H-3139: Set up CloudWatch alerts terraform #7719
Conversation
github-actions
bot
added
area/infra
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
| resource "aws_lambda_function" "sns_to_slack" { | ||
| function_name = "${var.prefix}-${var.severity}-slack-alert" | ||
| role = aws_iam_role.lambda_execution.arn | ||
| handler = "index.handler" | ||
| runtime = "python3.10" | ||
| timeout = 30 | ||
|
|
||
| filename = data.archive_file.lambda_zip.output_path | ||
| source_code_hash = data.archive_file.lambda_zip.output_base64sha256 | ||
|
|
||
| environment { | ||
| variables = { | ||
| SLACK_WEBHOOK_URL = var.slack_webhook_url | ||
| ALERT_SEVERITY = var.severity | ||
| } | ||
| } | ||
|
|
||
| tags = { | ||
| Name = "${var.prefix}-${var.severity}-slack-alert" | ||
| Purpose = "Transform SNS alerts to Slack format" | ||
| Severity = var.severity | ||
| } | ||
| } |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by aws-lambda-x-ray-tracing-not-active.
You can view more details about this finding in the Semgrep AppSec Platform.
| environment { | ||
| variables = { | ||
| SLACK_WEBHOOK_URL = var.slack_webhook_url | ||
| ALERT_SEVERITY = var.severity | ||
| } | ||
| } |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by aws-lambda-environment-unencrypted.
You can view more details about this finding in the Semgrep AppSec Platform.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| resource "aws_lambda_function" "sns_to_slack" { | ||
| function_name = "${var.prefix}-${var.severity}-slack-alert" | ||
| role = aws_iam_role.lambda_execution.arn | ||
| handler = "index.handler" | ||
| runtime = "python3.10" | ||
| timeout = 30 | ||
|
|
||
| filename = data.archive_file.lambda_zip.output_path | ||
| source_code_hash = data.archive_file.lambda_zip.output_base64sha256 | ||
|
|
||
| environment { | ||
| variables = { | ||
| SLACK_WEBHOOK_URL = var.slack_webhook_url | ||
| ALERT_SEVERITY = var.severity | ||
| } | ||
| } | ||
|
|
||
| tags = { | ||
| Name = "${var.prefix}-${var.severity}-slack-alert" | ||
| Purpose = "Transform SNS alerts to Slack format" | ||
| Severity = var.severity | ||
| } | ||
| } |
Check notice
Code scanning / Semgrep OSS
Semgrep Finding: terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active Note
| environment { | ||
| variables = { | ||
| SLACK_WEBHOOK_URL = var.slack_webhook_url | ||
| ALERT_SEVERITY = var.severity | ||
| } | ||
| } |
Check warning
Code scanning / Semgrep OSS
Semgrep Finding: terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted Warning
TimDiekmann
force-pushed
the
t/h-3139-define-cloudwatch-metric-alarms-using-terraform
branch
from
88fff08 to
29a5c01
Compare
TimDiekmann
deleted the
t/h-3139-define-cloudwatch-metric-alarms-using-terraform
branch
🌟 What is the purpose of this PR?
We have alerts through Grafana, however, if Grafana goes offline we won't notice that because we don't have a watcher who watches the watcher.
This implements a CloudWatch alarm and sends it to Slack.