运行本地 Cloudwatch 代理时出现“无法确定 aws-region”

Question

我正在尝试将 AWS Cloudwatch 代理配置为在 AWS 之外的普通 Ubuntu 18.04 上运行。每次我运行它时，我都会收到此错误：

# /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m onPremise -c "file:/path/to/cloudwatch/cloudwatch.json" -s
/opt/aws/amazon-cloudwatch-agent/bin/config-downloader --output-dir /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d --download-source file:/path/to/cloudwatch/cloudwatch.json --mode onPrem --config /opt/aws/amazon-cloudwatch-agent/etc/common-config.toml --multi-config default
Got Home directory: /root
I! Set home dir Linux: /root
Unable to determine aws-region.
Please make sure the credentials and region set correctly on your hosts.
Refer to http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html
Fail to fetch the config!

运行该程序strace -f表明它正在尝试读取/root/.aws/credentials然后退出。根据指南，以下是以下内容/root/.aws/credentials：

[AmazonCloudWatchAgent]
aws_access_key_id = key
aws_secret_access_key = secret
region = us-west-2

如果我运行aws configure get region，它能够正确检索该区域。但是，Cloudwatch 代理无法读取它。common-config.toml这是（根据 strace 也可以读取）的内容。

## Configuration for shared credential.
## Default credential strategy will be used if it is absent here:
##  Instance role is used for EC2 case by default.
##  AmazonCloudWatchAgent profile is used for onPremise case by default.
[credentials]
   shared_credential_profile = "AmazonCloudWatchAgent"
   shared_credential_file = "/root/.aws/credentials"


## Configuration for proxy.
## System-wide environment-variable will be read if it is absent here.
## i.e. HTTP_PROXY/http_proxy; HTTPS_PROXY/https_proxy; NO_PROXY/no_proxy
## Note: system-wide environment-variable is not accessible when using ssm run-command.
## Absent in both here and environment-variable means no proxy will be used.
# [proxy]
#    http_proxy = "{http_url}"
#    https_proxy = "{https_url}"
#    no_proxy = "{domain}"

以下是我尝试过的其他事情：

• 根据https://forums.aws.amazon.com/thread.jspa?threadID=291589 ，将region配置中的（和所有值）用双引号引起来。这没有什么区别。

• 添加 /home/myuser/.aws/config、/home/myuser/.aws/credentials 和 /root/.aws/config 并使用适当的值填充它们。根据 strace，这些文件未被读取。

• 搜索 CloudWatch Agent 的源代码（它不是开源的）

• 在程序环境中显式设置 AWS_REGION=us-west-2 （相同错误）

• 更改[AmazonCloudWatchAgent]为[profile AmazonCloudWatchAgent]上述所有位置和所有排列（没有区别）

• 在所有配置文件中添加一个[default]部分（没有区别）

• config-downloader直接调用程序，设置AWS_REGION等（同样的错误）

• 成为非 root 用户，然后使用调用该程序，sudo而不是在不使用 的情况下以 root 用户身份调用该程序sudo。

无论我尝试什么，我都会遇到同样的错误。我按照这些说明于 2020 年 3 月 23 日下载“最新”deb，安装了 CloudWatch 代理。https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/download-cloudwatch-agent-commandline.html

Answer 1

aws 配置默认为 C:\Users\Administrator，而不是您安装 CloudWatch 代理的用户。因此，您可能需要将 /.aws/ 文件夹移动到 CLoudWatch 用户。或者...更简单：

aws configure --profile AmazonCloudWatchAgent

如下所述： https: //docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.html#install-CloudWatch-Agent-iam_user-first

common-config.toml您还可以按照此处所述指定区域：https: //docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.html#CloudWatch-Agent-profile-instance-first

在运行 Windows Server 的服务器上，此文件位于 C:\ProgramData\Amazon\AmazonCloudWatchAgent 目录中。默认的common-config.toml如下：

# This common-config is used to configure items used for both ssm and cloudwatch access


## Configuration for shared credential.
## Default credential strategy will be used if it is absent here:
##            Instance role is used for EC2 case by default.
##            AmazonCloudWatchAgent profile is used for onPremise case by default.
# [credentials]
#    shared_credential_profile = "{profile_name}"
#    shared_credential_file= "{file_name}"

## Configuration for proxy.
## System-wide environment-variable will be read if it is absent here.
## i.e. HTTP_PROXY/http_proxy; HTTPS_PROXY/https_proxy; NO_PROXY/no_proxy
## Note: system-wide environment-variable is not accessible when using ssm run-command.
## Absent in both here and environment-variable means no proxy will be used.
# [proxy]
#    http_proxy = "{http_url}"
#    https_proxy = "{https_url}"
#    no_proxy = "{domain}"

如果需要，您还可以使用新位置更新 common-config.toml。

Answer 2

我使用了不正确的“秘密”和无效字符，导致 INI 文件解析器崩溃。CloudWatch 代理错误地将其报告为“缺失区域”，而解析错误或“无效机密”错误则更为准确。