feature: alarms have action with sns (ran-isenberg#749)

Co-authored-by: Ran Isenberg <ran.isenberg@ranthebuilder.cloud>

Author: ran-isenberg

cdk/service/constants.py

@@ -7,6 +7,7 @@
 TABLE_NAME_OUTPUT = 'DbOutput'
 IDEMPOTENCY_TABLE_NAME_OUTPUT = 'IdempotencyDbOutput'
 APIGATEWAY = 'Apigateway'
+MONITORING_TOPIC = 'MonitoringTopic'
 GW_RESOURCE = 'orders'
 LAMBDA_LAYER_NAME = 'common'
 API_HANDLER_LAMBDA_MEMORY_SIZE = 128 # MB

cdk/service/monitoring.py

@@ -1,9 +1,19 @@
-from aws_cdk import Duration, aws_apigateway
+import aws_cdk.aws_sns as sns
+from aws_cdk import Duration, aws_apigateway, CfnOutput
 from aws_cdk import aws_dynamodb as dynamodb
 from aws_cdk import aws_lambda as _lambda
-from cdk_monitoring_constructs import CustomMetricGroup, ErrorRateThreshold, LatencyThreshold, MetricStatistic, MonitoringFacade
+from cdk_monitoring_constructs import (
+ AlarmFactoryDefaults,
+ CustomMetricGroup,
+ ErrorRateThreshold,
+ LatencyThreshold,
+ MetricStatistic,
+ MonitoringFacade,
+ SnsAlarmActionStrategy,
+)
+from aws_cdk import aws_kms as kms
 from constructs import Construct
-
+from aws_cdk import aws_iam as iam
 from cdk.service import constants
 
 
@@ -20,11 +30,39 @@ def __init__(
  ) -> None:
  super().__init__(scope, id_)
  self.id_ = id_
- self._build_high_level_dashboard(crud_api)
- self._build_low_level_dashboard(db, idempotency_table, functions)
+ self.notification_topic = self._build_topic()
+ self._build_high_level_dashboard(crud_api, self.notification_topic)
+ self._build_low_level_dashboard(db, idempotency_table, functions, self.notification_topic)
+
+ def _build_topic(self) -> sns.Topic:
+ key = kms.Key(
+ self,
+ 'MyKey',
+ description='KMS Key for SNS Topic Encryption',
+ enable_key_rotation=True # Enables automatic key rotation
+ )
+ topic = sns.Topic(self, f'{self.id_}alarms', display_name=f'{self.id_}alarms', master_key=key)
+ # Grant CloudWatch permissions to publish to the SNS topic
+ topic.add_to_resource_policy(
+ statement=iam.PolicyStatement(
+ actions=['sns:Publish'],
+ effect=iam.Effect.ALLOW,
+ principals=[iam.ServicePrincipal('cloudwatch.amazonaws.com')],
+ resources=[topic.topic_arn],
+ ))
+ CfnOutput(self, id=constants.MONITORING_TOPIC, value=topic.topic_name).override_logical_id(constants.MONITORING_TOPIC)
+ return topic
 
- def _build_high_level_dashboard(self, crud_api: aws_apigateway.RestApi):
- high_level_facade = MonitoringFacade(self, f'{self.id_}HighFacade')
+ def _build_high_level_dashboard(self, crud_api: aws_apigateway.RestApi, topic: sns.Topic):
+ high_level_facade = MonitoringFacade(
+ self,
+ f'{self.id_}HighFacade',
+ alarm_factory_defaults=AlarmFactoryDefaults(
+ actions_enabled=True,
+ alarm_name_prefix=self.id_,
+ action=SnsAlarmActionStrategy(on_alarm_topic=topic),
+ ),
+ )
  high_level_facade.add_large_header('Order REST API High Level Dashboard')
  high_level_facade.monitor_api_gateway(
  api=crud_api,
@@ -43,8 +81,16 @@ def _build_high_level_dashboard(self, crud_api: aws_apigateway.RestApi):
  group = CustomMetricGroup(metrics=[create_metric], title='Daily Order Requests')
  high_level_facade.monitor_custom(metric_groups=[group], human_readable_name='Daily KPIs', alarm_friendly_name='KPIs')
 
- def _build_low_level_dashboard(self, db: dynamodb.Table, idempotency_table: dynamodb.Table, functions: list[_lambda.Function]):
- low_level_facade = MonitoringFacade(self, f'{self.id_}LowFacade')
+ def _build_low_level_dashboard(self, db: dynamodb.Table, idempotency_table: dynamodb.Table, functions: list[_lambda.Function], topic: sns.Topic):
+ low_level_facade = MonitoringFacade(
+ self,
+ f'{self.id_}LowFacade',
+ alarm_factory_defaults=AlarmFactoryDefaults(
+ actions_enabled=True,
+ alarm_name_prefix=self.id_,
+ action=SnsAlarmActionStrategy(on_alarm_topic=topic),
+ ),
+ )
  low_level_facade.add_large_header('Orders REST API Low Level Dashboard')
  for func in functions:
  low_level_facade.monitor_lambda_function(

docs/best_practices/monitoring.md

@@ -78,6 +78,10 @@ For P90, P50 metrics, follow this [explanation.](https://www.dnv.com/article/ter
 For internal server errors rate, we define the following alarm:
 ![5xx](../media/monitoring/alarm_5xx.png)
 
+#### Actions
+
+Alarms are of no use unless they have an action. We have configured the alarms to send an SNS notification to a new SNS topic.
+From there, you can connect any subscription - HTTPS/SMS/Email, etc. to notify your teams with the alarm details.
 
 ## **CDK Reference**