POST custom metric with curl to cloudwatch - amazon-web-services

Question

I want to log results of an api call to cloud watch.
What I want to do is to post consume metrics to cloud watch.
My architecture is designed to sit on elastic beanstalk, so I prefer to install as little as possible on it.
I am trying to understand is it possible to post the cloud watch with simple CURL POST.
I have this tutorial.
I don't really understand this example.
Can I to it with post? (looks like get method).
And what is the endpoint?
When I tried :
curl -X POST https://monitoring.&api-domain;/doc/2010-08-01/?Action=PutMetricData&Version=2010-08-01&Namespace=TestNamespace&MetricData.member.1.MetricName=buffers&MetricData.member.1.Unit=Bytes&&MetricData.member.1.Dimensions.member.1.Name=InstanceType&MetricData.member.1.Dimensions.member.1.Value=m1.small&AUTHPARAMS
I got this error:
'api-domain' is not recognized as an internal or external command,
operable program or batch file.
'Version' is not recognized as an internal or external command,
operable program or batch file.
'Namespace' is not recognized as an internal or external command,
operable program or batch file.
'MetricData.member.1.MetricName' is not recognized as an internal or external command,
operable program or batch file.
'MetricData.member.1.Unit' is not recognized as an internal or external command,
operable program or batch file.
'MetricData.member.1.Dimensions.member.1.Value' is not recognized as an internal or external command,
operable program or batch file.
'AUTHPARAMS' is not recognized as an internal or external command,
operable program or batch file.
Please don't tell me to use aws cli.
I know I can use it. I want to try not to use it.

Answer 1

Here is the documentation explaining how to make POST requests: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/making-api-requests.html#CloudWatch-API-requests-using-post-method
Here is a list of endpoints per region: https://docs.aws.amazon.com/general/latest/gr/rande.html#cw_region
Resulting curl will look something like this:
curl -X POST \
https://monitoring.us-east-1.amazonaws.com \
-H 'Accept: application/json' \
-H 'Authorization: AWS4-HMAC-SHA256 Credential=YOUR_ACCESS_KEY_GOES_HERE/20190326/us-east-1/monitoring/aws4_request, SignedHeaders=accept;content-encoding;content-length;content-type;host;x-amz-date;x-amz-target, Signature=SIGV4_SIGNATURE_GOES_HERE' \
-H 'Content-Encoding: amz-1.0' \
-H 'Content-Length: 141' \
-H 'Content-Type: application/json' \
-H 'X-Amz-Date: 20190326T071934Z' \
-H 'X-Amz-Target: GraniteServiceVersion20100801.PutMetricData' \
-H 'host: monitoring.us-east-1.amazonaws.com' \
-d '{
"Namespace": "StackOverflow",
"MetricData": [
{
"MetricName": "TestMetric",
"Value": 123.0
}
]
}'
Note that Authorization header in the example above has two placeholders, YOUR_ACCESS_KEY_GOES_HERE and SIGV4_SIGNATURE_GOES_HERE. These are the access key from the credentials you'll be using to sign the requests and the signature you'll have to construct using this algorithm: https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html and this is one of the reasons why using the CLI or SDKs is the recommended way of making requests.

Answer 2

Here is a pure bash example that only needs curl and openssl. It is greatly inspired by: https://github.com/riboseinc/aws-authenticating-secgroup-scripts
#!/bin/bash
set -o errexit
set -o pipefail
set -o nounset
function sha256Hash() {
printf "$1" | openssl dgst -sha256 -binary -hex | sed 's/^.* //'
}
function log() {
local message="$1"
local details="$2"
printf "${message}\n" >&2
printf "${details}\n\n" | sed 's/^/ /' >&2
}
function to_hex() {
printf "$1" | od -A n -t x1 | tr -d [:space:]
}
function hmac_sha256() {
printf "$2" | \
openssl dgst -binary -hex -sha256 -mac HMAC -macopt hexkey:"$1" | \
sed 's/^.* //'
}
## http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
function sig4_create_canonical_request() {
local http_request_method="$1"
local canonical_uri="/${api_uri}"
local canonical_query=""
local header_host="host:${api_host}"
local canonical_headers="${header_host}\n${header_x_amz_date}"
local request_payload=$(sha256Hash "$metricjson")
local canonical_request="${http_request_method}\n${canonical_uri}\n${canonical_query}\n${canonical_headers}\n\n${signed_headers}\n${request_payload}"
printf "$(sha256Hash ${canonical_request})"
}
## http://docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html
function sigv4_create_string_to_sign() {
local hashed_canonical_request="$1"
local sts="${algorithm}\n${timestamp}\n${credential_scope}\n${hashed_canonical_request}"
printf "${sts}"
}
## http://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
function sigv4_calculate_signature() {
local secret=$(to_hex "AWS4${aws_secret_key}")
local k_date=$(hmac_sha256 "${secret}" "${today}")
local k_region=$(hmac_sha256 "${k_date}" "${aws_region}")
local k_service=$(hmac_sha256 "${k_region}" "${aws_service}")
local k_signing=$(hmac_sha256 "${k_service}" "aws4_request")
local string_to_sign="$1"
local signature=$(hmac_sha256 "${k_signing}" "${string_to_sign}" | sed 's/^.* //')
printf "${signature}"
}
## http://docs.aws.amazon.com/general/latest/gr/sigv4-add-signature-to-request.html#sigv4-add-signature-auth-header
function sigv4_add_signature_to_request() {
local credential="Credential=${aws_access_key}/${credential_scope}"
local s_headers="SignedHeaders=${signed_headers}"
local signature="Signature=$1"
local authorization_header="Authorization: ${algorithm} ${credential}, ${s_headers}, ${signature}"
printf "${authorization_header}"
}
# https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
function sign_it() {
local method="$1"
local hashed_canonical_request=$(sig4_create_canonical_request "${method}")
local string_to_sign=$(sigv4_create_string_to_sign "${hashed_canonical_request}")
local signature=$(sigv4_calculate_signature "${string_to_sign}")
local authorization_header=$(sigv4_add_signature_to_request "${signature}")
printf "${authorization_header}"
}
## https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/making-api-requests.html#CloudWatch-API-requests-using-post-method
function put_metric_data() {
local http_method="$1"
local authorization_header=$(sign_it "${http_method}")
local content_length=$(echo -n "$metricjson"|wc -m)
printf "> ${http_method}-ing ${api_url}\n"
curl -i -X ${http_method} "${api_url}" \
-H 'Accept: application/json' \
-H 'Content-Encoding: amz-1.0' \
-H 'Content-Type: application/json' \
-H 'X-Amz-Target: GraniteServiceVersion20100801.PutMetricData' \
-H "${authorization_header}" \
-H "${header_x_amz_date}" \
-H "Content-Length: ${content_length}" \
-d "$metricjson"
}
function main() {
while [ -n "${1-}" ]; do
case "$1" in
-credentials) credentials="$2"; shift ;;
-url) url="$2"; shift ;;
-metricjson) metricjson="$2"; shift ;;
*) echo "Option $1 not recognized"; exit 1 ;;
esac
shift
done
if [ -z "${credentials}" ] || [ -z "${url}" ] || [ -z "${metricjson}" ] ; then
log "sample usage:" "<script> -metricjson <metricjson> -credentials <aws_access_key>:<aws_secret_key> -url <c_url>"
exit 1
fi
local method="POST"
local aws_access_key=$(cut -d':' -f1 <<<"${credentials}")
local aws_secret_key=$(cut -d':' -f2 <<<"${credentials}")
local api_url="${url}"
local timestamp=${timestamp-$(date -u +"%Y%m%dT%H%M%SZ")} # 20171226T112335Z
local today=${today-$(date -u +"%Y%m%d")} # 20171226
local api_host=$(printf ${api_url} | awk -F/ '{print $3}')
local api_uri=$(printf ${api_url} | grep / | cut -d/ -f4-)
local aws_region=$(cut -d'.' -f2 <<<"${api_host}")
local aws_service=$(cut -d'.' -f1 <<<"${api_host}")
local algorithm="AWS4-HMAC-SHA256"
local credential_scope="${today}/${aws_region}/${aws_service}/aws4_request"
local signed_headers="host;x-amz-date"
local header_x_amz_date="x-amz-date:${timestamp}"
put_metric_data "${method}"
}
main "$#"