Nzalerts on AWS

This guide outlines two methods to set up Nzalerts on Amazon Web Services (AWS):

Setup Options

Option 1: AWS SNS method using cross-account managed identity

Uses an SNS topic with access granted to the NZEvents AWS role.

Option 2: AWS SNS method using credentials

Involves creating a user, role, and credentials, with full control managed by the user.

Option 3: Email method

This involves adding and configuring email notification method.

Option 1: AWS SNS method using cross-account managed identity

This method is simpler and uses an existing AWS role to publish events to your SNS topic.

Step 1: Setup SNS topic

Log in to your AWS account.
Search for SNS in the AWS console.
Go to Topics -> Create Topic.
Fill in the required details: Type, Name, and Display Name.
After creation, locate the ARN in the topic details and save it for later. See, <YOUR_SNS_TOPIC_ARN>.

Step 2: Create notification method using ARN method

Using nzsql

See Notification and event rule management for NPS events for creating a notification method.

Example:

CREATE NOTIFICATION METHOD <NOTIFICATION-METHOD-NAME>
TYPE AWS_SNS
AWS_TOPIC_ARN '<YOUR_SNS_TOPIC_ARN>';

Using NPS console

Go to Settings -> Monitoring and alerts section.
Navigate to Add method radio button and click it.
In the Select method section, from the drop down choose AWS SNS and provide the name for the notification method and click next.
In the Configure method section, enter <YOUR_SNS_TOPIC_ARN> in the field for topic ARN and click confirm.

Step 3: Get ROLE ARN

Using nzsql

Run SHOW NOTIFICATION METHOD in nzsql like the following.

SHOW NOTIFICATION METHOD;

NAME	TYPE
EXAMPLE_EMAIL_NM_1	EMAIL
EXAMPLE_AWS_SNS_NM_1	AWS_SNS

Identify the method created using the SNS ARN.

In nzsql, run the following:

SHOW NOTIFICATION METHOD EXAMPLE_AWS_SNS_NM_1;

NAME	TYPE	AWS_TOPIC_ARN	AWS_ROLE_ARN
EXAMPLE_AWS_SNS_NM_1	AWS_SNS	`arn:aws:sns:<region>:<account-id>:<topic-name>`	`arn:aws:iam::<account-id>:role/<role-name>`

Copy the AWS_ROLE_ARN from the output and save it for later use.

Using NPS console

Go to Settings -> Alerts and monitoring, then expand the notification method which you have created in the earlier step.
Copy the value for AWS_ROLE_ARN field and store the AWS ROLE ARN for later use.

Step 3: Configure SNS topic access policy

Go to AWS console -> SNS -> Edit.
In the Access Policy section, add the following (replace placeholders):

{
  "Effect": "Allow",
  "Principal": {
    "AWS": [
      "<AWS_ROLE_ARN>"
    ]
  },
  "Action": "sns:Publish",
  "Resource": "<YOUR_SNS_TOPIC_ARN>"
}

Option 2: AWS SNS method using credentials

This method provides full control over user and role creation, suitable for custom setups.

Step 1: Setup SNS topic

Follow the same steps as in the ARN Method to create and retrieve the SNS Topic ARN.

Step 2: Get access key ID and secret

Refer to the AWS documentation:

Get Access Key ID and Secret Credentials.

Step 3: Create user

Log in to AWS account -> Navigate to IAM.
Go to Users -> Create User.
Enter user details.
Skip permissions -> Click Next.
Review and create the user.
Copy and store the User ARN. See, <YOUR_USER_ARN>.

Step 4: Create role policy

Go to IAM -> Policies -> Create Policy.
Choose JSON and paste:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sns:Publish",
      "Resource": "<YOUR_SNS_TOPIC>"
    }
  ]
}

Click Next, provide policy details, and save the policy name.

Step 5: Create role

Go to IAM -> Roles -> Create Role.
Select Custom Trust Policy.
Paste the following (replace <YOUR_USER_ARN>):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<YOUR_USER_ARN>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Click Next, attach the previously created policy.
Enter role details and create the role.
Copy and store the ROLE ARN.

Step 6: Configure SNS topic access policy

Go to the SNS topic -> Edit.
In the Access Policy section, add:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": [
      "<YOUR_ROLE_ARN>"
    ]
  },
  "Action": "SNS:Publish",
  "Resource": "<YOUR_SNS_TOPIC_ARN>"
}

Step 7: Create and attach user policy

Go to IAM -> Policies -> Create Policy.
Paste the following JSON:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "<YOUR_ROLE_ARN>"
    }
  ]
}

Click Next, provide policy details, and save the policy name.

Step 8: Create notification method using credentials

Using nzsql

See Notification and event rule management for NPS events for creating a notification method.

Example:

  CREATE NOTIFICATION METHOD <NOTIFICATION-METHOD-NAME>
  TYPE AWS_SNS
  AWS_TOPIC_ARN '<YOUR_SNS_TOPIC_ARN>'
  AWS_ROLE_ARN '<YOUR_ROLE_ARN>'
  AWS_ACCESSKEY_ID 'XXXXX'
  AWS_ACCESSKEY_SECRET 'XXXXX';

Use the access key id and access key secret created in previous step.

Using NPS console

Go to Settings -> Monitoring and alerts section.
Navigate to Add method radio button and click it.
In the Select method section, from the select method drop down choose AWS SNS and provide the name for the notification method in the enter method name field and click next.
In the Configure method section, enter <YOUR_SNS_TOPIC_ARN> in the field for topic ARN.
Click on the add role ARN checkbox.
Enter <YOUR_ROLE_ARN> in the Role ARN field.
Enter access key id and access key secret created before.
Click Confirm.

Option 3: Email method

Go to Settings -> Monitoring and alerts section.
Navigate to Add method radio button and click it.
In the Select method section, from the select method drop down choose Email and provide the name for the notification method in the enter method name field and click next.
In the Configure method section, enter the mail address in the respective fields.
Click Confirm.

Create rule for Email method

Go to Settings -> Monitoring and alerts section.
Navigate to Create rule -> Define rule.
Enter rule name and enable the status and click Next.
Go to Select destination, select the destination as Email and choose email method.
Click Next to go to Choose event.
Enter the details and click Next to go to Event expression.
Fill in the necessary fields and click Confirm to complete the rule setup.