Metrics monitor for IBM Verify SaaS

Important Notes: Before using this product, you should have an active IBM Verify SaaS tenant (aka ISV). This product extends the capability to monitor IBM Verify SaaS and without it, this product cannot function. Please note that IBM Verify SaaS will require its own license/subscription. This product also requires an ongoing internet connection with your IBM Verify SaaS tenant. IBM Verify SaaS is available on AWS marketplace. For information, please refer https://aws.amazon.com/marketplace/pp/prodview-zmue2hhq2fkxk 

In summary, this product requires following services to function:

• Your own IBM Verify SaaS tenant
• Your own monitoring tool that supports prometheus for visualisation of the metrics.
• Customers are responsible for the use of and ensuring the availability and security of all listed external resources.

Preparation: Gather following information before starting the deployment.

• Type of instance (t3.small, t3.medium or t3.large) - t3.medium is recommended
• Region, target VPC and subnet under that VPC
• Environment identifier (referred as envID here onwards)
• Agent identifier (referred as agentID here onwards)
• Operational mode (with Amazon Managed Prometheus or self hosted Prometheus)
• Workspace re-write URL in case of Amazon Managed Prometheus
• Username, password and CIDR to control access to agent endpoint
• Client id and secret generated on target IBM Verify SaaS tenant NOTE: Client id requires API permissions - manage application lifecycle, read external agents. read webhooks, read certificates, read reports, read users and groups

CloudFormation template: CloudFormation template will provision following AWS resources.

• A Secret (envID_agentID-mm-isv-secret) on AWS Secret Manager to hold configuration and secret data
• A IAM role (envID_agentID-mm-isv-role) and policy (envID_agentID-mm-isv-policy) to allow EC2 access to secret and Amazon Managed Prometheus workspace
• EC2 instance (envID_agentID-mm4isv) to run agent

Deployment: Follow the steps below to setup metric monitoring agent for ISV.

1. Launch the product using 1-Click.
2. Supply all configuration requested in the form and submit the request.
3. Logs can be accessed from http://EC2InstanceIP:9401/agentID/iamboards/logs  after successful completion of CloudFormation process.
4. Configure monitoring tool, this depends the operational mode chosen at the time of deployment (step 2).

• Mode 1 (Push) - Add Amazon Managed Prometheus workspace as a data source in monitoring tool.
• Mode 2 (Pull) - Configure self hosted prometheus server to /agentID/iamboards/metrics http endpoint of the agent. Add this prometheus as a data source in monitoring tool.

5. Build dashboards using the data generated by agent

Health check: EC2 Instance -

• Navigate to Amazon EC2 console and verify that the region is correct.
• Choose instance and select metrics monitor instance (envID_agentID-mm4isv)
• Select the server to display metadata page and choose the status check tab at the bottom of the page to review if status checks passed or failed. Agent service -
• Access health check endpoint http://EC2InstanceIP:9401/health  to review agent is healthy or not.

Secret rotation and configuration changes: Follow the steps below to handle change in secret or configuration.

• Access the secret (envID_agentID-mm-isv-secret) and update the required details
• Restart the EC2 instance (envID_agentID-mm4isv) from Amazon EC2 console to apply configuration changes.

Upgrade: There are 2 options to handle upgrade. Option 1 -

• Setup a brand new EC2 instance with latest version and different agentID using 1 click deployment.
• Remove old CloudFormation once new instance is healthy Option 2 -
• Copy user data content from the existing EC2 instance where agent is running
• Create a new EC2 instance with the latest version of product AMI with user data copied from old instance (step1)
• Remove old EC2 instance once new instance is healthy.