aws-network-monitoring

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

AWS Network Monitoring

AWS网络监控

Overview

概述

Domain expertise for installing and configuring Amazon CloudWatch Network Flow Monitor agents on EC2 instances. Covers IAM permission setup, agent installation via SSM Distributor or command-line install, agent activation, verification, and troubleshooting.

Network Flow Monitor agents are lightweight software that publish performance metrics (latency, packet loss) to the Network Flow Monitor backend, enabling monitoring of network path health between workloads.

Works best with the AWS MCP server — enables running SSM commands, attaching IAM policies, and validating agent status directly. All guidance also works with standard AWS CLI access.

本内容提供在EC2实例上安装和配置Amazon CloudWatch Network Flow Monitor代理的领域专业知识。涵盖IAM权限设置、通过SSM Distributor或命令行安装代理、代理激活、验证以及故障排查。

Network Flow Monitor代理是轻量级软件，可将性能指标（延迟、丢包）上报至Network Flow Monitor后端，从而实现对工作负载之间网络路径健康状况的监控。

最佳搭配 AWS MCP服务器 —— 支持直接运行SSM命令、附加IAM策略并验证代理状态。所有指南也适用于标准AWS CLI访问。

Routing

路由

User need	Action
Installing Network Flow Monitor agents on EC2	Read agent-install-ec2.md
Configuring IAM for Network Flow Monitor agents	Read agent-permissions.md
Troubleshooting Network Flow Monitor agents (403, no metrics, connectivity)	Read troubleshooting.md
Spans multiple areas	Read the most specific reference first, then consult others as needed

用户需求	操作
在EC2上安装Network Flow Monitor代理	阅读 agent-install-ec2.md
为Network Flow Monitor代理配置IAM	阅读 agent-permissions.md
排查Network Flow Monitor代理问题（403、无指标、连接问题）	阅读 troubleshooting.md
涉及多个领域	先阅读最相关的参考文档，再根据需要查阅其他文档

Files

文件

File	Content
agent-install-ec2.md	End-to-end Network Flow Monitor agent installation via SSM Distributor, activation, verification
agent-permissions.md	IAM policy setup for Network Flow Monitor agent metric publishing
troubleshooting.md	Error → cause → fix for Network Flow Monitor agent issues (HTTP 403, missing metrics, connectivity)

文件	内容
agent-install-ec2.md	通过SSM Distributor完成Network Flow Monitor代理的端到端安装、激活和验证
agent-permissions.md	为Network Flow Monitor代理指标上报配置IAM策略
troubleshooting.md	Network Flow Monitor代理问题（HTTP 403、指标缺失、连接问题）的错误→原因→解决方案

Supported versions

支持版本

For supported Linux distributions, kernel versions, and architectures, see the AWS documentation. Windows is not supported.

关于支持的Linux发行版、内核版本和架构，请查看AWS文档。暂不支持Windows系统。

Security Considerations

安全注意事项

Least-privilege IAM: Attach only
```
CloudWatchNetworkFlowMonitorAgentPublishPolicy
```
for publishing metrics and
```
AmazonSSMManagedInstanceCore
```
for SSM management. Do not use
```
*FullAccess
```
policies.
Private subnets: When the instance is in a private subnet, prefer VPC endpoints for SSM (
```
com.amazonaws.<region>.ssm
```
,
```
.ssmmessages
```
,
```
.ec2messages
```
) over a NAT gateway to keep traffic on the AWS network.
Credential storage: Never embed AWS credentials on the instance; the publish policy MUST be attached to the instance role, not configured as static keys.
Audit trail: Ensure CloudTrail is enabled in the account so SSM
```
SendCommand
```
invocations and IAM
```
AttachRolePolicy
```
actions performed during agent setup are logged for security investigations.
References: CloudWatch Network Flow Monitor security, IAM best practices

最小权限IAM：仅附加用于上报指标的
```
CloudWatchNetworkFlowMonitorAgentPublishPolicy
```
和用于SSM管理的
```
AmazonSSMManagedInstanceCore
```
。请勿使用
```
*FullAccess
```
策略。
私有子网：当实例位于私有子网中时，优先使用SSM的VPC端点（
```
com.amazonaws.<region>.ssm
```
、
```
.ssmmessages
```
、
```
.ec2messages
```
）而非NAT网关，以确保流量在AWS网络内传输。
凭证存储：切勿在实例中嵌入AWS凭证；上报策略必须附加到实例角色，而非配置为静态密钥。
审计追踪：确保账户中已启用CloudTrail，以便记录代理设置过程中执行的SSM
```
SendCommand
```
调用和IAM
```
AttachRolePolicy
```
操作，用于安全调查。
参考文档：CloudWatch Network Flow Monitor安全、IAM最佳实践