# Using Metricbeat AWS Module on Private Subnet EC2 **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [September 8, 2021, 2:42pm UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676 "2021-09-08T14:42:40Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![roh](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@roh](https://discuss.elastic.co/u/roh)\ **Post date:** [September 8, 2021, 2:42pm UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/1 "2021-09-08T14:42:40Z")
Hi all! My client wants to collect ec2, ebs, rds metrics using Metricbeat on private subnet ec2 instance with AWS module. So I searched for ways to do it. Judging by [document](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-aws.html), there are common services to reach like IAM, STS, CloudWatch, EC2, Tagging right? So I looked up for VPC Endpoints if there are services but IAM, Tagging wasn't there. I also tried using NAT Gateway and access through public internet but client won't be happy even though no one can access from public internet. So here's the question: To use Metricbeat AWS module on private subnet ec2, is using public internet unavoidable? Thanks in advance! ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [September 9, 2021, 10:17am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/2 "2021-09-09T10:17:12Z")
Hi @roh! This is an interesting question, @Kaiyan_Sheng have we faced any similar case so far? ---
**Author:** ![Jignesh\_Makwana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jignesh_makwana/32/94705_2.png) [@Jignesh\_Makwana](https://discuss.elastic.co/u/Jignesh_Makwana)\ **Post date:** [September 17, 2021, 5:33am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/3 "2021-09-17T05:33:08Z")
Hi, Dose this issue resolved? Looks we have similar issue. Regards, Jig ---
**Author:** ![tanwk2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanwk2/32/94711_2.png) [@tanwk2](https://discuss.elastic.co/u/tanwk2)\ **Post date:** [September 17, 2021, 8:30am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/4 "2021-09-17T08:30:40Z")
Hi, we have the same business requirements as @roh where our private subnet cannot be exposed to the internet. Hoping for a prompt reply! Thank You! ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [September 21, 2021, 8:58pm UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/5 "2021-09-21T20:58:37Z")
Hello! Sorry for the late response. Right now in Metricbeat, AWS module collects monitoring metrics all from CloudWatch using AWS GetMetricData API. With your setup, do you know if you can make the Cloudwatch GetMetricData API call using AWS CLI on the private subnet EC2? ---
**Author:** ![tanwk2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanwk2/32/94711_2.png) [@tanwk2](https://discuss.elastic.co/u/tanwk2)\ **Post date:** [September 22, 2021, 2:13am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/6 "2021-09-22T02:13:23Z")
Hi, we know it uses AWS GetMetricData API and we also had all the necessary setup done such as: 1. AWS PrivateLink Traffic Filtering to reach Elastic Cloud (Working for all the different beats) 2. VPC endpoints created for EC2 metric set and tested calling the API to AWS : - ec2:DescribeInstances (Created & able to call API) - ec2:DescribeRegions (Created & able to call API) - cloudwatch:GetMetricData (Created & able to call API) - cloudwatch:ListMetrics (Created & able to call API) - sts:GetCallerIdentity (Created & able to call API) - iam:ListAccountAliases (Not available) Therefore, we suspect if ListAccountAliases is the problem with this issue. Btw, ap-southeast-1 here. ---
**Author:** ![roh](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@roh](https://discuss.elastic.co/u/roh)\ **Post date:** [September 23, 2021, 12:36am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/7 "2021-09-23T00:36:06Z")
@tanwk2 @Jignesh_Makwana I'm not sure this would help. My client made Private Subnet EC2 to reach IAM endpoint somehow. I asked him how and he told me if there's VPC that can reach IAM endpoint and Private EC2 is available to reach the VPC's EC2, it can reach it. I'm not familiar with AWS and haven't tested it so I cannot guarantee. I'll try to upload a result after the test. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 21, 2021, 2:36am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676/8 "2021-10-21T02:36:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.