Monitor AWS with Zabbix 7.4 (AWS by HTTP) — CloudShell-only IAM, Host Wizard, and Cost Explorer

Zabbix 7.4 includes AWS by HTTP templates. You create a single account host (e.g., aws-prod) and link only the base template AWS by HTTP. That template performs discovery and automatically creates child hosts (EC2, RDS, ECS, ELB, Lambda, S3) with the correct service templates attached. The optional AWS Cost Explorer by HTTP template is the only one you add separately to the account host for spend data.

Cost basics

CloudWatch GetMetricData is billed by metrics retrieved (~$0.01 per 1,000 metrics).
Cost Explorer (CE) API: $0.01 per request. Optional hourly granularity ≈ $0.01 / 1,000 hourly usage records / month.

Create AWS access in CloudShell (CLI-only, least privilege)

Open AWS CloudShell. Run:

Policies (core + optional CE)

cat > zabbix-aws-readonly.json <<'JSON'
{ "Version":"2012-10-17","Statement":[{ "Effect":"Allow","Action":[
"cloudwatch:DescribeAlarms","cloudwatch:GetMetricData",
"ec2:DescribeInstances","ec2:DescribeVolumes","ec2:DescribeRegions","ec2:DescribeSecurityGroups",
"rds:DescribeEvents","rds:DescribeDBInstances",
"ecs:DescribeClusters","ecs:ListClusters","ecs:ListServices","ecs:ListTasks",
"elasticloadbalancing:DescribeLoadBalancers","elasticloadbalancing:DescribeTargetGroups",
"lambda:ListFunctions",
"s3:ListAllMyBuckets","s3:GetBucketLocation","s3:GetMetricsConfiguration",
"backup:ListBackupVaults","backup:ListBackupJobs","backup:ListCopyJobs","backup:ListRestoreJobs"
], "Resource":"*" }]}
JSON

cat > zabbix-cost-readonly.json <<'JSON'
{ "Version":"2012-10-17","Statement":[
  {"Effect":"Allow","Action":["ce:GetCostAndUsage","ce:GetDimensionValues"],"Resource":"*"}
]}
JSON

User + attach

USER=zabbix-aws-monitor

aws iam create-user --user-name "$USER"

READONLY_ARN=$(aws iam create-policy \
  --policy-name ZabbixAWSReadOnly \
  --policy-document file://zabbix-aws-readonly.json \
  --query Policy.Arn --output text)
aws iam attach-user-policy --user-name "$USER" --policy-arn "$READONLY_ARN"

COST_ARN=$(aws iam create-policy \
  --policy-name ZabbixAWSCostExplorerReadOnly \
  --policy-document file://zabbix-cost-readonly.json \
  --query Policy.Arn --output text)
aws iam attach-user-policy --user-name "$USER" --policy-arn "$COST_ARN"

Access keys

aws iam create-access-key --user-name "$USER" \
  --query 'AccessKey.{id:AccessKeyId,secret:SecretAccessKey}' --output json

Create the account host with Host Wizard

Data collection → Hosts → Host Wizard

Choose template AWS by HTTP

Host name: aws-prod (or your naming), Host group: Cloud

Configure host (2/2) → Authorization Access key and fill:

Create.

Do not manually attach EC2/RDS/ECS/ELB/Lambda/S3 templates to aws-prod. The base AWS by HTTP template will:

discover those services,
create child hosts (e.g., discovered EC2 instances appear as child hosts),
and auto-attach the correct service template to each child host.

Link Cost Explorer (the only template you add separately)

On aws-prod → Templates → Link new templates → AWS Cost Explorer by HTTP.
CE must be enabled in the Billing console; CE data has ~24h lag.

Why “Get daily costs / Get monthly costs” look empty:
They’re master items (Text, History=0) that fetch big JSON; Latest data may show blank Last value. The per-service USD numbers you see are dependent items parsing that JSON.

What you’ll see in Zabbix

Account host (aws-prod)
Manages discovery; holds Cost Explorer items (if linked).

Child hosts (discovered)
One per EC2/RDS/ECS/ELB/Lambda/S3 entity; these hosts contain the performance/health metrics.

Leave a Comment Cancel Reply