AWS Network Monitoring

From the author

Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health. Covers agent installation, IAM permissions, monitoring network paths, and troubleshooting agents reporting no metrics, HTTP 403 errors, or connectivity failures.

— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides comprehensive instructions for managing Amazon CloudWatch Network Flow Monitor agents on EC2 instances. It covers the end-to-end lifecycle, including IAM permission configuration, agent installation via SSM Distributor or command-line, activation, and verification. It also includes a dedicated troubleshooting guide for common issues such as HTTP 403 errors, missing metrics, and connectivity failures.

What it does

Provides procedures for installing Network Flow Monitor agents using SSM Distributor or CLI.
Details the required IAM policies for metric publishing.
Offers steps to activate and verify agent status.
Includes troubleshooting workflows for common agent errors.
Provides guidance on deactivating or uninstalling agents.
Outlines security best practices for agent deployment.

When to use it

When you need to monitor network path health between EC2 workloads.
When setting up new EC2 instances that require network performance metrics.
When troubleshooting agents that are failing to report metrics.
When resolving HTTP 403 errors related to agent connectivity.

Advantages

Centralized guidance for both SSM-managed and manual agent installations.
Clear security recommendations following the principle of least privilege.
Structured troubleshooting paths for common deployment failures.
Integration-ready instructions for AWS CLI and SSM workflows.

Usage examples

“How do I install the Network Flow Monitor agent on my EC2 instances using SSM?”: The agent provides the specific SSM Distributor commands to install the agent by instance ID or by tag, along with verification steps.
“My agent is reporting HTTP 403 errors. How do I fix it?”: The agent directs you to the troubleshooting reference to verify IAM permissions and ensure the correct policy is attached to the instance role.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/aws/aws-network-monitoring/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip aws-network-monitoring.zip -d .agents/skills

Documentation by AWS

Overview

Domain expertise for installing and configuring Amazon CloudWatch Network Flow Monitor agents on EC2 instances. Covers IAM permission setup, agent installation via SSM Distributor or command-line install, agent activation, verification, and troubleshooting.

Network Flow Monitor agents are lightweight software that publish performance metrics (latency, packet loss) to the Network Flow Monitor backend, enabling monitoring of network path health between workloads.

Works best with the AWS MCP server — enables running SSM commands, attaching IAM policies, and validating agent status directly. All guidance also works with standard AWS CLI access.

Routing

User need	Action
Installing Network Flow Monitor agents on EC2	Read agent-install-ec2.md
Configuring IAM for Network Flow Monitor agents	Read agent-permissions.md
Troubleshooting Network Flow Monitor agents (403, no metrics, connectivity)	Read troubleshooting.md
Spans multiple areas	Read the most specific reference first, then consult others as needed

Files

File	Content
agent-install-ec2.md	End-to-end Network Flow Monitor agent installation via SSM Distributor, activation, verification
agent-permissions.md	IAM policy setup for Network Flow Monitor agent metric publishing
troubleshooting.md	Error → cause → fix for Network Flow Monitor agent issues (HTTP 403, missing metrics, connectivity)

Supported versions

For supported Linux distributions, kernel versions, and architectures, see the AWS documentation. Windows is not supported.

Security Considerations

Least-privilege IAM: Attach only CloudWatchNetworkFlowMonitorAgentPublishPolicy for publishing metrics and AmazonSSMManagedInstanceCore for SSM management. Do not use *FullAccess policies.
Private subnets: When the instance is in a private subnet, prefer VPC endpoints for SSM (com.amazonaws.<region>.ssm, .ssmmessages, .ec2messages) over a NAT gateway to keep traffic on the AWS network.
Credential storage: Never embed AWS credentials on the instance; the publish policy MUST be attached to the instance role, not configured as static keys.
Audit trail: Ensure CloudTrail is enabled in the account so SSM SendCommand invocations and IAM AttachRolePolicy actions performed during agent setup are logged for security investigations.
References: CloudWatch Network Flow Monitor security, IAM best practices

Files

ATTRIBUTION.mdAdded by AutoGineer934 B
LICENSELicence file added by AutoGineer9.9 KiB
NOTICELicence file added by AutoGineer67 B
SKILL.md3.4 KiB
references/agent-install-ec2.md5.0 KiB
references/agent-permissions.md1.5 KiB
references/troubleshooting.md2.4 KiB

references/agent-install-ec2.md

EC2 Agent Installation Procedure

Two install paths are supported. Prefer SSM Distributor when SSM is available — it lets you target many instances in one call (by tag, instance ID, or resource group) and integrates with the manage-agent document used to activate/deactivate agents. Use the command-line path when SSM is unavailable. Activation is only applicable for the SSM path; command-line-installed agents start publishing as soon as IAM permissions are in place.

Prerequisites

IAM permissions configured before install (see agent-permissions.md). Agents install successfully without the policy but cannot publish metrics until it is attached.
Supported Linux distribution (see AWS documentation)
For the SSM path: target EC2 instances must have SSM Agent installed and running

SSM Distributor install path

Step 1: Verify SSM connectivity

aws ssm describe-instance-information \
  --filters "Key=InstanceIds,Values=<instance-id>" \
  --query "InstanceInformationList[].{Id:InstanceId,Ping:PingStatus}" \
  --output table

If instances don't appear, ensure the instance has the AmazonSSMManagedInstanceCore policy attached.

Step 2: Install the agent

By instance ID:

aws ssm send-command \
  --document-name "AWS-ConfigureAWSPackage" \
  --targets "Key=instanceids,Values=<instance-id-1>,<instance-id-2>" \
  --parameters '{"action":["Install"],"name":["AmazonCloudWatchNetworkFlowMonitorAgent"]}' \
  --comment "Install Network Flow Monitor agent"

By tag:

aws ssm send-command \
  --document-name "AWS-ConfigureAWSPackage" \
  --targets "Key=tag:Environment,Values=<your-tag-value>" \
  --parameters '{"action":["Install"],"name":["AmazonCloudWatchNetworkFlowMonitorAgent"]}' \
  --comment "Install Network Flow Monitor agent on tagged instances"

Step 3: Verify installation status

aws ssm list-command-invocations \
  --command-id "<command-id-from-step-2>" \
  --details \
  --query "CommandInvocations[].{Instance:InstanceId,Status:Status}" \
  --output table

Step 4: Activate the agent

aws ssm send-command \
  --document-name "AmazonCloudWatch-NetworkFlowMonitorManageAgent" \
  --targets "Key=instanceids,Values=<instance-id-1>,<instance-id-2>" \
  --parameters '{"Action":["Activate"]}' \
  --comment "Activate Network Flow Monitor agent"

Step 5: Verify the agent is publishing

Wait 30-60 seconds (the agent publishes reports every 30 seconds by default, with up to 5 seconds of jitter), then check agent logs for successful HTTP responses:

sudo journalctl -u network-flow-monitor.service | grep HTTP

HTTP 200 responses to networkflowmonitorreports.<region>.api.aws confirm the agent is publishing successfully. Any other status code indicates an error — see troubleshooting.md.

Deactivate (without uninstalling)

Deactivating stops metric publishing and the associated billing without removing the agent.

aws ssm send-command \
  --document-name "AmazonCloudWatch-NetworkFlowMonitorManageAgent" \
  --targets "Key=instanceids,Values=<instance-id>" \
  --parameters '{"Action":["Deactivate"]}'

Uninstall

aws ssm send-command \
  --document-name "AWS-ConfigureAWSPackage" \
  --targets "Key=instanceids,Values=<instance-id>" \
  --parameters '{"action":["Uninstall"],"name":["AmazonCloudWatchNetworkFlowMonitorAgent"]}'

Command-line install path (no SSM)

Use when SSM is unavailable. Activation is not applicable to this path — the agent begins publishing as soon as the package is installed and the IAM policy is attached to the instance role.

Amazon Linux 2023 (package repository):

sudo yum install network-flow-monitor-agent

Amazon Linux 2023 (direct download by architecture):

# x86_64
sudo yum install https://networkflowmonitoragent.awsstatic.com/latest/x86_64/network-flow-monitor-agent.rpm

# ARM64 (Graviton)
sudo yum install https://networkflowmonitoragent.awsstatic.com/latest/arm64/network-flow-monitor-agent.rpm

Debian / Ubuntu:

# x86_64
wget https://networkflowmonitoragent.awsstatic.com/latest/x86_64/network-flow-monitor-agent.deb
sudo apt-get install ./network-flow-monitor-agent.deb

# ARM64 (Graviton)
wget https://networkflowmonitoragent.awsstatic.com/latest/arm64/network-flow-monitor-agent.deb
sudo apt-get install ./network-flow-monitor-agent.deb

Red Hat / CentOS / SUSE:

Use the same RPM as Amazon Linux 2023 above (substitute zypper for yum on SUSE). The SSM Distributor path also covers these distros and uses the same RPM internally.

Verify the agent is running:

service network-flow-monitor status

The output should show Loaded: ... enabled and Active: active (running).

Attach CloudWatchNetworkFlowMonitorAgentPublishPolicy to the instance role (see agent-permissions.md) so the agent can publish metrics.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Observability And Instrumentation
Addy Osmani· Community
A systematic approach to instrumenting production code with structured logs, metrics, and traces for effective system observability.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository113.9k
Spark Memory Thermal Ops
Seth Hobson· Community
Manage unified memory and thermal constraints for long-running machine learning jobs on NVIDIA DGX Spark.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository42.3k
Gke Alert Configuration
GoogleOfficial
Configure GKE alerting policies in Terraform using PromQL and Google Cloud Managed Service for Prometheus.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 more
Apache-2.0Low riskHas scriptsGitHub stars of the source repository23.2k
Application Performance Observability Engineer
Seth Hobson· Community
Expert observability engineer for designing production-grade monitoring, logging, tracing, and reliability systems.
Cloud and DevOpsClaude Code
MITGitHub stars of the source repository42.3k
Distributed Debugging Devops Troubleshooter
Seth Hobson· Community
An expert DevOps troubleshooter for incident response, system reliability, and complex distributed system debugging.
Cloud and DevOpsClaude Code
MITGitHub stars of the source repository42.3k
Distributed Tracing
Seth Hobson· Community
Implement distributed tracing using Jaeger and Tempo to monitor request flows and performance across microservices.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-network-monitoring.zip