AWS Observability solution using the CloudFormation template.
+* Integrated the latest SAM versions with AWSO v2.9.0 (CF + TF) to address CVEs and updated Lambda runtimes from Node.js v18.x to v20.x.
+* Upgraded to Sumo Logic Terraform provider v2.31.0 for CVE fixes.
+* Updated Terraform test code written in Go language from v1.18 to v1.22, addressing CVEs associated with the gRPC module.
+* Enhanced log group subscriptions limit in the updated SAM app, sumologic-loggroup-connector v1.0.12.
+
+Bug Fixes:
+* Resolved an issue where updating from versions lower than v2.8.0 to v2.8.0 was not functioning correctly. Users are now recommended to update directly to v2.9.0, bypassing v2.8.0.
+
+## v2.8.0, 17-May-2024 - Yanked
+
+### This version has been yanked. Please deploy/update to AWS Observability v2.9.0 or the latest version.
+
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.8.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+New Features:
+* RDS app - Added support to analyze RDS PostgreSQL CloudWatch logs.
+* New monitors added for RDS PostgreSQL, RDS MySQL, DynamoDB, EC2, Lambda, and API Gateway.
+* Added new dashboards for HTTP and Websocket API, which cover use cases based on CloudWatch logs and metrics, including enhanced metrics.
+* Added support for API Gateway access logs for all three types of APIs - REST, HTTP, and WebSocket API.
+
+Updates:
+* Optimized time to install AWS observability solution with CloudFormation template.
+* AccountID tag removed from AWS CloudWatch Metrics sources.
+* CVE fixes associated with Sumologic terraform provider and terraform integration module (update >= 2.28.3, < 3.0.0).
+* Updated Terraform integration module to AWS Terraform provider version 5.x.
+* Existing source URL of Classic Load Balancer is integrated with CloudFormation (CF) Solution.
+
+## v2.7.0, 25-Oct-2023
+
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.7.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+New Feature:
+* RDS app - Added support to analyze MySQL and AuroraMySQL Databases CloudWatch logs.
+
+Updates:
+* All Python lambda runtimes have been updated to Python 3.11, along with libraries updated.
+* All NodeJS lambda runtimes have been updated to NodeJS18.x along with libraries updated.
+* The solution is updated to use the AWS Terraform provider version v5.
+* Updated SAM apps used in the solution.
+ * sumologic-s3-logging-auto-enable - Semantic v1.0.6
+ * sumologic-loggroup-connector - Semantic v1.0.9
+
+Bug Fixes:
+* AWS Lambda app updated - Consistent handling of time-out error messages.
+* AWS Application Load Balancer app - Updated metric panel queries to precisely handle available dimensions.
+
+
+## v2.6.1, 18-July-2023
+
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.6.1/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+Security Fixes and Updates:
+ * Security fixes ([CVE-2022-23491](https://nvd.nist.gov/vuln/detail/CVE-2022-23491) and [CVE-2021-33503](https://nvd.nist.gov/vuln/detail/CVE-2021-33503)) for following.
+ * SAM: sumologic-s3-logging-auto-enable - Semantic v1.0.5
+ * SAM: sumologic-loggroup-connector - Semantic v1.0.7
+ * SumoLogicAWSObservabilityHelperv2.0.16.zip
+ * Removed unused permissions (AddTags, RemoveTags) from SAM: sumologic-s3-logging-auto-enable.
+ * Fine-tuned IAM role permission to invoke the lambda function in SAM: sumologic-loggroup-connector.
+
+## v2.6.0, 25-April-2023
+
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.6.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+New Feature:
+* Support for the Amazon SQS service.
+
+Updates:
+* Updated “AWS Account Overview” and “AWS Region Overview” dashboards to monitor newly added Amazon SQS service and other generic updates.
+* AWS Lambda service-related dashboard now supports InitDuration in the REPORT log with Lambda extension's new version, along with updates for trendline color fix and query optimization.
+* Improved the evaluation delay time to 4 minutes for CloudWatch metrics monitors.
+
+Bug Fixes:
+* Fixed issues with the “AWS Account Overview” and “AWS Region Overview” dashboards.
+* Fixed AWS Observability's Entity Inspector KPI for supported services.
+* Updated SNS CloudTrail FER (AwsObservabilitySNSCloudTrailLogsFER).
+
+## v2.5.1, 27-Sept-2022
+
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.5.1/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates).
+
+Updates:
+* Updated runtime of nodeJS 12.x lambdas to nodeJS 16.x.
+
+Bug Fixes:
+* Fixed FER (AwsObservabilityGenericCloudWatchLogsFER) that was mapping ECS namespace aws/ecs to ecs/containerInsights.
+
+
+## v2.5.0, 29-July-2022
+
+AWS Observability Solution (S3 Link for CloudFormation template): `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.5.0/sumologic_observability.master.template.yaml`
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates)
+
+New Features:
+* Support for Amazon EC2 CloudWatch Metric.
+* Support for the Amazon SNS service.
+* New onboarding method via script for Linux and Windows.
+
+Updates:
+* Updated “AWS Account Overview” and “AWS Region Overview” dashboards to monitor newly added Amazon SNS.
+* Simplified Terraform onboarding by importing existing SumoLogic Fields and FERs to the TF state file via fields.sh script.
+* Enhanced and optimized dashboards for Amazon DynamoDB, AWS API Gateway, AWS Classic Load Balancer, Amazon RDS, AWS Application Load Balancer, Amazon EC2 Metrics, Amazon ElastiCache, and AWS Network Load Balancer.
+* Terraform solution will use the Sumo Logic Terraform provider >= v2.16.2.
+
+Bug Fixes:
+* Fixed lambda CloudWatch logs FER (AwsObservabilityLambdaCloudWatchLogsFER).
+* Added new FER (AwsObservabilityGenericCloudWatchLogsFER) to handle generic CloudWatch logs namespace identification.
+* Fixed creation of extra resources with Terraform when the user selects none to deploy.
+* Fixed issue with the collection of the generic AWS namespace metric.
+* Fixed query for “Network Bytes In” panel in Amazon ElastiCache dashboard.
+* Updated documentation for Terraform solution.
+
+Removals:
+* RCE Dashboards are deprecated from the AWS Observability solution.
+
+## v2.4.0, 30-March-2022
+AWS Observability Solution (S3 Link for CloudFormation template):
+https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.4.0/sumologic_observability.master.template.yaml
+
+AWS Observability Solution (Terraform-based) repo: [sumologic-solution-templates](https://github.com/SumoLogic/sumologic-solution-templates)
+
+New Features:
+* Select the install location for the AWS Observability app folder. **Personal** is the default location.
+* Share the AWS Observability app folder “AWS Observability” with the Sumo Logic organization during installation, with “Share with Org” as the default.
+* Classic Elastic Load Balancer (ELB) AWS Service added to AWS Observability Solution.
+
+Updates:
+* Updated “AWS Account Overview” and “AWS Region Overview” dashboards to monitor the newly added AWS Classic ELB Service.
+* Added a new “AWS EC2 - Events” dashboard for AWS CloudTrail audit log monitoring.
+* Enhanced Lambda dashboards to monitor the cold start duration of Lambda Functions.
+* Updated FERs for application load balancer access logs, ECS AWS CloudTrail logs, ElastiCache CloudTrail logs, and created a new EC2-related AWS CloudTrail logs FER.
+
+Bug Fixes:
+* Resolved issue related to upgrade and uninstallation of AWS Observability solution when a user deletes the “apps” and/or “monitor” folder before upgrade or deletion.
+
+## v2.3.0, 24-Sept-2021
+
+CloudFormation YAML URL: https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.3.0/sumologic_observability.master.template.yaml
+
+[Terraform folder](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability-terraform) in the [sumologic-solution-templates GitHub Repo](https://github.com/SumoLogic/sumologic-solution-templates)
+
+Updates:
+* Provide Terraform support for setting up the AWS Observability Solution.
+* Allow rapid onboarding of multiple AWS accounts via CloudFormation templates and CSV files that map AWS account IDs to account aliases.
+* Allow collection of CloudWatch metrics data from all possible AWS namespaces.
+* Updated ECS, ElastiCache, EC2, RDS, and Lambda dashboards with minor cosmetic changes.
+
+Bug Fixes:
+* Changed the IAM Role to ensure that permissions are applied to S3 buckets used by AWS Observability only.
+* Made the AWS Account ID available as the “accountId” field.
+* OOTB monitors:
+ * Added a new monitor “AWS EC2 - High Total CPU Utilization”
+ * Renamed “AWS EC2 - High CPU Utilization” to “AWS EC2 - High System CPU Utilization”
+ * Fixed the underlying query for the “AWS EC2 - High Disk Utilization” monitor
+
+## v2.2.0, 30-Apr-2021
+
+CloudFormation YAML URL: https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.2.0/sumologic_observability.master.template.yaml
+
+Updates:
+* Support Kinesis Firehose for Metrics and Logs sources.
+* Lambda App updates to support data formats in the Kinesis Firehose for Logs source.
+* Added Global Intelligence for AWS CloudTrail DevOps.
+
+Bug Fixes:
+* Changed the widget title from "System CPU Utilization" to "Total CPU Utilization" in EC2 metrics dashboards.
+
+Removals:
+* Metric Rules for entity fields.
+
+## v2.1.0, 04-Feb-2021
+
+CloudFormation YAML URL: https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.1.0/sumologic_observability.master.template.yaml
+
+Updates:
+* Out-of-the-box Alerts.
+* Support for AWS NLB, Amazon ECS, and ElastiCache.
+* CloudFormation template versioning.
+* Support for AWS/SQS and AWS/SNS CloudWatch Metrics namespaces.
+* Automatic deletion of all resources created by the test CloudFormation template that checks permissions.
+
+Bug Fixes:
+* Fixed the FERs that were not getting applied correctly for logs from existing collector sources, with spaces in the source name.
+
+## v2.0.0, 10-Oct-2020
+
+CloudFormation YAML URL: https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/sumologic_observability.master.template.yaml
+
+Updates:
+* Updated the AWS Observability view hierarchy and all dashboards to use the entity model.
+* Added new FERs and fields to support the entity model.
+
+## v1.0.0, 31-Aug-2020
+
+First version of the solution.
diff --git a/docs/observability/aws/deploy-use-aws-observability/v3.0.0/configure-alerts.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/configure-alerts.md
new file mode 100644
index 00000000000..befac72e363
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/configure-alerts.md
@@ -0,0 +1,103 @@
+---
+id: configure-alerts
+title: Configure AWS Observability Alerts
+sidebar_label: Configure Alerts
+description: Sumo Logic has provided out-of-the-box alerts to help you quickly determine if a particular AWS service is available and performing as expected.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+Sumo Logic provides pre-configured alerts designed to promptly assess the availability and performance of specific AWS services. These alerts utilize metric datasets with predefined thresholds aligned with industry best practices and AWS recommendations. They are available for each AWS service integrated into the AWS Observability solution and can be deployed via a CloudFormation template.
+
+After installing the AWS Observability solution and selecting "Install Dashboards and Alerts," you can configure these alerts by navigating to the AWS Observability folder under **Monitors**.
+
+})
+
+To enable the monitors you wish to receive alerts from, see [Monitor Settings](/docs/alerts/monitors/settings). To configure alerts to send notifications to other teams or connections, see [Create a New Monitor](/docs/alerts/monitors/create-monitor).
+
+Sumo Logic provides the following out-of-the-box alerts:
+
+| Alert Name | Alert Description | Alert Condition | Recover Condition |
+|:--|:--|:--|:--|
+| AWS API Gateway - High Authorizer Errors | This alert fires where there are too many API requests (>5%) with authorizer errors within 5 minutes. | > 5 | <= 5 |
+| AWS API Gateway - High Client-Side Errors | This alert fires where there are too many API requests (>5%) with client-side errors within 5 minutes. This can indicate an issue in the authorisation or client request parameters. It could also mean that a resource was removed or a client is requesting one that doesn't exist. Errors could also be caused by exceeding the configured throttling limit. | >= 0.05 | < 0.05 |
+| AWS API Gateway - High Integration Errors | This alert fires where there are too many API requests (>5%) with integration errors within 5 minutes. | > 5 | <= 5 |
+| AWS API Gateway - High Integration Latency | This alert fires when we detect the high integration latency for the API requests in a stage within 5 minutes. This alarm is recommended for WebSocket APIs by AWS, and optional for other APIs because they already have separate alarm recommendations for the Latency metric. You can correlate the IntegrationLatency metric value with the corresponding latency metric of your backend such as the Duration metric for Lambda integrations. This helps you determine whether the API backend is taking more time to process requests from clients due to performance issues or if there is some other overhead from initialization or cold start. | >= 2000 | < 2000|
+| AWS API Gateway - High Latency | This alert fires when we detect the high Latency in a stage within 5 minutes for REST and HTTP API. Find the IntegrationLatency metric value to check the API backend latency. If the two metrics are mostly aligned, the API backend is the source of higher latency and you should investigate there for issues. View this metric per resource and method and narrow down the source of the latency. | >= 2500 | < 2500 |
+| AWS API Gateway - High Server-Side Errors | This alert fires where there are too many API requests (>5%) with server-side errors within 5 minutes. This can be caused by 5xx errors from your integration, permission issues, or other factors preventing successful invocation of the integration, such as the integration being throttled or deleted. | >= 0.05 | < 0.05 |
+| AWS API Gateway - High WAF Errors | This alert fires where there are too many API requests (>5%) with WAF errors within 5 minutes. | > 5 | <= 5 |
+| AWS API Gateway - High WAF Latency | This alert fires when we detect the high WAF latency for the REST and WebSocket API requests in a stage within 5 minutes. | > 1000 | <= 1000 |
+| AWS API Gateway - Low Traffic API | This alert fires where there is low message traffic volume for the API within 5 minutes. This can indicate an issue with the application calling the API such as using incorrect endpoints. It could also indicate an issue with the configuration or permissions of the API making it unreachable for clients. This alarm is not recommended for APIs that don't expect constant and consistent traffic. | <= 1 | > 1 |
+| Amazon RDS - High CPU Utilization | This alert fires when we detect that the average CPU utilization for a database is high (>=85%) for an interval of 5 minutes. | >= 85 | < 85 |
+| Amazon RDS - High Disk Queue Depth | This alert fires when the average disk queue depth for a database is high (>=5) for an interval of 5 minutes. Higher this value, higher will be the number of outstanding I/Os (read/write requests) waiting to access the disk, which will impact the performance of your application. | >= 5 | < 5 |
+| Amazon RDS - High Read Latency | This alert fires when the average read latency of a database within a 5 minutes time interval is high (>=5 seconds). High read latency will affect the performance of your application. | >= 5 | < 5 |
+| Amazon RDS - High Write Latency | This alert fires when the average write latency of a database within a 5 minute interval is high (>=5 seconds) . High write latencies will affect the performance of your application. | >= 5 | < 5 |
+| Amazon RDS - Low Aurora Buffer Cache Hit Ratio | This alert fires when the average RDS Aurora buffer cache hit ratio within a 5 minute interval is low (<= 50%). This indicates that a lower percentage of requests were are served by the buffer cache, which could further indicate a degradation in application performance. | <= 50 | > 50 |
+| Amazon RDS - Low Burst Balance | This alert fires when we observe a low burst balance (<= 50%) for a given database. A low burst balance indicates you won't be able to scale up as fast for burstable database workloads on gp2 volumes. | <= 50 | > 50 |
+| Amazon RDS - Low Free Storage | This alert fires when the average free storage space of a RDS instance is low (< 512MB) for an interval of 15 minutes. | < 512 | >= 512 |
+| Amazon RDS - Low Freeable Memory | This alert fires when the average Freeable memory of an RDS instance is < 128 MB for an interval of 15 minutes. If this value is lower you may need to scale up to a larger instance class. | <= 128 | > 128 |
+| Amazon RDS - Oracle Logs - DB Crash | This alert fires when we detect greater than or equal to 1 Oracle DB crash over a 5 minute time-period. | >= 1 | < 1 |
+| Amazon RDS - Oracle Logs - Failed Connection Attempts | This alert fires when we detect greater than or equal to 25 failed connection attempts over a 5 minute time-period. | >= 25 | < 25 |
+| Amazon RDS MSSQL - Authentication failures from the same client IP on multiple databases | This alert fires when we detect specific client IP attempting authentication failures on more than or equal to 10 databases over a 15 minute time-period. | >= 1 | < 1 |
+| Amazon RDS MSSQL - Database observing authentication failures from multiple client IPs | This alert fires when we detect more than or equal to 10 client IPs attempting authentication failures on the database over a 15-minute period. | >= 1 | < 1 |
+| Amazon RDS MySQL - Excessive Slow Query Detected | This alert fires when we detect the average time to execute a query is more than 5 seconds over last 10 minutes. | >= 1 | < 1 |
+| Amazon RDS MySQL - High Authentication Failure | This alert fires when we detect more then 10 authentication failure over a 5 minute time-period. | > 10 | <= 10 |
+| Amazon RDS PostgreSQL - Excessive Slow Query Detected | This alert fires when we detect the average time to execute a query is more than 5 seconds over a 10 minutes. | > 0 | <= 0 |
+| Amazon RDS PostgreSQL - High Authentication Failure | This alert fires when we detect more than 10 authentication failure in Postgres logs over a 5 minute time-period. | > 10 | <= 10 |
+| Amazon RDS PostgreSQL - High Errors | This alert fires when we detect high number (>10) of error/fatal logs in Postgres logs over a 5 minutes time period. | > 10 | <= 10 |
+| Amazon RDS PostgreSQL - Statement Timeouts | This alert fires when we detect Postgres logs show statement timeouts. | > 0 | <= 0 |
+| AWS DynamoDB - High Account Provisioned Read Capacity | This alert fires when we detect that the average read capacity provisioned for an account for a time interval of 5 minutes is greater than or equal to 80%. High values indicate requests to the database are being throttled, which could further indicate that your application may not be working as intended. | >= 80 | < 80 |
+| AWS DynamoDB - High Account Provisioned Write Capacity | This alert fires when we detect that the average write capacity provisioned for an account for a time interval of 5 minutes is greater than or equal to 80%. High values indicate requests to the database are being throttled, which could further indicate that your application may not be working as intended. | >= 80 | < 80 |
+| AWS DynamoDB - High Max Provisioned Table Read Capacity | This alert fires when we detect that the average percentage of read provisioned capacity used by the highest read provisioned table of an account for a time interval of 5 minutes is great than or equal to 80%. High values indicate requests to the database are being throttled, which could further indicate that your application may not be working as intended. | >= 80 | < 80 |
+| AWS DynamoDB - High Max Provisioned Table Write Capacity | This alert fires when we detect that the average percentage of write provisioned capacity used by the highest write provisioned table of an account for a time interval of 5 minutes is great than or equal to 80%. High values indicate requests to the database are being throttled, which could further indicate that your application may not be working as intended. | >= 80 | < 80 |
+| AWS DynamoDB - High Read Throttle | This alert fires when we detect that the total read throttle events for a dynamodb table is high (>5) for a time interval of 5 minutes. | > 5 | <= 5 |
+| AWS DynamoDB - High Write Throttle | This alert fires when we detect that the total write throttle events for a dynamodb table is high (>5) for a time interval of 5 minutes. | > 5 | <= 5 |
+| AWS DynamoDB - Multiple Tables deleted | This alert fires when five or more tables are deleted within 15 minutes. | >= 5 | < 5 |
+| AWS DynamoDB - System Errors | This alert fires when we detect system errors for a dynamodb table is high (>10) for a time interval of 5 minutes. | > 10 | <= 10 |
+| AWS Application Load Balancer - Access from Highly Malicious Sources | This alert fires when an Application load balancer is accessed from highly malicious IP addresses within last 5 minutes. | > 0 | <= 0 |
+| AWS Application Load Balancer - Deletion Alert | This alert fires when we detect greater than or equal to 2 application load balancers are deleted over a 5 minute time-period. | >= 2 | < 2 |
+| AWS Application Load Balancer - High 4XX Errors | This alert fires where there are too many HTTP requests (>5%) with a response status of 4xx within an interval of 5 minutes. | >= 5 | < 5 |
+| AWS Application Load Balancer - High 5XX Errors | This alert fires where there are too many HTTP requests (>5%) with a response status of 5xx within an interval of 5 minutes. | >= 5 | < 5 |
+| AWS Application Load Balancer - High Latency | This alert fires when we detect that the average latency for a given Application load balancer within a time interval of 5 minutes is greater than or equal to three seconds. | >= 3000 | < 3000 |
+| AWS Application Load Balancer - Targets Deregistered | This alert fires when we detect greater than or equal to 1 target is de-registered over a 5 minute time-period. | >= 1 | < 1 |
+| AWS Network Load Balancer - Deletion Alert | This alert fires when we detect greater than or equal to 2 application load balancers are deleted over a 5 minute time-period. | >= 2 | < 2 |
+| AWS Network Load Balancer - High TLS Negotiation Errors | This alert fires when we detect that there are too many TLS Negotiation Errors (>=10%) within an interval of 5 minutes for a given network load balancer. | >= 10 | < 10 |
+| AWS Network Load Balancer - High Unhealthy Hosts | This alert fires when we detect that are there are too many unhealthy hosts (>=10%) within an interval of 5 minutes for a given network load balancer. | >= 10 | < 10 |
+| AWS Network Load Balancer - Targets Deregistered | This alert fires when we detect greater than or equal to 1 target is de-registered over a 5 minute time-period. | >= 1 | < 1 |
+| AWS Classic Load Balancer - Access from Highly Malicious Sources | This alert fires when the Classic load balancer is accessed from highly malicious IP addresses within last 5 minutes. | > 0 | <= 0 |
+| AWS Classic Load Balancer - Deletion Alert | This alert fires when we detect greater than or equal to 2 application load balancers are deleted over a 5 minute time-period. | >= 2 | < 2 |
+| AWS Classic Load Balancer - High 4XX Errors | This alert fires where there are too many HTTP requests (>5%) with a response status of 4xx within an interval of 5 minutes. | >= 5 | < 5 |
+| AWS Classic Load Balancer - High 5XX Errors| This alert fires where there are too many HTTP requests (>5%) with a response status of 5xx within an interval of 5 minutes. | >= 5 | < 5 |
+| AWS Classic Load Balancer - High Latency ]| This alert fires when we detect that the average latency for a given Classic load balancer within a time interval of 5 minutes is greater than or equal to three seconds. | >= 3000 | < 3000 |
+| AWS Classic Load Balancer - Targets Deregistered | This alert fires when we detect greater than or equal to 1 target is de-registered over a 5 minute time-period. | >= 1 | < 1 |
+| AWS Lambda - High Memory Utilization | This alert fires when we detect a Lambda execution with memory usage of more than 85% within an interval of 10 minutes.| > 0 | <= 0 |
+| AWS Lambda - High Percentage of Failed Requests | This alert fires when we detect a large number of failed Lambda requests (>5%) within an interval of 5 minutes. | >= 5 | < 5 |
+| AWS Lambda - Low Provisioned Concurrency Utilization | This alert fires when the average provisioned concurrency utilization for 5 minutes is low (<= 50%). This indicates low provisioned concurrency utilization efficiency. | <= 50 | > 50 |
+| AWS Lambda - Throttling | This alert fires when we detect a Lambda running into throttling within an interval of 10 minutes. | > 0 | <= 0 |
+| AWS EC2 - High Disk Utilization | This alert fires when the average disk utilization within a 5 minute time interval for an EC2 instance is high (>=85%). | >= 85 | < 85 |
+| AWS EC2 - High Memory Utilization | This alert fires when the average memory utilization within a 5 minute interval for an EC2 instance is high (>=85%). | >= 85 | < 85 |
+| AWS EC2 - High System CPU Utilization | This alert fires when the average system CPU utilization within a 5 minute interval for an EC2 instance is high (>=85%). | >= 85 | < 85 |
+| AWS EC2 - High Total CPU Utilization | This alert fires when the average total CPU utilization within a 5 minute interval for an EC2 instance is high (>=85%). | >= 85 | < 85 |
+| AWS EC2 CW - High CPU Utilization | This alert fires when the average CPU Utilization based on cloud watch metrics, within a 5 minute interval for an EC2 instance is high (>=85%). | > 85 | <= 85 |
+| AWS EC2 CW - Status Check Failed | This alert fires when there is a status check failures within a 5 minute interval for an EC2 instance. | > 0 | <= 0 |
+| Amazon ECS - High CPU Utilization | This alert fires when the average CPU utilization within a 5 minute interval for a service within a cluster is high (>=85%). | >= 85 | < 85 |
+| Amazon ECS - High Memory Utilization | This alert fires when the average memory utilization within a 5 minute interval for a service within a cluster is high (>=85%). | >= 85 | < 85 |
+| Amazon Elasticache - High CPU Utilization | This alert fires when the average CPU utilization within a 5 minute interval for a host is high (>=90%). The CPUUtilization metric includes total CPU utilization across application, operating system and management processes. We highly recommend monitoring CPU utilization for hosts with two vCPUs or less. | >= 90 | < 90 |
+| Amazon Elasticache - High Engine CPU Utilization | This alert fires when the average CPU utilization for the Redis engine process within a 5 minute interval is high (>=90%). For larger node types with four vCPUs or more, use the EngineCPUUtilization metric to monitor and set thresholds for scaling. | >= 90 | < 90 |
+| Amazon Elasticache - High Redis Database Memory Usage | This alert fires when the average database memory usage within a 5 minute interval for the Redis engine is high (>=95%). When the value reaches 100%, eviction may happen or write operations may fail based on ElastiCache policies thereby impacting application performance. | >= 95 | < 95 |
+| Amazon Elasticache - High Redis Memory Fragmentation Ratio | This alert fires when the average Redis memory fragmentation ratio for within a 5 minute interval is high (>=1.5). Value equal to or greater than 1.5 Indicate significant memory fragmentation. | >= 1.5 | < 1.5 |
+| Amazon Elasticache - Low Redis Cache Hit Rate | This alert fires when the average cache hit rate for Redis within a 5 minute interval is low (<= 80%). This indicates low efficiency of the Redis instance. If cache ratio is lower than 80%, that indicates a significant amount of keys are either evicted, expired, or don't exist. | <= 80 | > 80 |
+| Amazon Elasticache - Multiple Failed Operations | This alert fires when we detect multiple failed operations within a 15 minute interval for an ElastiCache service. | >= 10 | < 10 |
+| AWS SNS - Access from Highly Malicious Sources| This alert fires when an Application AWS - SNS is accessed from highly malicious IP addresses within last 5 minutes. | > 0 | <= 0 |
+| AWS SNS - Failed Events | This alert fires when an SNS app has high number of failed events (>5) within last 5 minutes. | > 5 | <= 5 |
+| AWS SNS - Failed Notifications | This alert fires where there are many failed notifications (>=5) within an interval of 5 minutes. | > 2 | <= 2 |
+| AWS SNS - Notification to DLQ | This alert fires when an SNS topic messages are moved to a dead-letter queue. | > 0 | <= 0 |
+| AWS SNS - Notification to DLQ Failure | This alert fires when an SNS topic messages that couldn't be moved to a dead-letter queue. | > 0 | <= 0 |
+| AWS SQS - Access from Highly Malicious Sources | This alert fires when an Application AWS - SQS is accessed from highly malicious IP addresses within last 5 minutes. | > 0 | <= 0 |
+| AWS SQS - Message processing not fast enough | This alert fires when we detect message processing is not fast enough. That is, the average approximate age of the oldest non-deleted message in the queue is more than 5 seconds for an interval of 5 minutes. | > 5 | <= 5 |
+| AWS SQS - Messages not processed | This alert fires when we detect messages that have been received by a consumer, but have not been processed (deleted/failed). That is, the average number of messages that are in flight are >=20 for an interval of 5 minutes. | >= 20 | < 20 |
+| AWS SQS - Queue has stopped receiving messages | This alert fires when we detect that the queue has stopped receiving messages. That is, the average number of messages received in the queue <1 for an interval of 30 minutes. | < 1 | >= 1 |
+
+:::note
+The information is provided for both Alert conditions and Recover conditions.
+:::
diff --git a/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/automatic-installation-script.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/automatic-installation-script.md
similarity index 92%
rename from docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/automatic-installation-script.md
rename to docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/automatic-installation-script.md
index 2148566298d..d5c5c987bd3 100644
--- a/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/automatic-installation-script.md
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/automatic-installation-script.md
@@ -7,10 +7,10 @@ description: Sumo Logic provides POSIX and PowerShell scripts to trigger the Clo
Sumo Logic provides [POSIX](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability/scripts/AWSOAutoSetupScript/DeployAWSOPosix.sh) and [PowerShell](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability/scripts/AWSOAutoSetupScript/DeployAWSOWin.ps1) scripts to trigger the CloudFormation template for creating a stack to deploy AWS Observability Solution.
-This is a simplified method of deploying AWS Observability using default parameters with just one quick command. Use it for a quick start or when you are happy with the defaults (see [table below](#appendix-i)). For more advanced use cases, when any of the default needs to be adjusted, fall back to [Terraform](/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform) or [CloudFormation](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation) installation steps.
+This is a simplified method of deploying AWS Observability using default parameters with just one quick command. Use it for a quick start or when you are happy with the defaults (see [table below](#appendix-i)). For more advanced use cases, when any of the default needs to be adjusted, fall back to [Terraform](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform) or [CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation) installation steps.
:::tip Multi-account and region
-If you need to add support for multiple AWS accounts or multiple regions, refer to the Sumo Logic documentation for [CloudFormation](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation) or [Terraform](/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform).
+If you need to add support for multiple AWS accounts or multiple regions, refer to the Sumo Logic documentation for [CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation) or [Terraform](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform).
:::
## Prerequisites
@@ -36,7 +36,7 @@ The script takes two inputs:
## CloudFormation parameters
-The script above will take only two inputs, the Sumo Logic access ID and Access Key. And internally it will trigger a CloudFormation template. This CloudFormation template requires some additional parameters. But all of these parameters will take the default value. When using this script one cannot override these values. Refer to the table in **Appendix I** for all the parameters and the respective default values which will be used as part of this installation. Learn details about each parameter in detail [here](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation).
+The script above will take only two inputs, the Sumo Logic access ID and Access Key. And internally it will trigger a CloudFormation template. This CloudFormation template requires some additional parameters. But all of these parameters will take the default value. When using this script one cannot override these values. Refer to the table in **Appendix I** for all the parameters and the respective default values which will be used as part of this installation. Learn details about each parameter in detail [here](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation).
### PowerShell script command execution
diff --git a/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection.md
new file mode 100644
index 00000000000..051a987e958
--- /dev/null
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection.md
@@ -0,0 +1,34 @@
+---
+id: centralized-aws-cloudtrail-log-collection
+title: Centralized AWS CloudTrail Log Collection
+sidebar_label: Centralized AWS CloudTrail Log Collection.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+If you are collecting AWS CloudTrail logs from multiple AWS accounts into a single S3 bucket, we need to make sure Sumo Logic has the ability to reliably extract the account alias that you created from the account-ids.
+
+To do so:
+
+1. First, run the CloudFormation template in the Central Master Log account to collect all CloudTrail Logs and install apps and alerts.
+1. Use StackSets to deploy the solution in multiple accounts. While doing so, answer the questions as follows:
+ 1. Install AWS Observability Apps as No. })
+ 1. Create Sumo Logic CloudTrail Logs Source as ‘No’.
+1. Set up FERs in Sumo Logic for CloudTrail logs to associate AWS account-ids present in the logs with AWS account aliases. Log in to the Sumo Logic web UI with a *supported browser*, as an administrator that has the [Manage Field Extractions role capability](/docs/manage/users-roles/roles/role-capabilities/#data-management) and follow the instructions in [Create a Field Extraction Rule](/docs/manage/field-extractions/create-field-extraction-rule/) using the following values:
+ * **Rule Name**: AWS Accounts
+ * **Applied At**: Ingest Time
+ * **Scope**: Specific Data
+ * **Metadata**. `_sourceCategory`
+ * **Value**. aws/observability/cloudtrail/logs
+ * **Parse Expression**
+ * Enter a parse expression to create an “account” field that maps to the alias you set for each sub account. For example, if you used the `“dev”` alias for an AWS account with ID `"528560886094"` and the `“prod”` alias for an AWS account with ID `"567680881046"`, your parse expression would look like:
+ ```sumo
+ | json "recipientAccountId"
+ // Manually map your aws account id with the AWS account alias you setup earlier for individual child account
+ | "" as account
+ | if (recipientAccountId = "528560886094", "dev", account) as account
+ | if (recipientAccountId = "567680881046", "prod", account) as account
+ | fields account
+ ```
+
+ Here is how this would look in Sumo Logic:})
diff --git a/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md
similarity index 96%
rename from docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md
rename to docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md
index 0bf339223e4..2503014ba9d 100644
--- a/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions.md
@@ -13,7 +13,7 @@ Given that we use an account alias, we recommend you use StackSets to automati
## Before you start
-* If this is the first time you've deployed our AWS Observability solution, read the [Before You Deploy](/docs/observability/aws/deploy-use-aws-observability/before-you-deploy/) topic for more information.
+* If this is the first time you've deployed our AWS Observability solution, read the [Before You Deploy](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy/) topic for more information.
* Complete the prerequisites for StackSets as described in the [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html).
## Step 1: Open the CloudFormation template
@@ -23,7 +23,7 @@ Given that we use an account alias, we recommend you use StackSets to automati
* Click [this URL](https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.15.0/sumologic_observability.master.template.yaml) to invoke the latest Sumo Logic AWS CloudFormation template.
* Download the AWS Observability Solution template (S3 link for CloudFormation template): https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.15.0/sumologic_observability.master.template.yaml to invoke the latest Sumo Logic AWS CloudFormation template.
:::note
- If you would like to download or inspect this or other versions of this template, see the [Changelog](/docs/observability/aws/deploy-use-aws-observability/changelog/).
+ If you would like to download or inspect this or other versions of this template, see the [Changelog](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/changelog/).
:::
1. Select the AWS Region where you want to deploy the AWS CloudFormation template.
:::danger
@@ -82,8 +82,8 @@ In case you do not provide a CSV file or if we detect that it does not have the
1. Go to [StackSets](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacksets) in your AWS account.
1. Click **Create StackSet**.
-1. Paste the URL `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.15.0/sumologic_observability.master.template.yaml` in the Amazon S3 URL option and click **Next**. If you'd like to download or inspect this or other versions of this template, see the [Changelog](/docs/observability/aws/deploy-use-aws-observability/changelog/).
-1. Provide a StackSet Name and supply the values for each of the prompts listed as per instructions in the [Deploy and Use AWS Observability](/docs/observability/aws/deploy-use-aws-observability) section with the following exception:
+1. Paste the URL `https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/aws-observability-versions/v2.15.0/sumologic_observability.master.template.yaml` in the Amazon S3 URL option and click **Next**. If you'd like to download or inspect this or other versions of this template, see the [Changelog](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/changelog/).
+1. Provide a StackSet Name and supply the values for each of the prompts listed as per instructions in the [Deploy and Use AWS Observability](/docs/observability/aws/deploy-use-aws-observability/v3.0.0) section with the following exception:
1. Leave the field “Alias for AWS Account Identification” blank.
1. Provide the S3 Object URL of a CSV file that maps AWS Account IDs to an Account Alias in Section 2 of the template “AWS Account Alias”.
1. Answer **No** in Section 3 of the template "Install AWS Observability Apps".
diff --git a/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/index.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/index.md
similarity index 99%
rename from docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/index.md
rename to docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/index.md
index 0a2213d1245..fa8e328a604 100644
--- a/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/index.md
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/index.md
@@ -1,5 +1,5 @@
---
-slug: /observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation
+slug: /observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation
title: Deploy with AWS CloudFormation
description: Learn about the process of executing the AWS CloudFormation template to set up the AWS Observability Solution for a single AWS region and account combination.
---
@@ -116,7 +116,7 @@ The table below displays the response for each text box in this section.
The table below displays the response for each text box in this section.
-If you are collecting AWS CloudTrail logs from multiple AWS accounts into a common S3 bucket, run the CloudFormation template in the account that has the S3 bucket and see [Centralized AWS CloudTrail Log Collection](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection/).
+If you are collecting AWS CloudTrail logs from multiple AWS accounts into a common S3 bucket, run the CloudFormation template in the account that has the S3 bucket and see [Centralized AWS CloudTrail Log Collection](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection/).
| Prompt | Guideline |
|:--|:--|
@@ -235,7 +235,7 @@ Below are some common errors that can occur while using the CloudFormation templ
| The API rate limit for this user has been exceeded. | This error indicates that AWS CloudFormation execution has exceeded the API rate limit set on the Sumo Logic side. It can occur if you install the AWS CloudFormation template in multiple regions or accounts using the same Access Key and Access ID. | - Re-deploy the deployment stack without updating the stack in the template. Re-running will detect the drift and create remaining resources. - If the throttling problem persists, try to break down the multi-region deployment into parts and use distinct access IDs and access keys for each part. | | S3 Bucket already exists. | The error can occur if:
- An S3 bucket with the same name exists in S3, or
- The S3 Bucket is not present in S3 but is referenced by some other AWS CloudFormation stack that created it. | - Remove the S3 bucket from S3 or select “No” in the AWS CloudFormation template for S3 bucket creation.
- Remove the AWS CloudFormation Stack which references the S3 bucket. | | The S3 bucket you tried to delete is not empty. | The error can occur when deleting the stack with a non-empty S3 bucket. | Delete the S3 bucket manually if you do not need the bucket or its content in the future. | -| Invalid IAM role OR AccessDenied. | This error can occur when Sumo Logic access keys are disabled or do not have the required permissions. | - Refer to [Edit, activate/deactivate, rotate, or delete access keys](/docs/manage/security/access-keys/#edit-activatedeactivate-rotate-or-delete-access-keys) for access keys activation.
- Refer to [Role capabilities](/docs/observability/aws/deploy-use-aws-observability/before-you-deploy/#prerequisites) for permissions related issues. | +| Invalid IAM role OR AccessDenied. | This error can occur when Sumo Logic access keys are disabled or do not have the required permissions. | - Refer to [Edit, activate/deactivate, rotate, or delete access keys](/docs/manage/security/access-keys/#edit-activatedeactivate-rotate-or-delete-access-keys) for access keys activation.
- Refer to [Role capabilities](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy/#prerequisites) for permissions related issues. | | Subscription filters are not applied to newly created log groups. | This error can occur when CloudTrail is not enabled for EventBridge to capture `CreateLogGroup` events. | CloudTrail must be enabled for EventBridge to capture `CreateLogGroup` events, since these events are recorded and delivered through CloudTrail. | | Access logs are not enabled for the Load Balancer. | This error can occur when CloudTrail is not enabled for EventBridge to capture `CreateLoadBalancer` events. | CloudTrail must be enabled for EventBridge to capture `CreateLoadBalancer` events, since these events are recorded and delivered through CloudTrail. | diff --git a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform.md similarity index 98% rename from docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md rename to docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform.md index 6a811d4b4da..bc33d9937fc 100644 --- a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md +++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform.md @@ -110,7 +110,7 @@ Before you run the Terraform script, perform the following actions on a server m :::note See the [variables.tf](https://github.com/SumoLogic/sumologic-solution-templates/blob/master/aws-observability-terraform/variables.tf) file and [README](https://github.com/SumoLogic/sumologic-solution-templates/tree/master/aws-observability-terraform#readme) in that folder for configuration information with permissible values for these variables. ::: -1. As part of configuring the AWS Observability solution, we need to [create fields and FERs](/docs/observability/aws/deploy-use-aws-observability/resources/) in the Sumo Logic org. To import any fields and or FERs that are already present in the Sumo Logic org into our Terraform state, we need to run a script. To do so, navigate to the **sumologic-solution-templates/aws-observability-terraform** folder and do the following: +1. As part of configuring the AWS Observability solution, we need to [create fields and FERs](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/resources/) in the Sumo Logic org. To import any fields and or FERs that are already present in the Sumo Logic org into our Terraform state, we need to run a script. To do so, navigate to the **sumologic-solution-templates/aws-observability-terraform** folder and do the following: 1. Set the following environment variables using the commands below: ```bash export SUMOLOGIC_ENV="YOUR_SUMOLOGIC_DEPLOYMENT" @@ -573,11 +573,11 @@ To uninstall the AWS Observability solution deployed using Terraform, navigate t terraform destroy ``` -This will destroy all [resources](/docs/observability/aws/deploy-use-aws-observability/resources/) and configuration previously set up. +This will destroy all [resources](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/resources/) and configuration previously set up. ## Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform -To migrate CloudWatch Source to Kinesis Firehose Source using Terraform, refer to [Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform](/docs/observability/aws/deploy-use-aws-observability/migration-strategy-using-terraform). +To migrate CloudWatch Source to Kinesis Firehose Source using Terraform, refer to [Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/migration-strategy-using-terraform). ## Appendix @@ -668,7 +668,7 @@ The following table provides a list of all source parameters and their default v ### Configure collection of CloudWatch metrics :::note -To migrate from legacy CloudWatch Metrics Source to Kinesis Firehose Metrics Source using Terraform, refer to [Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform](/docs/observability/aws/deploy-use-aws-observability/migration-strategy-using-terraform). +To migrate from legacy CloudWatch Metrics Source to Kinesis Firehose Metrics Source using Terraform, refer to [Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/migration-strategy-using-terraform). ::: #### collect_cloudwatch_metrics @@ -1058,7 +1058,7 @@ classic_lb_log_source_url="https://api.sumologic.com/api/v1/collectors/1234/sour ### Configure collection of CloudTrail logs :::note -To migrate CloudWatch Logs Source to Kinesis Firehose Logs Source using Terraform, refer to [Migration Strategy using Terraform](/docs/observability/aws/deploy-use-aws-observability/migration-strategy-using-terraform). +To migrate CloudWatch Logs Source to Kinesis Firehose Logs Source using Terraform, refer to [Migration Strategy using Terraform](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/migration-strategy-using-terraform). ::: #### collect_cloudtrail_logs @@ -1560,7 +1560,7 @@ Verify you configured [Sumo Logic provider](https://github.com/SumoLogic/sumolog "errors":[{"code":"fer:invalid_extraction_rule","message":"Invalid Field Extraction Rule","meta":{"reason":"A field extraction rule with name 'AwsObservabilityApiGatewayCloudTrailLogsFER' already exists"}}] ``` #### Solution -Refer to step 4 in this [section](/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform/#step-2-configure-the-terraform-script). +Refer to step 4 in this [section](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform/#step-2-configure-the-terraform-script). ### waiting for S3 Bucket Policy (bucket-name) delete #### Error Message @@ -1614,7 +1614,7 @@ Invalid IAM role OR AccessDenied #### Solution - Refer to [Edit, activate/deactivate, rotate, or delete access keys](/docs/manage/security/access-keys/#edit-activatedeactivate-rotate-or-delete-access-keys) for access keys activation. -- Refer to [Prerequisites](/docs/observability/aws/deploy-use-aws-observability/before-you-deploy/#prerequisites) for permissions related issues. +- Refer to [Prerequisites](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy/#prerequisites) for permissions related issues. ### Subscription filters are not applied to newly created log groups diff --git a/docs/observability/aws/deploy-use-aws-observability/v3.0.0/index.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/index.md new file mode 100644 index 00000000000..0f629de77de --- /dev/null +++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/index.md @@ -0,0 +1,94 @@ +--- +slug: /observability/aws/deploy-use-aws-observability/v3.0.0 +title: Deploy and Use AWS Observability v3.0.0 +sidebar_label: v3.0.0 (latest) +description: Learn about Sumo Logic's AWS Observability Solution, how to deploy it, and how to get started with it. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; +import Iframe from 'react-iframe'; + +AWS Observability Solution is a framework to simplify the monitoring and troubleshooting of your AWS cloud infrastructure. You can use the Sumo Logic observability app dashboards to isolate and solve problems faster. + +These topics have information about Sumo Logic's AWS Observability Solution, how to deploy it, and how to get started with it. + +import DocCardList from '@theme/DocCardList'; +import {useCurrentSidebarCategory} from '@docusaurus/theme-common'; + +:::training Micro Lesson + +Watch a micro lesson on deploying the AWS Observability Solution. + + + +::: + + +In this section, we'll introduce the following concepts: + +
+
\ No newline at end of file
diff --git a/docs/observability/aws/deploy-use-aws-observability/migration-strategy-using-terraform.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/migration-strategy-using-terraform.md
similarity index 98%
rename from docs/observability/aws/deploy-use-aws-observability/migration-strategy-using-terraform.md
rename to docs/observability/aws/deploy-use-aws-observability/v3.0.0/migration-strategy-using-terraform.md
index 05419a2a0d5..7b37a76543e 100644
--- a/docs/observability/aws/deploy-use-aws-observability/migration-strategy-using-terraform.md
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/migration-strategy-using-terraform.md
@@ -106,4 +106,4 @@ When you try to migrate CloudWatch Source to Kinesis Firehose Source using [Appr
### Solution
-To resolve this issue, refer to [Creating Serverless Application Repository CloudFormation](/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform/#troubleshooting).
+To resolve this issue, refer to [Creating Serverless Application Repository CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform/#troubleshooting).
diff --git a/docs/observability/aws/deploy-use-aws-observability/resources.md b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/resources.md
similarity index 96%
rename from docs/observability/aws/deploy-use-aws-observability/resources.md
rename to docs/observability/aws/deploy-use-aws-observability/v3.0.0/resources.md
index 9360f724381..72c77068df8 100644
--- a/docs/observability/aws/deploy-use-aws-observability/resources.md
+++ b/docs/observability/aws/deploy-use-aws-observability/v3.0.0/resources.md
@@ -6,7 +6,7 @@ description: Learn more about AWS Observability resources created and modified a
---
-The CloudFormation template creates a number of resources at deployment in AWS and Sumo Logic. You will use the template when setting up the solution. See [Before You Deploy](/docs/observability/aws/deploy-use-aws-observability/before-you-deploy) for prerequisites and instructions to configure.
+The CloudFormation template creates a number of resources at deployment in AWS and Sumo Logic. You will use the template when setting up the solution. See [Before You Deploy](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy) for prerequisites and instructions to configure.
For more information on the solution and features, see [About Sumo Logic AWS Observability](/docs/observability/aws/about).
@@ -164,7 +164,7 @@ The metadata tags are applied to Sumo Logic Sources.
### Resources
-The [AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation) and [Terraform](/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform) template execution creates the following resources in Sumo Logic.
+The [AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation) and [Terraform](/docs/observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform) template execution creates the following resources in Sumo Logic.
+
+
+
+Before You Deploy
+Learn prerequisites and guidelines for deploying the AWS Observability Solution to a single AWS account and region.
+
+
+
+
+Deploy with AWS CloudFormation
+Learn about the process of executing the AWS CloudFormation template to set up the AWS Observability Solution for a single AWS region and account combination.
+
+
+
+
+Deploy with Terraform
+Learn how to deploy AWS Observability Solution using Terraform.
+
+
+
+
+Migration Strategy from CloudWatch Source to Kinesis Firehose Source using Terraform
+Learn how to migrate CloudWatch Source to Kinesis Firehose Source using Terraform.
+
+
+
+
+View AWS Observability Solution Dashboards
+Learn how to navigate your AWS Observability infrastructure, as well as provide links to the app dashboards.
+
+
+
+
+Configure AWS Observability Alerts
+Sumo Logic has provided out-of-the-box alerts to help you quickly determine if a particular AWS service is available and performing as expected.
+
+
+
+
+Update the AWS Observability Stack
+Learn how to update the AWS Observability stack.
+
+
+
+
+AWS Observability Resources
+Learn more about AWS Observability resources created and modified at deployment using Terraform and CloudFormation.
+
+
+
+
+AWS Observability Terraform script and CloudFormation Changelog
+This section provides details on the available versions of the AWS Observability CloudFormation template.
+})
+1. Similarly, from the expanded account, select a region.
+
+ The **AWS Region Overview** dashboard appears in the window on the right. The dashboard provides insights into the AWS account activities in that AWS region and gives you an at-a-glance view of the health and status of the AWS services in that account-region combination.})
+1. From the expanded account and region combination, select a namespace or AWS service. The dashboard for the selected namespace appears in the window on the right. In our example, we selected the AWS EC2 Metrics namespace in the *us-east-1* region of the *prod* account.})
+
+## Drill down for root cause analysis
+
+From each level in the hierarchy, you can drill-down to individual entities by opening any logs or metrics dashboard panel. To do so:
+
+Select the graph data point you are interested in. In the following screenshot, we selected 5xx Error Codes by Load Balancer in the honeycomb graph. A list of related content links for our failed pod appears in a panel on the right.
+
+})
+
+For details, see [Drill Down to Discover Root Causes](/docs/dashboards/drill-down-to-discover-root-causes/).
+
+## Viewing AWS Observability Solution Dashboards
+
+All of the apps are installed in a folder named **Sumo Logic AWS Observability Apps** that is located in your personal folder.
+
+To add a new dashboard to your hierarchy, refer to the instructions in [Add a New AWS Service to the AWS Observability View Hierarchy](/docs/observability/aws/other-configurations-tools/add-new-aws-service).
+
+To view the app dashboards:
+
+1. Navigate to your Sumo Logic personal folder.
+1. Click an app folder to list the dashboard pages.
+1. Click a page link to view the dashboard in the window on the right.})
+
+Click a link for information on the individual app dashboards:
+
+* [AWS API Gateway](/docs/observability/aws/integrations/aws-api-gateway)
+* [AWS Application Load Balancer](/docs/observability/aws/integrations/aws-application-load-balancer)
+* [AWS DynamoDB](/docs/observability/aws/integrations/aws-dynamodb)
+* [AWS EC2 Host Metrics](/docs/observability/aws/integrations/aws-ec2-host-metrics)
+* [AWS EC2 Metrics](/docs/observability/aws/integrations/aws-ec2-metrics)
+* [AWS Lambda](/docs/observability/aws/integrations/aws-lambda)
+* [Amazon RDS](/docs/observability/aws/integrations/amazon-rds)
+* [Amazon ElastiCache](/docs/observability/aws/integrations/amazon-elasticache)
+* [Amazon ECS](/docs/observability/aws/integrations/amazon-ecs)
+* [AWS Network ELB](/docs/observability/aws/integrations/aws-network-load-balancer)
+* [AWS Classic Load Balancer](/docs/observability/aws/integrations/aws-classic-load-balancer)
+* [Amazon SNS](/docs/observability/aws/integrations/amazon-sns)
+* [Amazon SQS](/docs/observability/aws/integrations/amazon-sqs)
+
+## More Information
+
+* [Explore Monitoring Dashboards](/docs/dashboards/explore-view)
diff --git a/docs/observability/aws/faq.md b/docs/observability/aws/faq.md
index 716cd27e2e2..17276cc431d 100644
--- a/docs/observability/aws/faq.md
+++ b/docs/observability/aws/faq.md
@@ -74,11 +74,11 @@ and instructions.
### How do you set up AWS services for monitoring?
-You set up your AWS services using a AWS CloudFormation template (CFN) that is run in your AWS account. When run, resources are generated in Sumo Logic to collect logs and metrics. See [Before You Deploy](/docs/observability/aws/deploy-use-aws-observability/before-you-deploy) for prerequisites, requirements, and instructions to use the CFN.
+You set up your AWS services using a AWS CloudFormation template (CFN) that is run in your AWS account. When run, resources are generated in Sumo Logic to collect logs and metrics. See [Before You Deploy](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy) for prerequisites, requirements, and instructions to use the CFN.
### Can I deploy with CloudFormation?
-Yes, you can deploy with CloudFormation template. See [Deploy with AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/) for information.
+Yes, you can deploy with CloudFormation template. See [Deploy with AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/) for information.
If you have already set up the solution with Terraform and want to move
to CloudFormation, we recommend that you:
@@ -89,7 +89,7 @@ to CloudFormation, we recommend that you:
### Can I deploy with Terraform?
-Yes, you can deploy using a Terraform script. See [Deploy with Terraform](/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform) for detailed instructions, options, and a GitHub repository of files to use in your deployment script.
+Yes, you can deploy using a Terraform script. See [Deploy with Terraform](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform) for detailed instructions, options, and a GitHub repository of files to use in your deployment script.
If you have already set up the solution with CloudFormation in the past
and want to move to Terraform, we recommend that you:
@@ -100,7 +100,7 @@ and want to move to Terraform, we recommend that you:
### What resources are generated during set up?
-See [AWS Observability Resources](/docs/observability/aws/deploy-use-aws-observability/resources) for a complete list of resources the CloudFormation (CFN) template and Terraform Script creates at deployment in AWS and in Sumo Logic.
+See [AWS Observability Resources](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/resources) for a complete list of resources the CloudFormation (CFN) template and Terraform Script creates at deployment in AWS and in Sumo Logic.
### Why are Field Extraction Rules and Metrics Rules created as part of the installation scripts?
@@ -112,12 +112,12 @@ As of our current release, Fields and FERs will be imported into Terraform. You
Renaming an existing FER has no effect on FER usage.
-See [AWS Observability Resources](/docs/observability/aws/deploy-use-aws-observability/resources)
+See [AWS Observability Resources](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/resources)
for the list of Field Extraction Rules in the resources.
### How do you keep track of changes and make feature updates?
-Sumo Logic provides updates to the AWS Observability Solution through CloudFormation and Terraform. See the [changelog](/docs/observability/aws/deploy-use-aws-observability/changelog) to review all the changes and pointers to the CloudFormation templates associated with each version. AWS provides the ability to update a CloudFormation stack. To learn more about how to update your stack, see [Update the AWS Observability Stack](/docs/observability/aws/deploy-use-aws-observability/update-aws-observability-stack).
+Sumo Logic provides updates to the AWS Observability Solution through CloudFormation and Terraform. See the [changelog](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/changelog) to review all the changes and pointers to the CloudFormation templates associated with each version. AWS provides the ability to update a CloudFormation stack. To learn more about how to update your stack, see [Update the AWS Observability Stack](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/update-aws-observability-stack).
### What are options to monitor EC2 Host Metrics?
@@ -159,7 +159,7 @@ Host metrics use a different format than CloudWatch. They can also refer to non-
AWS Observability integrates with the [AWS Observability view](/docs/dashboards/explore-view/#aws-observability) by populating metadata and
only shows entities with metrics coming in. If you do not see expected
entities, make sure configurations are correct to collect and receive
-metrics including the [CloudWatch Namespace](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation)
+metrics including the [CloudWatch Namespace](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation)
for CloudFormation Template. You can configure metadata through
deployment configuration or manually.
diff --git a/docs/observability/aws/other-configurations-tools/integrate-control-tower-accounts.md b/docs/observability/aws/other-configurations-tools/integrate-control-tower-accounts.md
index 766ff88c2e9..936fe97d995 100644
--- a/docs/observability/aws/other-configurations-tools/integrate-control-tower-accounts.md
+++ b/docs/observability/aws/other-configurations-tools/integrate-control-tower-accounts.md
@@ -30,7 +30,7 @@ We recommend you familiarize yourself with the AWS Observability Solution. For m
* [About Sumo Logic AWS Observability](/docs/observability/aws/about.md)
* [Deploy and Use AWS Observability](/docs/observability/aws/deploy-use-aws-observability)
-* [View the AWS Observability Solution Dashboards](/docs/observability/aws/deploy-use-aws-observability/view-dashboards/)
+* [View the AWS Observability Solution Dashboards](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/view-dashboards/)
:::note
CloudTrail must be enabled for EventBridge to capture `CreateManagedAccount`, `UpdateManagedAccount` events, since these events are recorded and delivered through CloudTrail.
@@ -51,7 +51,7 @@ Integrating with AWS Control Tower takes several steps:
In this step, you configure the collection of logs and metrics for all AWS accounts managed by Control Tower, and install the apps in the solution. To do so, follow these steps for each AWS account that is managed by AWS Control Tower.
1. Log in to the AWS Management Console as the AWS account user.
-1. Follow steps 1 through 10 of the instructions in [Deploy with AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/) to configure the AWS Observability CloudFormation template.
+1. Follow steps 1 through 10 of the instructions in [Deploy with AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/) to configure the AWS Observability CloudFormation template.
1. In the **Sumo Logic AWS CloudTrail Source Details** section of the template, select **No** for **Create Sumo Logic CloudTrail Logs Source** and keep the default values for all other options. })
## Step 2: Collect from the Log Archive account
@@ -61,7 +61,7 @@ In the instructions below, we assume the Log Archive AWS account is being used o
:::
1. Log in to the AWS Management Console as the Log Archive AWS account user.
-1. Follow steps 1 through 10 of the instructions in the [Deploy with AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/) to configure the AWS Observability CloudFormation template.
+1. Follow steps 1 through 10 of the instructions in the [Deploy with AWS CloudFormation](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/) to configure the AWS Observability CloudFormation template.
1. In the **Sumo Logic Access Configuration** section of the template, fill in as required by the template.
1. In the **AWS Resources Tag Configuration** section of the template, select **None** for **Auto Enable Tagging** and enter `logarchive` as the account alias.
1. In the **Sumo Logic AWS Observability Apps Configuration** section of the template, select **No** for “Install AWS Observability Apps”, as they were installed in [Step 1](#step-1-set-up-collection-from-aws-accounts-and-install-apps), above.})
@@ -119,4 +119,4 @@ You must have a role that grants you the Manage Field Extractions capability to
## Step 4: View the AWS Observability dashboards
-Now you can start monitoring your AWS services in AWS Control Tower managed accounts. For information about the solution dashboards, see [View AWS Observability Solution Dashboards](/docs/observability/aws/deploy-use-aws-observability/view-dashboards/).
+Now you can start monitoring your AWS services in AWS Control Tower managed accounts. For information about the solution dashboards, see [View AWS Observability Solution Dashboards](/docs/observability/aws/deploy-use-aws-observability/v2.15.0/view-dashboards/).
diff --git a/sidebars.ts b/sidebars.ts
index 2ba97200e41..a018b44459c 100644
--- a/sidebars.ts
+++ b/sidebars.ts
@@ -2007,26 +2007,66 @@ module.exports = {
collapsed: true,
link: {type: 'doc', id: 'observability/aws/deploy-use-aws-observability/index'},
items: [
- 'observability/aws/deploy-use-aws-observability/before-you-deploy',
{
type: 'category',
- label: 'Deploy with AWS CloudFormation',
+ label: 'v3.0.0 (latest)',
collapsible: true,
collapsed: true,
- link: {type: 'doc', id: 'observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/index'},
+ link: {type: 'doc', id: 'observability/aws/deploy-use-aws-observability/v3.0.0/index'},
items: [
- 'observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions',
- 'observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/automatic-installation-script',
- 'observability/aws/deploy-use-aws-observability/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/before-you-deploy',
+ {
+ type: 'category',
+ label: 'Deploy with AWS CloudFormation',
+ collapsible: true,
+ collapsed: true,
+ link: {type: 'doc', id: 'observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/index'},
+ items: [
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/automatic-installation-script',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection',
+ ],
+ },
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/deploy-with-terraform',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/migration-strategy-using-terraform',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/view-dashboards',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/configure-alerts',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/update-aws-observability-stack',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/resources',
+ 'observability/aws/deploy-use-aws-observability/v3.0.0/changelog',
+ ],
+ },
+ {
+ type: 'category',
+ label: 'v2.15.0',
+ collapsible: true,
+ collapsed: true,
+ link: {type: 'doc', id: 'observability/aws/deploy-use-aws-observability/v2.15.0/index'},
+ items: [
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/before-you-deploy',
+ {
+ type: 'category',
+ label: 'Deploy with AWS CloudFormation',
+ collapsible: true,
+ collapsed: true,
+ link: {type: 'doc', id: 'observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/index'},
+ items: [
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/deploy-multiple-accounts-regions',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/automatic-installation-script',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-aws-cloudformation/centralized-aws-cloudtrail-log-collection',
+ ],
+ },
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/deploy-with-terraform',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/migration-strategy-using-terraform',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/view-dashboards',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/configure-alerts',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/update-aws-observability-stack',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/resources',
+ 'observability/aws/deploy-use-aws-observability/v2.15.0/changelog',
],
},
- 'observability/aws/deploy-use-aws-observability/deploy-with-terraform',
- 'observability/aws/deploy-use-aws-observability/migration-strategy-using-terraform',
- 'observability/aws/deploy-use-aws-observability/view-dashboards',
- 'observability/aws/deploy-use-aws-observability/configure-alerts',
- 'observability/aws/deploy-use-aws-observability/update-aws-observability-stack',
- 'observability/aws/deploy-use-aws-observability/resources',
- 'observability/aws/deploy-use-aws-observability/changelog',
+ 'observability/aws/deploy-use-aws-observability/migration-strategy-v2x-to-v300-cloudformation',
+ 'observability/aws/deploy-use-aws-observability/migration-strategy-v2x-to-v300-manual',
],
},
{
diff --git a/static/img/observability/migration-arn-cfn-stack-resources.png b/static/img/observability/migration-arn-cfn-stack-resources.png
new file mode 100644
index 00000000000..118aca7f668
Binary files /dev/null and b/static/img/observability/migration-arn-cfn-stack-resources.png differ
diff --git a/static/img/observability/migration-arn-common-resources-role.png b/static/img/observability/migration-arn-common-resources-role.png
new file mode 100644
index 00000000000..b861f95ced0
Binary files /dev/null and b/static/img/observability/migration-arn-common-resources-role.png differ
diff --git a/static/img/observability/migration-arn-iam-role-summary.png b/static/img/observability/migration-arn-iam-role-summary.png
new file mode 100644
index 00000000000..214c8db535e
Binary files /dev/null and b/static/img/observability/migration-arn-iam-role-summary.png differ
diff --git a/static/img/observability/migration-remove-on-delete.png b/static/img/observability/migration-remove-on-delete.png
new file mode 100644
index 00000000000..9b45e84b8c5
Binary files /dev/null and b/static/img/observability/migration-remove-on-delete.png differ