-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'upstream/main' into add-project-update-…
…automation-app-docker
- Loading branch information
Showing
21 changed files
with
942 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| */ | ||
|
|
||
| import {Alarm, ComparisonOperator, MathExpression, Metric, TreatMissingData} from "aws-cdk-lib/aws-cloudwatch"; | ||
| import { Construct } from "constructs"; | ||
| import { SnsMonitors, SnsMonitorsProps } from "./snsMonitor"; | ||
| import {Duration} from "aws-cdk-lib"; | ||
|
|
||
| interface automationAppSnsProps extends SnsMonitorsProps { | ||
| readonly automationAppSnsAlarms: Array<{ alertName: string, metricName: string}>; | ||
| } | ||
|
|
||
| export class AutomationAppSns extends SnsMonitors { | ||
| private readonly automationAppSnsAlarms: Array<{ alertName: string, metricName: string}>; | ||
| constructor(scope: Construct, id: string, props: automationAppSnsProps) { | ||
| super(scope, id, props); | ||
| this.automationAppSnsAlarms = props.automationAppSnsAlarms; | ||
| this.automationAppSnsAlarms.forEach(({ alertName, metricName }) => { | ||
| const alarm = this.automationAppFailed(alertName, metricName); | ||
| this.map[alarm[1]] = alarm[0]; | ||
| }); | ||
| this.createTopic(); | ||
| } | ||
|
|
||
| private automationAppFailed(alertName: string, metricName: string): [Alarm, string] { | ||
| const metricPeriod = Duration.minutes(10); | ||
|
|
||
| const automationAppFailedMetric = new Metric({ | ||
| namespace: this.alarmNameSpace, | ||
| metricName: metricName, | ||
| statistic: "Sum", | ||
| period: metricPeriod, | ||
| }); | ||
|
|
||
| const filledAutomationAppFailedMetric = new MathExpression({ | ||
| expression: "FILL(metric, 0)", | ||
| usingMetrics: { | ||
| metric: automationAppFailedMetric, | ||
| }, | ||
| period: metricPeriod, | ||
| }); | ||
|
|
||
| const alarmObject = new Alarm(this, `error_alarm_${alertName}`, { | ||
| metric: filledAutomationAppFailedMetric, | ||
| threshold: 1, | ||
| evaluationPeriods: 1, | ||
| comparisonOperator: ComparisonOperator.LESS_THAN_THRESHOLD, | ||
| datapointsToAlarm: 1, | ||
| treatMissingData: TreatMissingData.BREACHING, | ||
| alarmDescription: "Detect GitHub Automation App failure", | ||
| alarmName: alertName, | ||
| }); | ||
| return [alarmObject, alertName]; | ||
| } | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| */ | ||
|
|
||
| import { Duration, Stack, StackProps } from "aws-cdk-lib"; | ||
| import { Rule, RuleTargetInput, Schedule } from "aws-cdk-lib/aws-events"; | ||
| import { SfnStateMachine } from "aws-cdk-lib/aws-events-targets"; | ||
| import { Bucket } from "aws-cdk-lib/aws-s3"; | ||
| import { JsonPath, StateMachine, TaskInput } from "aws-cdk-lib/aws-stepfunctions"; | ||
| import { LambdaInvoke } from "aws-cdk-lib/aws-stepfunctions-tasks"; | ||
| import { Construct } from 'constructs'; | ||
| import { OpenSearchLambda } from "../constructs/lambda"; | ||
| import { OpenSearchDomainStack } from "./opensearch"; | ||
| import { VpcStack } from "./vpc"; | ||
| import {Effect, ManagedPolicy, PolicyDocument, PolicyStatement, Role, ServicePrincipal} from "aws-cdk-lib/aws-iam"; | ||
| import {Secret} from "aws-cdk-lib/aws-secretsmanager"; | ||
|
|
||
| export interface OpenSearchEventCanaryWorkflowStackProps extends StackProps { | ||
| readonly vpcStack: VpcStack; | ||
| readonly lambdaPackage: string; | ||
| readonly gitHubRepoTarget: string; | ||
| readonly gitHubAppSecret: Secret; | ||
| } | ||
|
|
||
| export interface WorkflowComponent { | ||
| opensearchEventCanaryWorkflowStateMachineName: string | ||
| } | ||
|
|
||
| export class OpenSearchEventCanaryWorkflowStack extends Stack { | ||
| public readonly workflowComponent: WorkflowComponent; | ||
| constructor(scope: Construct, id: string, props: OpenSearchEventCanaryWorkflowStackProps) { | ||
| super(scope, id, props); | ||
|
|
||
| const eventCanaryTask = this.createEventCanaryTask(this, | ||
| props.vpcStack, | ||
| props.lambdaPackage, | ||
| props.gitHubRepoTarget, | ||
| props.gitHubAppSecret, | ||
| ); | ||
|
|
||
| const opensearchEventCanaryWorkflow = new StateMachine(this, 'OpenSearchEventCanaryWorkflow', { | ||
| definition: eventCanaryTask, | ||
| timeout: Duration.minutes(15), | ||
| stateMachineName: 'OpenSearchEventCanaryWorkflow' | ||
| }) | ||
|
|
||
| new Rule(this, 'OpenSearchEventCanaryWorkflow-Every-10mins', { | ||
| schedule: Schedule.expression('cron(0/10 * * * ? *)'), | ||
| targets: [new SfnStateMachine(opensearchEventCanaryWorkflow)], | ||
| }); | ||
|
|
||
| this.workflowComponent = { | ||
| opensearchEventCanaryWorkflowStateMachineName: opensearchEventCanaryWorkflow.stateMachineName | ||
| } | ||
| } | ||
|
|
||
| private createEventCanaryTask(scope: Construct, vpcStack: VpcStack, lambdaPackage: string, gitHubRepoTarget: string, gitHubAppSecret: Secret) { | ||
| const eventCanaryLambdaRole = new Role(this, 'OpenSearchEventCanaryLambdaRole', { | ||
| assumedBy: new ServicePrincipal('lambda.amazonaws.com'), | ||
| description: "OpenSearch Metrics Event Canary Lambda Execution Role", | ||
| roleName: "OpenSearchEventCanaryLambdaRole", | ||
| managedPolicies: [ | ||
| ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'), | ||
| ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'), | ||
| ] | ||
| }); | ||
|
|
||
| eventCanaryLambdaRole.addToPolicy( | ||
| new PolicyStatement({ | ||
| effect: Effect.ALLOW, | ||
| actions: ["secretsmanager:GetSecretValue"], | ||
| resources: [`${gitHubAppSecret.secretFullArn}`], | ||
| }), | ||
| ); | ||
|
|
||
| const eventCanaryLambda = new OpenSearchLambda(this, "OpenSearchMetricsEventCanaryLambdaFunction", { | ||
| lambdaNameBase: "OpenSearchMetricsEventCanary", | ||
| handler: "org.opensearchmetrics.lambda.EventCanaryLambda", | ||
| lambdaZipPath: `../../../build/distributions/${lambdaPackage}`, | ||
| vpc: vpcStack.vpc, | ||
| securityGroup: vpcStack.securityGroup, | ||
| role: eventCanaryLambdaRole, | ||
| environment: { | ||
| GITHUB_REPO_TARGET: gitHubRepoTarget, | ||
| API_CREDENTIALS_SECRETS: gitHubAppSecret.secretName, | ||
| SECRETS_MANAGER_REGION: gitHubAppSecret.env.region, | ||
| } | ||
| }).lambda; | ||
| return new LambdaInvoke(scope, 'Event Canary Lambda', { | ||
| lambdaFunction: eventCanaryLambda, | ||
| resultPath: JsonPath.DISCARD, | ||
| timeout: Duration.minutes(15) | ||
| }).addRetry(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| */ | ||
|
|
||
| import { App } from "aws-cdk-lib"; | ||
| import { Template } from "aws-cdk-lib/assertions"; | ||
| import Project from "../lib/enums/project"; | ||
| import { VpcStack } from "../lib/stacks/vpc"; | ||
| import {OpenSearchEventCanaryWorkflowStack} from "../lib/stacks/eventCanaryWorkflow"; | ||
| import {OpenSearchMetricsSecretsStack} from "../lib/stacks/secrets"; | ||
|
|
||
| test('Event Canary Workflow Stack Test', () => { | ||
| const app = new App(); | ||
| const vpcStack = new VpcStack(app, 'Test-OpenSearchHealth-VPC', {}); | ||
|
|
||
| // Create Secret Manager for the metrics project | ||
| const openSearchMetricsSecretsStack = new OpenSearchMetricsSecretsStack(app, "OpenSearchMetrics-Secrets", { | ||
| secretName: 'metrics-creds' | ||
| }); | ||
|
|
||
| const openSearchEventCanaryWorkflowStack = new OpenSearchEventCanaryWorkflowStack(app, 'OpenSearchEventCanary-Workflow', { | ||
| vpcStack: vpcStack, | ||
| lambdaPackage: Project.LAMBDA_PACKAGE, | ||
| gitHubRepoTarget: Project.EVENT_CANARY_REPO_TARGET, | ||
| gitHubAppSecret: openSearchMetricsSecretsStack.secret, | ||
| }) | ||
|
|
||
| openSearchEventCanaryWorkflowStack.node.addDependency(vpcStack); | ||
| const template = Template.fromStack(openSearchEventCanaryWorkflowStack); | ||
| template.resourceCountIs('AWS::IAM::Role', 3); | ||
| template.resourceCountIs('AWS::Lambda::Function', 1); | ||
| template.hasResourceProperties('AWS::Lambda::Function', { | ||
| "FunctionName": "OpenSearchMetricsEventCanaryLambda", | ||
| "Handler": "org.opensearchmetrics.lambda.EventCanaryLambda" | ||
| }); | ||
| template.resourceCountIs('AWS::StepFunctions::StateMachine', 1); | ||
| template.hasResourceProperties('AWS::StepFunctions::StateMachine', { | ||
| "DefinitionString": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "{\"StartAt\":\"Event Canary Lambda\",\"States\":{\"Event Canary Lambda\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ClientExecutionTimeoutException\",\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"States.ALL\"]}],\"Type\":\"Task\",\"TimeoutSeconds\":900,\"ResultPath\":null,\"Resource\":\"arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":states:::lambda:invoke\",\"Parameters\":{\"FunctionName\":\"", | ||
| { | ||
| "Fn::GetAtt": [ | ||
| "OpenSearchMetricsEventCanaryLambda358BAA07", | ||
| "Arn" | ||
| ] | ||
| }, | ||
| "\",\"Payload.$\":\"$\"}}},\"TimeoutSeconds\":900}" | ||
| ] | ||
| ] | ||
| }, | ||
| "RoleArn": { | ||
| "Fn::GetAtt": [ | ||
| "OpenSearchEventCanaryWorkflowRoleDC920D0E", | ||
| "Arn" | ||
| ] | ||
| }, | ||
| "StateMachineName": "OpenSearchEventCanaryWorkflow" | ||
| }); | ||
| template.resourceCountIs('AWS::Events::Rule', 1); | ||
| template.hasResourceProperties('AWS::Events::Rule', { | ||
| "ScheduleExpression": "cron(0/10 * * * ? *)", | ||
| "State": "ENABLED", | ||
| "Targets": [ | ||
| { | ||
| "Arn": { | ||
| "Ref": "OpenSearchEventCanaryWorkflowEB1017B7" | ||
| }, | ||
| "Id": "Target0", | ||
| "RoleArn": { | ||
| "Fn::GetAtt": [ | ||
| "OpenSearchEventCanaryWorkflowEventsRoleA5644829", | ||
| "Arn" | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| }); | ||
| }); |
Oops, something went wrong.