AWS Systems ManagerとCloudWatchでオンプレミスサーバーを監視しよう！

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": {"Service": "ssm.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }
}

「An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: The policy must contain a valid version string」

aws iam create-role --role-name SSMServiceRole --assume-role-policy-document file://SSMService-Trust.json

aws iam attach-role-policy --role-name SSMServiceRole --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM

aws ssm create-activation --default-instance-name MyServers --iam-role SSMServiceRole --registration-limit 10　--expiration-date '2018-10-21 00:00:00' --region us-east-2

mkdir /tmp/ssm
curl https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm -o /tmp/ssm/amazon-ssm-agent.rpm
sudo yum install -y /tmp/ssm/amazon-ssm-agent.rpm
sudo systemctl stop amazon-ssm-agent
sudo amazon-ssm-agent -register -code "activation-code" -id "activation-id" -region us-east-2
sudo systemctl start amazon-ssm-agent

aws configure --profile AmazonCloudWatchAgent

sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard

On which OS are you planning to use the agent?
1. linux
2. windows
default choice: [1]:
選択 1

Trying to fetch the default region based on ec2 metadata...
Are you using EC2 or On-Premises hosts?
1. EC2
2. On-Premises
default choice: [2]:
選択 2

Please make sure the credentials and region set correctly on your hosts.
Refer to http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html
Do you want to turn on StatsD daemon?
(StatsDは、Node.js上で稼動するデータ収集デーモン)
1. yes
2. no
default choice: [1]:
選択 1

Which port do you want StatsD daemon to listen to?
8125 (デフォルト)

What is the collect interval for StatsD daemon?
1. 10s
2. 30s
3. 60s
default choice: [1]:
選択 1

What is the aggregation interval for metrics collected by StatsD daemon?
1. Do not aggregate
2. 10s
3. 30s
4. 60s
default choice: [4]:
選択 4

Do you want to monitor metrics from CollectD?
(CollectDとは、SNMP等を使用せずに単体で動作する、サーバの統計情報を収集するためのオープンソースソフトウェア、導入していない場合はインストールする)
1. yes
2. no
default choice: [1]:
選択 1

Do you want to monitor any host metrics? e.g. CPU, memory, etc.
1. yes
2. no
default choice: [1]:
選択 1

Do you want to monitor cpu metrics per core? Additional CloudWatch charges may apply.
1. yes
2. no
default choice: [1]:
選択 1

Would you like to collect your metrics at high resolution (sub-minute resolution)? 
This enables sub-minute resolution for all metrics, but you can customize for specific metrics in the output json file.
1. 1s
2. 10s
3. 30s
4. 60s
default choice: [4]:
選択 4

Which default metrics config do you want?
1. Basic
2. Standard
3. Advanced
4. None
default choice: [1]:
選択 1
(それぞれの監視対象は、Amazon CloudWatch - ユーザーガイドを参照ください)
(https://docs.aws.amazon.com/ja_jp/AmazonCloudWatch/latest/monitoring/acw-ug.pdf#page=87)

Current config as follows:
{ ・・・・・・json形式で、config内容が出力されます。ここでは割愛します。

}

Are you satisfied with the above config? Note: it can be manually customized after the wizard completes to add additional items.
1. yes
2. no
default choice: [1]:
選択 1

Do you have any existing CloudWatch Log Agent (http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html) configuration file to import for migration?
1. yes
2. no
default choice: [2]:
選択 2
(CloudWatch Log Agentは利用しないため、2を選択)

Do you want to monitor any log files?
1. yes
2. no
default choice: [1]:
2
(今回はログ監視はしないため、2を選択)

Saved config file to /opt/aws/amazon-cloudwatch-agent/bin/config.json successfully.
Current config as follows:
{ ・・・・・・json形式で、config内容が出力されます。ここでは割愛します。

}

Please check the above content of the config.
The config file is also located at /opt/aws/amazon-cloudwatch-agent/bin/config.json.
Edit it manually if needed.
Do you want to store the config in the SSM parameter store?
1. yes
2. no
default choice: [1]:
選択 1

What parameter store name do you want to use to store your config? (Use 'AmazonCloudWatch-' prefix if you use our managed AWS policy)
default choice: [AmazonCloudWatch-linux]
入力 AmazonCloudWatch-linux
Which region do you want to store the config in the parameter store?
default choice: [us-east-2]
入力 us-west-2
(アクティベーションを作成したリージョンを指定)

Which AWS credential should be used to send json config to parameter store?
1. XXXXXXXXX....(From SDK)
2. YYYYYYYYY....(From Profile: AmazonCloudWatchAgent)
3. Other
default choice: [1]:
選択 3
(一番初めの CloudWatch Agentに必要なIAMユーザー作成 にて作成した二つ目のIAMユーザーを利用します)

Please make sure the creds you used have the right permissions configured for SSM access.
Please provide credentials to upload the json config file to parameter store.
AWS Access Key:
入力 ZZZZZZZZZ.....
AWS Secret Key:
入力 XYZXYZXYZXYZXYZXYZ....

Successfully put config to parameter store AmazonCloudWatch-linux.
Program exits now.

"netstat": { 
　"measurement":[
　　　"tcp_established"
　], 
　"metrics_collection_interval": 60 
},