사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill aws-network-monitoring시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
AWS Network Monitoring
Overview
Domain expertise for installing and configuring Amazon CloudWatch Network Flow Monitor agents on EC2 instances. Covers IAM permission setup, agent installation via SSM Distributor or command-line install, agent activation, verification, and troubleshooting.
Network Flow Monitor agents are lightweight software that publish performance metrics (latency, packet loss) to the Network Flow Monitor backend, enabling monitoring of network path health between workloads.
Works best with the AWS MCP server — enables running SSM commands, attaching IAM policies, and validating agent status directly. All guidance also works with standard AWS CLI access.
Routing
| User need | Action |
|---|---|
| Installing Network Flow Monitor agents on EC2 | Read agent-install-ec2.md |
| Configuring IAM for Network Flow Monitor agents | Read agent-permissions.md |
| Troubleshooting Network Flow Monitor agents (403, no metrics, connectivity) | Read troubleshooting.md |
| Spans multiple areas | Read the most specific reference first, then consult others as needed |
Files
| File | Content |
|---|---|
| agent-install-ec2.md | End-to-end Network Flow Monitor agent installation via SSM Distributor, activation, verification |
| agent-permissions.md | IAM policy setup for Network Flow Monitor agent metric publishing |
| troubleshooting.md | Error → cause → fix for Network Flow Monitor agent issues (HTTP 403, missing metrics, connectivity) |
Supported versions
For supported Linux distributions, kernel versions, and architectures, see the AWS documentation. Windows is not supported.
Security Considerations
- Least-privilege IAM: Attach only
CloudWatchNetworkFlowMonitorAgentPublishPolicyfor publishing metrics andAmazonSSMManagedInstanceCorefor SSM management. Do not use*FullAccesspolicies. - Private subnets: When the instance is in a private subnet, prefer VPC endpoints for SSM (
com.amazonaws.<region>.ssm,.ssmmessages,.ec2messages) over a NAT gateway to keep traffic on the AWS network. - Credential storage: Never embed AWS credentials on the instance; the publish policy MUST be attached to the instance role, not configured as static keys.
- Audit trail: Ensure CloudTrail is enabled in the account so SSM
SendCommandinvocations and IAMAttachRolePolicyactions performed during agent setup are logged for security investigations. - References: CloudWatch Network Flow Monitor security, IAM best practices
