Adam Moussa
c28d5b1170
Add a MonitoringConstruct (lib/constructs/monitoring.ts) wiring CloudWatch alarms to the shared site-alerts SNS topic for the seahaven-slack-bot stack. Every alarm uses an SNS alarm action only (no OK action) and treats missing data as NOT_BREACHING; alarm names are repo-namespaced kebab-case. Coverage: - Lambda (9 fns): Errors, Throttles, Duration (p99, eval3/dp2, ~80% of timeout) - DynamoDB (seahaven-conversations, seahaven-unanswered-questions): ThrottledRequests + SystemErrors via the per-operations metric-math helpers (the bare TableName-only helpers are deprecated/invalid); operations scoped to 6 CRUD ops to stay under the 10-metric alarm-math cap - API Gateway v2 (seahaven-slack-webhook): 5xx, 4xx, Latency (ApiId dimension) - ECS Fargate (seahaven-socket-mode): CPU + Memory utilization (AWS/ECS) Expose qbo-oauth Lambda and the ECS cluster/service as public readonly handles without changing logical IDs. RunningTaskCount alarm is gated off pending Container Insights sign-off (separate commit).
73 lines
2.3 KiB
TypeScript
73 lines
2.3 KiB
TypeScript
import { Construct } from 'constructs';
|
|
import * as ecs from 'aws-cdk-lib/aws-ecs';
|
|
import * as ecr_assets from 'aws-cdk-lib/aws-ecr-assets';
|
|
import * as ec2 from 'aws-cdk-lib/aws-ec2';
|
|
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
|
|
import * as lambda from 'aws-cdk-lib/aws-lambda';
|
|
import * as logs from 'aws-cdk-lib/aws-logs';
|
|
import * as path from 'path';
|
|
|
|
export interface SocketModeProps {
|
|
vpc: ec2.IVpc;
|
|
processorLambda: lambda.IFunction;
|
|
appHomeLambda: lambda.IFunction;
|
|
}
|
|
|
|
export class SocketModeConstruct extends Construct {
|
|
public readonly cluster: ecs.Cluster;
|
|
public readonly service: ecs.FargateService;
|
|
|
|
constructor(scope: Construct, id: string, props: SocketModeProps) {
|
|
super(scope, id);
|
|
|
|
const appTokenSecret = secretsmanager.Secret.fromSecretNameV2(
|
|
this, 'AppTokenSecret', 'seahaven/slack/app-level-token',
|
|
);
|
|
|
|
const cluster = new ecs.Cluster(this, 'Cluster', {
|
|
clusterName: 'seahaven-socket-mode',
|
|
vpc: props.vpc,
|
|
});
|
|
this.cluster = cluster;
|
|
|
|
const taskDef = new ecs.FargateTaskDefinition(this, 'TaskDef', {
|
|
memoryLimitMiB: 512,
|
|
cpu: 256,
|
|
runtimePlatform: {
|
|
cpuArchitecture: ecs.CpuArchitecture.ARM64,
|
|
operatingSystemFamily: ecs.OperatingSystemFamily.LINUX,
|
|
},
|
|
});
|
|
|
|
taskDef.addContainer('socket-mode', {
|
|
image: ecs.ContainerImage.fromAsset(
|
|
path.join(__dirname, '../../services/socket-mode'),
|
|
{ platform: ecr_assets.Platform.LINUX_ARM64 },
|
|
),
|
|
environment: {
|
|
APP_TOKEN_SECRET_ARN: appTokenSecret.secretArn,
|
|
PROCESSOR_FUNCTION_NAME: props.processorLambda.functionName,
|
|
APP_HOME_FUNCTION_NAME: props.appHomeLambda.functionName,
|
|
},
|
|
logging: ecs.LogDrivers.awsLogs({
|
|
streamPrefix: 'socket-mode',
|
|
logRetention: logs.RetentionDays.TWO_MONTHS,
|
|
}),
|
|
});
|
|
|
|
appTokenSecret.grantRead(taskDef.taskRole);
|
|
props.processorLambda.grantInvoke(taskDef.taskRole);
|
|
props.appHomeLambda.grantInvoke(taskDef.taskRole);
|
|
|
|
this.service = new ecs.FargateService(this, 'Service', {
|
|
serviceName: 'seahaven-socket-mode',
|
|
cluster,
|
|
taskDefinition: taskDef,
|
|
desiredCount: 1,
|
|
minHealthyPercent: 100,
|
|
maxHealthyPercent: 200,
|
|
assignPublicIp: false,
|
|
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
|
|
});
|
|
}
|
|
}
|