Cloudwatch

Connect AWS CloudWatch to NOFire AI to query and analyze application logs across Kubernetes and microservices environments. NOFire AI uses these logs during investigation and automated root cause analysis. NOFire AI follows AWS best practices for secure access, using an assumed role and an external ID.

​

Prerequisites

• An AWS account, and permission to create IAM policies and roles in it.
• Your 12-digit AWS account ID, and the region your log groups are in.
• The external ID shown on the NOFire AI dashboard when you add the connection.

​

Step 1: Create IAM role

Navigate to AWS IAM console

Open the AWS Management Console with an account that has permission to create IAM roles. Then follow the steps below:

1. Access IAM: Navigate to the IAM service in the AWS console.
2. Copy the following IAM policy. You will attach it to the role that you create later.
   nofireai-iam-policy.json

   {
   	"Version": "2012-10-17",
   	"Statement": [
   		{
   			"Sid": "LogsPermissions",
   			"Effect": "Allow",
   			"Action": [
   				"logs:StartQuery",
   				"logs:GetQueryResults",
   				"logs:DescribeLogGroups",
   				"logs:DescribeLogStreams"
   			],
   			"Resource": "arn:aws:logs:us-east-1:<your-account-id>:log-group:/aws/containerinsights/*/*"
   		}
   	]
   }
   
3. Create a new policy: In the navigation pane on the left, choose Policies > Create policy.
4. Finalize and review: Create a name and description for the IAM policy: If everything is correct, click the Create policy button at the bottom right corner.
5. Create a new role: In the navigation pane on the left, choose Roles > Create role.
6. Enter credentials:
   • Add NOFire AI’s Account ID: In the Account ID input box, paste the NOFire AI AWS Account ID: 593113792344. This gives NOFire AI access to the IAM role.
   • Add an External ID: Under Options, enter an external ID.
7. Assign permissions: On the permissions console, use the Filter and select Customer Managed. Search for the policy name that you provided in step 4, then click Next.
8. Finalize and review: Create a name and description for the IAM role, and then review the configurations.
9. If everything is correct, click the Create role button at the bottom right corner.
10. Copy the Role ARN: After you create the role, open it and copy the role ARN. You will need this to complete the connection setup on the NOFire AI dashboard.

​

Step 2: Add AWS CloudWatch connection to NOFire AI

Navigate to the Connections Tab

1. Go to Connections and click Connect on Cloudwatch.
2. Enter credentials:
   1. Name (for example, production)
   2. Region (for example, us-east-1)
   3. IAM Role ARN
   4. External ID

      

      
      Click Save to create the connection
3. After you connect to your log source, NOFire AI queries and analyzes logs on demand as part of its automated root cause analysis. Logs enrich the investigation process.

​

Test the connection

1. Open the Connections dashboard and make sure that the CloudWatch connection status is READY. A connection that stays in an error state did not authenticate.
2. Ask NOFire a question that needs logs, for example “show me the errors for the checkout service in the last hour”. An answer that quotes your log lines confirms the connection works end to end.

​

Troubleshooting