Skip to content

Commit

Permalink
DACP: Add Cloudwatch Alerts and WAF
Browse files Browse the repository at this point in the history
  • Loading branch information
matt-k1998 committed Nov 13, 2023
1 parent 679e462 commit 5398298
Show file tree
Hide file tree
Showing 3 changed files with 119 additions and 0 deletions.
78 changes: 78 additions & 0 deletions terraform/environments/dacp/ecs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -270,3 +270,81 @@ resource "aws_cloudwatch_log_resource_policy" "ecs_logging_policy" {
})
policy_name = "TrustEventsToStoreLogEvents"
}

resource "aws_cloudwatch_metric_alarm" "ecs_cpu_alarm" {
count = local.is-development ? 0 : 1
alarm_name = "ecs-cpu-utilization-alarm"
comparison_operator = "GreaterThanOrEqualToThreshold"
evaluation_periods = "2"
metric_name = "CpuUtilized"
namespace = "ECS/ContainerInsights"
period = "120"
statistic = "Average"
threshold = "80"
alarm_description = "This metric checks if CPU utilization is high - threshold set to 80%"
alarm_actions = [aws_sns_topic.dacp_utilisation_alarm[0].arn]
dimensions = {
ClusterName = aws_ecs_cluster.dacp_cluster.name
}
}

resource "aws_cloudwatch_metric_alarm" "ecs_memory_alarm" {
count = local.is-development ? 0 : 1
alarm_name = "ecs-memory-utilization-alarm"
comparison_operator = "GreaterThanOrEqualToThreshold"
evaluation_periods = "2"
metric_name = "MemoryUtilized"
namespace = "ECS/ContainerInsights"
period = "120"
statistic = "Average"
threshold = "1600"
alarm_description = "This metric checks if memory utilization is high - threshold set to 1600MB"
alarm_actions = [aws_sns_topic.dacp_utilisation_alarm[0].arn]
dimensions = {
ClusterName = aws_ecs_cluster.dacp_cluster.name
}
}

resource "aws_sns_topic" "dacp_utilisation_alarm" {
count = local.is-development ? 0 : 1
name = "dacp_utilisation_alarm"
}

# Pager duty integration

# Get the map of pagerduty integration keys from the modernisation platform account
data "aws_secretsmanager_secret" "pagerduty_integration_keys" {
provider = aws.modernisation-platform
name = "pagerduty_integration_keys"
}
data "aws_secretsmanager_secret_version" "pagerduty_integration_keys" {
provider = aws.modernisation-platform
secret_id = data.aws_secretsmanager_secret.pagerduty_integration_keys.id
}

# Add a local to get the keys
locals {
pagerduty_integration_keys = jsondecode(data.aws_secretsmanager_secret_version.pagerduty_integration_keys.secret_string)
}

# link the sns topic to the service - preprod
module "pagerduty_core_alerts_non_prod" {
count = local.is-preproduction ? 1 : 0
depends_on = [
aws_sns_topic.dacp_utilisation_alarm
]
source = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
sns_topics = [aws_sns_topic.dacp_utilisation_alarm[0].name]
pagerduty_integration_key = local.pagerduty_integration_keys["dacp_non_prod_alarms"]
}

# link the sns topic to the service - prod
module "pagerduty_core_alerts_prod" {
count = local.is-production ? 1 : 0
depends_on = [
aws_sns_topic.dacp_utilisation_alarm
]
source = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
sns_topics = [aws_sns_topic.dacp_utilisation_alarm[0].name]
pagerduty_integration_key = local.pagerduty_integration_keys["dacp_prod_alarms"]
}
5 changes: 5 additions & 0 deletions terraform/environments/dacp/load_balancer.tf
Original file line number Diff line number Diff line change
Expand Up @@ -154,3 +154,8 @@ resource "aws_lb_listener" "dacp_lb" {
target_group_arn = aws_lb_target_group.dacp_target_group.arn
}
}

resource "aws_wafv2_web_acl_association" "web_acl_association_my_lb" {
resource_arn = aws_lb.dacp_lb.arn
web_acl_arn = aws_wafv2_web_acl.dacp_web_acl.arn
}
36 changes: 36 additions & 0 deletions terraform/environments/dacp/waf.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
resource "aws_wafv2_web_acl" "dacp_web_acl" {
name = "dacp-web-acl"
scope = "REGIONAL"

default_action {
allow {}
}

rule {
name = "common-rule-set"
priority = 1

override_action {
none {}
}

statement {
managed_rule_group_statement {
name = "AWSManagedRulesCommonRuleSet"
vendor_name = "AWS"
}
}

visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "AWSManagedRulesCommonRuleSetMetrics"
sampled_requests_enabled = true
}
}

visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "dacp-web-acl"
sampled_requests_enabled = true
}
}

0 comments on commit 5398298

Please sign in to comment.