marbot-lambda-function.yml

---
# Copyright widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'marbot.io: Lambda function monitoring (https://github.com/marbot-io/monitoring-jump-start)'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'marbot endpoint'
      Parameters:
      - EndpointId
      - Stage
    - Label:
        default: 'Lambda'
      Parameters:
      - FunctionName
    - Label:
        default: 'Thresholds'
      Parameters:
      - ErrorsThreshold
      - ThrottlesThreshold
Parameters:
  EndpointId:
    Description: 'Your marbot endpoint ID (to get this value: select a channel where marbot belongs to and send a message like this: "@marbot show me my endpoint id").'
    Type: String
  Stage:
    Description: 'marbot stage (never change this!).'
    Type: String
    Default: v1
    AllowedValues: [v1, dev]
  FunctionName:
    Description: 'The Lambda function name that you want to monitor.'
    Type: String
  ErrorsThreshold:
    Description: 'The maximum errors of a Lambda function (set to -1 to disable).'
    Type: Number
    Default: 0
    MinValue: -1
  ThrottlesThreshold:
    Description: 'The maximum throttles of a Lambda function (set to -1 to disable).'
    Type: Number
    Default: 0
    MinValue: -1
Conditions:
  HasErrorsThreshold: !Not [!Equals [!Ref ErrorsThreshold, '-1']]
  HasThrottlesThreshold: !Not [!Equals [!Ref ThrottlesThreshold, '-1']]
Resources:
  ##########################################################################
  #                                                                        #
  #                                 TOPIC                                  #
  #                                                                        #
  ##########################################################################
  Topic:
    Type: 'AWS::SNS::Topic'
    Properties: {}
  TopicPolicy:
    Type: 'AWS::SNS::TopicPolicy'
    Properties:
      PolicyDocument:
        Id: Id1
        Version: '2012-10-17'
        Statement:
        - Sid: Sid1
          Effect: Allow
          Principal:
            Service: 'events.amazonaws.com' # Allow EventBridge
          Action: 'sns:Publish'
          Resource: !Ref Topic
        - Sid: Sid2
          Effect: Allow
          Principal:
            AWS: '*' # Allow CloudWatch Alarms
          Action: 'sns:Publish'
          Resource: !Ref Topic
          Condition:
            StringEquals:
              'AWS:SourceOwner': !Ref 'AWS::AccountId'
      Topics:
      - !Ref Topic
  TopicEndpointSubscription:
    DependsOn: TopicPolicy
    Type: 'AWS::SNS::Subscription'
    Properties:
      DeliveryPolicy:
        healthyRetryPolicy:
          minDelayTarget: 1
          maxDelayTarget: 60
          numRetries: 100
          numNoDelayRetries: 0
          backoffFunction: exponential
        throttlePolicy:
          maxReceivesPerSecond: 1
      Endpoint: !Sub 'https://api.marbot.io/${Stage}/endpoint/${EndpointId}'
      Protocol: https
      TopicArn: !Ref Topic
  MonitoringJumpStartEvent:
    DependsOn: TopicEndpointSubscription
    Type: 'AWS::Events::Rule'
    Properties:
      Description: 'Monitoring Jump Start connection. (created by marbot)'
      ScheduleExpression: 'rate(30 days)'
      State: ENABLED
      Targets:
      - Arn: !Ref Topic
        Id: marbot
        Input: !Sub |
          {
            "Type": "monitoring-jump-start-connection",
            "StackTemplate": "marbot-lambda-function",
            "StackVersion": "1.1.2",
            "Partition": "${AWS::Partition}",
            "AccountId": "${AWS::AccountId}",
            "Region": "${AWS::Region}",
            "StackId": "${AWS::StackId}",
            "StackName": "${AWS::StackName}"
          }
  ##########################################################################
  #                                                                        #
  #                                 ALARMS                                 #
  #                                                                        #
  ##########################################################################
  ErrorsAlarm:
    Condition: HasErrorsThreshold
    DependsOn: TopicEndpointSubscription
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - !Ref Topic
      AlarmDescription: 'Invocations failed due to errors'
      ComparisonOperator: GreaterThanThreshold
      DatapointsToAlarm: 1 # We use a 1 out of 18 alarm: if we only look at one period we might miss an error because of the eventual consistent nature of CloudWatch and the fact that Lambda uses the invocation timestamp for metric data
      Dimensions:
      - Name: FunctionName
        Value: !Ref FunctionName
      EvaluationPeriods: 18 # We use a 1 out of 18 alarm: if we only look at one period we might miss an error because of the eventual consistent nature of CloudWatch and the fact that Lambda uses the invocation timestamp for metric data
      MetricName: Errors
      Namespace: 'AWS/Lambda'
      OKActions:
      - !Ref Topic
      Period: 60
      Statistic: Sum
      Threshold: !Ref ErrorsThreshold
      TreatMissingData: notBreaching
  ThrottlesAlarm:
    Condition: HasThrottlesThreshold
    DependsOn: TopicEndpointSubscription
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - !Ref Topic
      AlarmDescription: 'Invocation attempts were throttled due to invocation rates exceeding the concurrent limits'
      ComparisonOperator: GreaterThanThreshold
      DatapointsToAlarm: 1 # We use a 1 out of 18 alarm: if we only look at one period we might miss an error because of the eventual consistent nature of CloudWatch and the fact that Lambda uses the invocation timestamp for metric data
      Dimensions:
      - Name: FunctionName
        Value: !Ref FunctionName
      EvaluationPeriods: 18 # We use a 1 out of 18 alarm: if we only look at one period we might miss an error because of the eventual consistent nature of CloudWatch and the fact that Lambda uses the invocation timestamp for metric data
      MetricName: Throttles
      Namespace: 'AWS/Lambda'
      OKActions:
      - !Ref Topic
      Period: 60
      Statistic: Sum
      Threshold: !Ref ThrottlesThreshold
      TreatMissingData: notBreaching
Outputs:
  StackName:
    Description: 'Stack name.'
    Value: !Sub '${AWS::StackName}'
  StackTemplate:
    Description: 'Stack template.'
    Value: 'marbot-lambda-function'
  StackVersion:
    Description: 'Stack version.'
    Value: '1.1.2'