Feature/alarm creator

alarm_creator/actions.py

@@ -1,91 +1,100 @@
-import boto3, json
-
-from pip import main
+import boto3, json, os
 
 # Create boto3 clients
 CWclient = boto3.client("cloudwatch")
 ec2 = boto3.resource("ec2")
 rds = boto3.client("rds")
 ec2client = boto3.client("ec2")
 ecsclient = boto3.client("ecs")
+s3client = boto3.client("s3")
+elasticlient = boto3.client("elasticache")
+
+alarm_bucket = os.environ["BUCKET_NAME"]
 
-# Load json file containing the alarms
-with open('./alarms.json') as alarms_file:
-    alarms = json.load(alarms_file)
+def get_alarm_params():
+    alarm_data = s3client.get_object(
+        Bucket=alarm_bucket,
+        Key='alarms.json'
+    )
+    alarm_params = alarm_data.get('Body')
+    alarms = json.load(alarm_params)
+    return alarms
 
 # Alarm creator
 def AWS_Alarms():
+    # Load alarms parameters
+    alarms = get_alarm_params()
+
     for service in alarms:
-
         # Fill instances variable with Running instances per service
         if service == "EC2":
             instances = GetRunningInstances()
         elif service == "RDS":
             instances = GetRunningDBInstances()
         elif service == "ECS":
             instances = GetRunningClusters()
+        elif service == "ElastiCache":
+            instances = GetRunningCacheClusters()
+        elif service == "CWAgent":
+            instances = GetRunningInstances() 
+
+
         for alarm in alarms[service]:
-
             # Query the namespaces in CloudWatch Metrics
-            response = CWclient.list_metrics(Namespace=f"{alarms[service][alarm]['Namespace']}", RecentlyActive='PT3H',)
+            response = CWclient.list_metrics(Namespace=f"{alarms[service][alarm]['Namespace']}", RecentlyActive='PT3H')
             for metrics in response["Metrics"]:
-
-                # Check if any of the found metricnames are equal to metric names in alarms file 
+                # Check if any of the found metric names are equal to metric names in alarms file 
                 if metrics["MetricName"] == alarms[service][alarm]['MetricName']:
-                    for dimensions in metrics["Dimensions"]:
-                        if dimensions["Name"] == alarms[service][alarm]['Dimensions']:
-                            for priority, threshold in zip(alarms[service][alarm]['AlarmThresholds']["priority"], alarms[service][alarm]['AlarmThresholds']["alarm_threshold"]):
-
-                                # To make alarmnames pretty, 'MB/GB' is used instead of 1000000/1000000000 bytes, needs to be in bytes for actual threshold
-                                if alarms[service][alarm]['Description']['ThresholdUnit'] == "GB":
-                                    cw_threshold = int(threshold) * 1000000000
-                                elif alarms[service][alarm]['Description']['ThresholdUnit'] == "MB":
-                                    cw_threshold = int(threshold) * 1000000
-                                else:
-                                    cw_threshold = int(threshold)
-
-                                # Handling dimensions
-                                instanceDimensions = {
-                                                "Name":  f"{dimensions['Name']}", 
-                                                "Value": f"{dimensions['Value']}"
-                                            }
-                                dimensionlist = []
-                                # For disk alarms there are more dimensions than other alarms 
-                                try:                
-                                    for item in alarms[service][alarm]['DiskDimensions']:
-                                        dimensionlist.append(item)
-                                except KeyError:    #
-                                    dimensionlist = []
-                                dimensionlist.insert(0, instanceDimensions)
-
-                                for instance in instances:
-
-                                    # Create alarms
-                                    CWclient.put_metric_alarm(
-                                        AlarmName=f"{instance}-{alarm} {alarms[service][alarm]['Description']['Operatorsymbol']} {threshold} {alarms[service][alarm]['Description']['ThresholdUnit']}",
-                                        ComparisonOperator=alarms[service][alarm]['ComparisonOperator'],
-                                        EvaluationPeriods=alarms[service][alarm]['EvaluationPeriods'],
-                                        MetricName=alarms[service][alarm]['MetricName'],
-                                        Namespace=alarms[service][alarm]['Namespace'],
-                                        Period=alarms[service][alarm]['Period'],
-                                        Statistic=alarms[service][alarm]['Statistic'],
-                                        Threshold=cw_threshold,
-                                        ActionsEnabled=True,
-                                        TreatMissingData=alarms[service][alarm]['TreatMissingData'],
-                                        AlarmDescription=f"{priority}",
-                                        Dimensions=dimensionlist,
-                                        Tags=[{"Key": "CreatedbyLambda", "Value": "True"}],
-                                    )
+                    for priority, threshold in zip(alarms[service][alarm]['AlarmThresholds']["priority"], alarms[service][alarm]['AlarmThresholds']["alarm_threshold"]):
+                        # Convert thresholds to bytes if needed
+                        if alarms[service][alarm]['Description']['ThresholdUnit'] == "GB":
+                            cw_threshold = int(threshold) * 1000000000
+                        elif alarms[service][alarm]['Description']['ThresholdUnit'] == "MB":
+                            cw_threshold = int(threshold) * 1000000
+                        else:
+                            cw_threshold = int(threshold)
+
+                        # Handling dimensions
+                        for instance in instances:
+
+                            instanceDimensions = {
+                                "Name": f"{alarms[service][alarm]['Dimensions']}",
+                                "Value": instance
+                            }
+
+                            # Initialize the dimension list
+                            dimensionlist = [instanceDimensions]
+
+                            # Add any additional disk-related dimensions if present
+                            if 'ExtraDimensions' in alarms[service][alarm]:
+                                dimensionlist.extend(alarms[service][alarm]['ExtraDimensions'])
+
+                            # Create the alarms
+                            CWclient.put_metric_alarm(
+                                AlarmName=f"{instance}-{alarm} {alarms[service][alarm]['Description']['Operatorsymbol']} {threshold} {alarms[service][alarm]['Description']['ThresholdUnit']}",
+                                ComparisonOperator=alarms[service][alarm]['ComparisonOperator'],
+                                EvaluationPeriods=alarms[service][alarm]['EvaluationPeriods'],
+                                MetricName=alarms[service][alarm]['MetricName'],
+                                Namespace=alarms[service][alarm]['Namespace'],
+                                Period=alarms[service][alarm]['Period'],
+                                Statistic=alarms[service][alarm]['Statistic'],
+                                Threshold=cw_threshold,
+                                ActionsEnabled=True,
+                                TreatMissingData=alarms[service][alarm]['TreatMissingData'],
+                                AlarmDescription=f"{priority}",
+                                Dimensions=dimensionlist,
+                                Tags=[{"Key": "CreatedbyLambda", "Value": "True"}],
+                            )
 
 def GetRunningInstances():
     get_running_instances = ec2client.describe_instances(
         Filters=[{"Name": "instance-state-name", "Values": ["running"]}]
     )
 
-    # instantiate empty array to store instance-id's
+    # Instantiate empty array to store instance-id's
     RunningInstances = []
 
-    # create an array with a list of instance names
+    # Create an array with a list of instance names
     for reservations in get_running_instances["Reservations"]:
         for instance in reservations["Instances"]:
             RunningInstances.append(instance["InstanceId"])
@@ -109,17 +118,28 @@ def GetRunningClusters():
 
     return RunningClusterNames
 
+def GetRunningCacheClusters():
+    get_running_cacheclusters = elasticlient.describe_cache_clusters()
+    RunningCacheClusters = []
+    for cachecluster in get_running_cacheclusters["CacheClusters"]:
+        RunningCacheClusters.append(cachecluster['CacheClusterId'])
+
+    return RunningCacheClusters
+
 def DeleteAlarms():
     get_alarm_info = CWclient.describe_alarms()
     RunningInstances = GetRunningInstances()
     RunningRDSInstances = GetRunningDBInstances()
     RunningClusters = GetRunningClusters()
+    RunningCacheClusters = GetRunningCacheClusters()
 
-    # collect alarm metrics and compare alarm metric instanceId with instance id's in array. if the state reason is breaching and instance does not exist delete alarm.
+    # Collect alarm metrics and compare alarm metric instanceId with instance id's in array. 
+    # If the state reason is breaching and instance does not exist, delete alarm.
     for metricalarm in get_alarm_info["MetricAlarms"]:
         instance_id = list(filter(lambda x: x["Name"] == "InstanceId", metricalarm["Dimensions"]))
         rds_instance_name = list(filter(lambda x: x["Name"] == "DBInstanceIdentifier", metricalarm["Dimensions"]))
         cluster_name = list(filter(lambda x: x["Name"] == "ClusterName", metricalarm["Dimensions"]))
+        cache_cluster_name = list(filter(lambda x: x["Name"] == "CacheClusterId", metricalarm["Dimensions"]))
 
         if len(instance_id) == 1:
             if instance_id[0]["Value"] not in RunningInstances:
@@ -130,3 +150,6 @@ def DeleteAlarms():
         elif len(cluster_name) == 1:
             if cluster_name[0]["Value"] not in RunningClusters:
                 CWclient.delete_alarms(AlarmNames=[metricalarm["AlarmName"]])
+        elif len(cache_cluster_name) == 1:
+            if cache_cluster_name[0]["Value"] not in RunningCacheClusters:
+                CWclient.delete_alarms(AlarmNames=[metricalarm["AlarmName"]])

alarms_s3.tf

@@ -0,0 +1,78 @@
+resource "aws_s3_bucket" "alarm_bucket" {
+    #bucket_prefix = "alarm-creator-alarms"
+    bucket_prefix = var.alarm_bucket_name
+    force_destroy = true
+}
+
+resource "aws_s3_bucket_policy" "alarm_bucket_policy" {
+    bucket = aws_s3_bucket.alarm_bucket.id
+    policy = data.aws_iam_policy_document.alarm_bucket_policy_doc.json
+    depends_on = [
+        aws_s3_bucket_public_access_block.this
+    ]
+}
+
+resource "aws_s3_bucket_acl" "bucket_access" {
+    bucket = aws_s3_bucket.alarm_bucket.id
+    acl = "private"
+    depends_on = [aws_s3_bucket_ownership_controls.this]
+}
+
+data "aws_iam_policy_document" "alarm_bucket_policy_doc" {
+    statement {
+        principals {
+          type = "AWS"
+          identifiers = ["*"]
+        }
+        actions = ["s3:GetObject"]
+        resources = [aws_s3_bucket.alarm_bucket.arn, "${aws_s3_bucket.alarm_bucket.arn}/*",]
+    }
+    statement {
+        principals {
+            type        = "AWS"
+            identifiers = [data.aws_caller_identity.current.account_id]
+        }
+        actions = ["s3:PutBucketPolicy"]
+        resources = [aws_s3_bucket.alarm_bucket.arn, "${aws_s3_bucket.alarm_bucket.arn}/*",]
+    }
+}
+
+resource "aws_s3_bucket_ownership_controls" "this" {
+  bucket = aws_s3_bucket.alarm_bucket.id
+
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "this" {
+    bucket = aws_s3_bucket.alarm_bucket.id
+
+    block_public_acls       = true
+    block_public_policy     = false
+    ignore_public_acls      = true
+    restrict_public_buckets = true
+}
+
+resource "aws_s3_object" "alarms_file" {
+    bucket = aws_s3_bucket.alarm_bucket.id
+    key = "alarms.json"
+    content = var.alarm_file == null ? file("./default_alarms.json") : var.alarm_file
+}
+
+resource "aws_s3_bucket_notification" "lambdatrigger" {
+  bucket = aws_s3_bucket.alarm_bucket.id
+  lambda_function {
+    lambda_function_arn = module.lambda_cw_alarm_creator.lambda_function_arn
+    events = ["s3:ObjectCreated:*"]
+  }
+  depends_on = [ aws_lambda_permission.allow_s3_trigger ]
+}
+
+resource "aws_lambda_permission" "allow_s3_trigger" {
+  statement_id = "AllowExecutionFromS3Bucket"
+  action = "lambda:InvokeFunction"
+  function_name = module.lambda_cw_alarm_creator.lambda_function_arn
+  principal = "s3.amazonaws.com"
+  source_arn = aws_s3_bucket.alarm_bucket.arn
+}

alarm_creator/alarms.json → default_alarms.json

@@ -57,7 +57,7 @@
             "Statistic" : "Average",
             "TreatMissingData" : "breaching",
             "Dimensions" : "InstanceId",
-            "DiskDimensions": [
+            "ExtraDimensions": [
                 {
                     "Name": "path",
                     "Value": "/"
@@ -90,7 +90,7 @@
             "Statistic" : "Average",
             "TreatMissingData" : "breaching",
             "Dimensions" : "InstanceId",
-            "DiskDimensions": [
+            "ExtraDimensions": [
                 {
                     "Name": "path",
                     "Value": "/sys/fs/cgroup"
@@ -123,7 +123,7 @@
             "Statistic" : "Average",
             "TreatMissingData" : "breaching",
             "Dimensions" : "InstanceId",
-            "DiskDimensions": [
+            "ExtraDimensions": [
                 {
                     "Name": "path",
                     "Value": "/dev"

lambda_cw_alarm_creator.tf

@@ -19,6 +19,7 @@ module "lambda_cw_alarm_creator" {
 
   environment_variables = {
     SNS_ARN = "${aws_sns_topic.notification_receiver.arn}"
+    BUCKET_NAME = "${aws_s3_bucket.alarm_bucket.id}"
   }
 
   sqs_dlq_arn = var.sqs_dlq_arn

lambda_cw_alarm_creator_role.tf

@@ -14,6 +14,8 @@ module "iam_role_lambda_cw_alarm_creator" {
     "lambda_ec2_read_access" : jsondecode(data.aws_iam_policy_document.lambda_ec2_read_access.json)
     "lambda_rds_read_access" : jsondecode(data.aws_iam_policy_document.lambda_rds_read_access.json)
     "lambda_ecs_read_access" : jsondecode(data.aws_iam_policy_document.lambda_ecs_read_access.json)
+    "lambda_s3_read_access" : jsondecode(data.aws_iam_policy_document.lambda_s3_read_access.json)
+    "lambda_elasticache_read_access" : jsondecode(data.aws_iam_policy_document.lambda_elasticache_read_access.json)
   }
 
   trust_relationship = {
@@ -93,6 +95,26 @@ data "aws_iam_policy_document" "lambda_ecs_read_access" {
   }
 }
 
+data "aws_iam_policy_document" "lambda_s3_read_access" {
+  statement {
+    sid = "AllowS3Access"
+
+    actions = ["s3:Get*"]
+
+    resources = ["*"]
+  }
+}
+
+data "aws_iam_policy_document" "lambda_elasticache_read_access" {
+  statement {
+    sid = "AllowLambdaElasticacheAccess"
+
+    actions = ["elasticache:Describe*"]
+
+    resources = ["*"]
+  }
+}
+
 # The Lambda role needs to access KMS key in order to access SNS topic.
 resource "aws_kms_grant" "give_lambda_role_access" {
   name              = "lambda-role-kms-grant-access"

variables.tf

@@ -29,3 +29,14 @@ variable "monitoring_account_configuration" {
     sqs_account = number
   })
 }
+
+variable "alarm_file" {
+  description = "json alarms file"
+  default = null
+
+}
+variable "alarm_bucket_name" {
+  description = "prefix for alarm bucket name"
+  default = "alarm-creator-alarm-parameters-"
+
+}