mirror of
https://github.com/Sea-Haven-Industries/apm-wo-analysis.git
synced 2026-09-30 05:23:15 +00:00
f13d2e3ff1
Some checks are pending
Deploy / Deploy to prod (push) Waiting to run
* feat(infra): migrate pipeline and Grafana to HCP Terraform (PLAT-75) Move apm-wo-analysis into seahaven-prod under workspace apm-wo-analysis-prod with in-repo hcptf/githubdeploy IAM, stub Lambdas, and GitHub Actions zip CD. * chore(iam): add Checkov skip comments for HCP IAM documents Pre-push HIGH findings are the DLM snapshot describe, tagged EC2 creates, exec boundary DescribeLogGroups star, and the drop-uploader user policy.
123 lines
4.7 KiB
HCL
123 lines
4.7 KiB
HCL
locals {
|
|
lambda_alarm_matrix = {
|
|
errors = {
|
|
metric_name = "Errors"
|
|
statistic = "Sum"
|
|
evaluation_periods = 1
|
|
datapoints_to_alarm = 1
|
|
threshold = 1
|
|
comparison = "GreaterThanOrEqualToThreshold"
|
|
period = 300
|
|
}
|
|
throttles = {
|
|
metric_name = "Throttles"
|
|
statistic = "Sum"
|
|
evaluation_periods = 1
|
|
datapoints_to_alarm = 1
|
|
threshold = 1
|
|
comparison = "GreaterThanOrEqualToThreshold"
|
|
period = 300
|
|
}
|
|
}
|
|
|
|
lambda_alarms = {
|
|
for pair in flatten([
|
|
for fn_key, fn in local.functions : [
|
|
for metric_key, metric in local.lambda_alarm_matrix : {
|
|
key = "${fn_key}-${metric_key}"
|
|
function = fn.function_name
|
|
metric_key = metric_key
|
|
metric_name = metric.metric_name
|
|
statistic = metric.statistic
|
|
evaluation = metric.evaluation_periods
|
|
datapoints = metric.datapoints_to_alarm
|
|
threshold = metric.threshold
|
|
comparison = metric.comparison
|
|
period = metric.period
|
|
description = metric_key == "errors" ? "${fn.function_name} reported one or more errors" : "${fn.function_name} was throttled (concurrency limit hit)"
|
|
}
|
|
]
|
|
]) : pair.key => pair
|
|
}
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "lambda_errors_throttles" {
|
|
for_each = local.lambda_alarms
|
|
|
|
alarm_name = "Lambda-${title(each.value.metric_key)}-${each.value.function}"
|
|
alarm_description = each.value.description
|
|
namespace = "AWS/Lambda"
|
|
metric_name = each.value.metric_name
|
|
dimensions = { FunctionName = each.value.function }
|
|
statistic = each.value.statistic
|
|
period = each.value.period
|
|
evaluation_periods = each.value.evaluation
|
|
datapoints_to_alarm = each.value.datapoints
|
|
threshold = each.value.threshold
|
|
comparison_operator = each.value.comparison
|
|
treat_missing_data = "notBreaching"
|
|
alarm_actions = [local.site_alerts_arn]
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "lambda_duration" {
|
|
for_each = local.functions
|
|
|
|
alarm_name = "Lambda-Duration-${each.value.function_name}"
|
|
alarm_description = "${each.value.function_name} duration approaching its ${each.value.timeout}s timeout (>=${each.value.duration_ms}ms)"
|
|
namespace = "AWS/Lambda"
|
|
metric_name = "Duration"
|
|
dimensions = { FunctionName = each.value.function_name }
|
|
statistic = "Maximum"
|
|
period = 300
|
|
evaluation_periods = 3
|
|
datapoints_to_alarm = 2
|
|
threshold = each.value.duration_ms
|
|
comparison_operator = "GreaterThanOrEqualToThreshold"
|
|
treat_missing_data = "notBreaching"
|
|
alarm_actions = [local.site_alerts_arn]
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "classifier_dlq" {
|
|
alarm_name = "apm-wo-analysis-classifier-dlq-messages"
|
|
alarm_description = "apm-wo-analysis-classifier DLQ has visible messages (dropped classifier run)"
|
|
namespace = "AWS/SQS"
|
|
metric_name = "ApproximateNumberOfMessagesVisible"
|
|
dimensions = { QueueName = aws_sqs_queue.classifier_dlq.name }
|
|
statistic = "Maximum"
|
|
period = 300
|
|
evaluation_periods = 1
|
|
threshold = 0
|
|
comparison_operator = "GreaterThanThreshold"
|
|
treat_missing_data = "notBreaching"
|
|
alarm_actions = [local.site_alerts_arn]
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "classifier_invocations" {
|
|
alarm_name = "apm-wo-analysis-classifier-invocations"
|
|
alarm_description = "apm-wo-analysis-classifier had fewer than 1 invocation in 24h (daily export missing or S3 trigger broken)"
|
|
namespace = "AWS/Lambda"
|
|
metric_name = "Invocations"
|
|
dimensions = { FunctionName = local.functions.classifier.function_name }
|
|
statistic = "Sum"
|
|
period = 86400
|
|
evaluation_periods = 1
|
|
threshold = 1
|
|
comparison_operator = "LessThanThreshold"
|
|
treat_missing_data = "breaching"
|
|
alarm_actions = [local.site_alerts_arn]
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "api_5xx" {
|
|
alarm_name = "ApiGateway-5xx-${aws_apigatewayv2_api.http.id}"
|
|
alarm_description = "5xx responses on the apm-wo-analysis HTTP API"
|
|
namespace = "AWS/ApiGateway"
|
|
metric_name = "5xx"
|
|
dimensions = { ApiId = aws_apigatewayv2_api.http.id }
|
|
statistic = "Sum"
|
|
period = 300
|
|
evaluation_periods = 1
|
|
threshold = 1
|
|
comparison_operator = "GreaterThanOrEqualToThreshold"
|
|
treat_missing_data = "notBreaching"
|
|
alarm_actions = [local.site_alerts_arn]
|
|
}
|