From ace0a29e25bce0c03afde6085ea34055d7db53a6 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 16 Sep 2026 17:25:53 -0400
Subject: [PATCH] fix(infra): keep no-logs alarm quiet until UniFi cutover

The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply.
---
 README.md              |  4 ++++
 terraform/alarms.tf    |  2 +-
 terraform/variables.tf | 11 +++++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 826d5f9..d314731 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,10 @@ First apply uses the hcptf-bootstrap window (exact `StringEquals` trust, never
 6. Second manual apply as the scoped role. After live-path proof, seal
    auto-apply on.
 
+`Syslog-NoIncomingLogs` defaults `treat_missing_data` to `notBreaching` so the
+empty prod log group does not page `site-alerts` before UniFi is re-pointed.
+After devices deliver to the new EIP, set `no_logs_treat_missing_data=breaching`.
+
 HCP outputs to copy: `public_ip`, `instance_id`, `hcptf_apply_role_arn`,
 `hcptf_plan_role_arn`.
 
diff --git a/terraform/alarms.tf b/terraform/alarms.tf
index a0c9023..3659fc8 100644
--- a/terraform/alarms.tf
+++ b/terraform/alarms.tf
@@ -8,7 +8,7 @@ resource "aws_cloudwatch_metric_alarm" "no_incoming_logs" {
   period              = 86400
   statistic           = "Sum"
   threshold           = 1
-  treat_missing_data  = "breaching"
+  treat_missing_data  = var.no_logs_treat_missing_data
   alarm_actions       = [local.site_alerts_arn]
 
   dimensions = {
diff --git a/terraform/variables.tf b/terraform/variables.tf
index ae53f48..aa0bcb4 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -9,3 +9,14 @@ variable "ami_id" {
   type        = string
   default     = "ami-02c114835b4e7739f"
 }
+
+variable "no_logs_treat_missing_data" {
+  description = "CloudWatch treat_missing_data for Syslog-NoIncomingLogs. Keep notBreaching until UniFi points at the new EIP, then set breaching."
+  type        = string
+  default     = "notBreaching"
+
+  validation {
+    condition     = contains(["breaching", "notBreaching", "ignore", "missing"], var.no_logs_treat_missing_data)
+    error_message = "no_logs_treat_missing_data must be breaching, notBreaching, ignore, or missing."
+  }
+}