diff --git a/terraform/environments/dacp/ecs.tf b/terraform/environments/dacp/ecs.tf index ca64459dda6..8f48067af04 100644 --- a/terraform/environments/dacp/ecs.tf +++ b/terraform/environments/dacp/ecs.tf @@ -270,3 +270,81 @@ resource "aws_cloudwatch_log_resource_policy" "ecs_logging_policy" { }) policy_name = "TrustEventsToStoreLogEvents" } + +resource "aws_cloudwatch_metric_alarm" "ecs_cpu_alarm" { + count = local.is-development ? 0 : 1 + alarm_name = "ecs-cpu-utilization-alarm" + comparison_operator = "GreaterThanOrEqualToThreshold" + evaluation_periods = "2" + metric_name = "CpuUtilized" + namespace = "ECS/ContainerInsights" + period = "120" + statistic = "Average" + threshold = "80" + alarm_description = "This metric checks if CPU utilization is high - threshold set to 80%" + alarm_actions = [aws_sns_topic.dacp_utilisation_alarm[0].arn] + dimensions = { + ClusterName = aws_ecs_cluster.dacp_cluster.name + } +} + +resource "aws_cloudwatch_metric_alarm" "ecs_memory_alarm" { + count = local.is-development ? 0 : 1 + alarm_name = "ecs-memory-utilization-alarm" + comparison_operator = "GreaterThanOrEqualToThreshold" + evaluation_periods = "2" + metric_name = "MemoryUtilized" + namespace = "ECS/ContainerInsights" + period = "120" + statistic = "Average" + threshold = "1600" + alarm_description = "This metric checks if memory utilization is high - threshold set to 1600MB" + alarm_actions = [aws_sns_topic.dacp_utilisation_alarm[0].arn] + dimensions = { + ClusterName = aws_ecs_cluster.dacp_cluster.name + } +} + +resource "aws_sns_topic" "dacp_utilisation_alarm" { + count = local.is-development ? 0 : 1 + name = "dacp_utilisation_alarm" +} + +# Pager duty integration + +# Get the map of pagerduty integration keys from the modernisation platform account +data "aws_secretsmanager_secret" "pagerduty_integration_keys" { + provider = aws.modernisation-platform + name = "pagerduty_integration_keys" +} +data "aws_secretsmanager_secret_version" "pagerduty_integration_keys" { + provider = aws.modernisation-platform + secret_id = data.aws_secretsmanager_secret.pagerduty_integration_keys.id +} + +# Add a local to get the keys +locals { + pagerduty_integration_keys = jsondecode(data.aws_secretsmanager_secret_version.pagerduty_integration_keys.secret_string) +} + +# link the sns topic to the service - preprod +module "pagerduty_core_alerts_non_prod" { + count = local.is-preproduction ? 1 : 0 + depends_on = [ + aws_sns_topic.dacp_utilisation_alarm + ] + source = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0" + sns_topics = [aws_sns_topic.dacp_utilisation_alarm[0].name] + pagerduty_integration_key = local.pagerduty_integration_keys["dacp_non_prod_alarms"] +} + +# link the sns topic to the service - prod +module "pagerduty_core_alerts_prod" { + count = local.is-production ? 1 : 0 + depends_on = [ + aws_sns_topic.dacp_utilisation_alarm + ] + source = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0" + sns_topics = [aws_sns_topic.dacp_utilisation_alarm[0].name] + pagerduty_integration_key = local.pagerduty_integration_keys["dacp_prod_alarms"] +} diff --git a/terraform/environments/dacp/load_balancer.tf b/terraform/environments/dacp/load_balancer.tf index e853f3d7f10..251853d6c1c 100644 --- a/terraform/environments/dacp/load_balancer.tf +++ b/terraform/environments/dacp/load_balancer.tf @@ -154,3 +154,8 @@ resource "aws_lb_listener" "dacp_lb" { target_group_arn = aws_lb_target_group.dacp_target_group.arn } } + +resource "aws_wafv2_web_acl_association" "web_acl_association_my_lb" { + resource_arn = aws_lb.dacp_lb.arn + web_acl_arn = aws_wafv2_web_acl.dacp_web_acl.arn +} diff --git a/terraform/environments/dacp/waf.tf b/terraform/environments/dacp/waf.tf new file mode 100644 index 00000000000..84138d85ac8 --- /dev/null +++ b/terraform/environments/dacp/waf.tf @@ -0,0 +1,36 @@ +resource "aws_wafv2_web_acl" "dacp_web_acl" { + name = "dacp-web-acl" + scope = "REGIONAL" + + default_action { + allow {} + } + + rule { + name = "common-rule-set" + priority = 1 + + override_action { + none {} + } + + statement { + managed_rule_group_statement { + name = "AWSManagedRulesCommonRuleSet" + vendor_name = "AWS" + } + } + + visibility_config { + cloudwatch_metrics_enabled = true + metric_name = "AWSManagedRulesCommonRuleSetMetrics" + sampled_requests_enabled = true + } + } + + visibility_config { + cloudwatch_metrics_enabled = true + metric_name = "dacp-web-acl" + sampled_requests_enabled = true + } +}