Skip to main content
Version: 3.2.7

Configure Amazon Web Services Resource Collection

The Amazon Web Services (AWS) collector is configured within the Resoto Worker configuration via the config command in Resoto Shell.

Enabling the Collector

  1. Open the Resoto Worker configuration via the config command in Resoto Shell:

    > config edit resoto.worker
  2. Add aws to the list of collectors by modifying the configuration as follows:

    resotoworker:
    ...
    # List of collectors to run
    collector:
    - 'aws'
    ...
    ...

Authentication

Resoto supports the authentication mechanisms described in the Boto3 SDK documentation. You can authenticate with AWS via an instance profile, an access key, or profiles. These credentials can be defined in the Resoto Worker configuration or as environment variables.

  1. Configure an instance profile.

  2. Create a file ~/.aws/credentials with the credentials for the created instance profile:

    ~/.aws/credentials
    [default]
    region = us-west-2

    role_arn = arn:aws:iam::235059640852:role/Resoto
    external_id = a5eMybsyGIowimdZqpZWxxxxxxxxxxxx
    credential_source = Ec2InstanceMetadata
  3. Make your credentials file available to Resoto at /home/resoto/.aws:

    • Add the following volume definition to the resotoworker service in docker-compose.yaml:

      docker-compose.yaml
      services:
      ...
      resotoworker:
      image: somecr.io/someengineering/resotoworker:3.2.7
      container_name: resotoworker
      ...
      volumes:
      - $HOME/.aws:/home/resoto/.aws
      ...
      ...
    • Recreate the resotoworker container with the updated service definition:

      $ docker-compose up -d
      note

      Docker Compose V2 integrated compose functions in to the Docker platform.

      In Docker Compose V2, the command is docker compose (no hyphen) instead of docker-compose.

  4. Open the Resoto Worker configuration via the config command in Resoto Shell:

    > config edit resoto.worker
  5. Modify the aws section of the configuration as follows, making sure that aws.access_key_id and aws.secret_access_key are set to null:

    Resoto Worker configuration
    resotoworker:
    ...
    ...
    aws:
    # AWS Access Key ID (null to load from env - recommended)
    access_key_id: null
    # AWS Secret Access Key (null to load from env - recommended)
    secret_access_key: null
    ...

Authorization

See How to Roll Out Resoto AWS Permissions with CloudFormation for a step-by-step guide on how to roll out Resoto permissions organization-wide.

If you prefer to deploy the role yourself, the S3 URL of the template to create the ResotoAccess role is https://resotopublic.s3.amazonaws.com/cf/resoto-role.template.

Resource Collection

By default, Resoto performs resource collection each hour. To immediately trigger a collect run, use the workflow run command in Resoto Shell:

> workflow run collect

Once the collect run completes, you can view a summary of collected AWS resources using the following search:

> search is(aws_resource) | count kind