cfn-guardian 0.6.11 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc62d2d0be60b4f28ab5da32207415340db06de99ee00f2a326174903e2d7a8b
-  data.tar.gz: d6bf90ce725692e2396ed0e337a4cd773f3b187402e2d1ab081f219bc1898c85
+  metadata.gz: 72248fcb349fb266e18552dd36dcff37b4757574fb91583092dad34037c8be5f
+  data.tar.gz: f3db4dfb6d7d91e4e39a6832b832d6b2dc75537b0de0a31aaa2ad0837389a4bd
 SHA512:
-  metadata.gz: d9b1c3ad0dc61891ca602b2156fbd523cdccc77296d6d959a420e66d2dfbcd449983160f11e8c33b4f4380e56930eacde37f35e0d048935b5aaf969736f2fd9a
-  data.tar.gz: 657b0c5a4eb265e58a36173157b1850a41a6d311d471fe5f9363d18b25420d97126c219057cd22cd6b1a4456140da5abdaa539969e8ce9b6759f54808653876a
+  metadata.gz: d8bc7d02245dde79df68affc7bc910b7c9657172b0473bb48e71e03e39cd83d6869e649ec362cc7592c31900bf5338f809001f2efac177c2c0b3a33fe326f333
+  data.tar.gz: 6b7789eca2cbfeefe60d997de944d004bc481d27db7b8c49bfb016ed0924bff971503d34288caf56d787cc4145426988734b146ec9cdcd7addc8eebf5049fe29

data/README.md

@@ -41,3 +41,4 @@ CfnGuardian is a AWS monitoring tool with a few capabilities:
 - Redshift Cluster
 - SQS Queues
 - LogGroup Metric Filters
+- ElasticSearch

data/docs/maintenance_mode.md

@@ -8,8 +8,8 @@ Alarms can be provided to the function the following ways
 Alarm names be provided by a space delimited list using the `--alarms` switch.
 
 ```bash
-cfn-guardian disable-alarms --group alarm-1 alarm-2
-cfn-guardian enable-alarms --group alarm-1 alarm-2
+cfn-guardian disable-alarms --alarms alarm-1 alarm-2
+cfn-guardian enable-alarms --alarms alarm-1 alarm-2
 ```
 
 ## Alarm Name Prefix
@@ -60,10 +60,16 @@ Resources:
     StatusCode: 200
 
 # Define the top level key
-MaintenaceGroups:
+MaintenanceGroups:
   
   # Define the group name
   AppUpdate:
+    # Optionally set a schedule for enabling/disabling
+    Schedules:
+      Disable: '30 0 * * ? *'
+      Enable: '00 1 * * ? *'
+      #Optionally specify and set to true to enable logging on lambda
+      Debug: true
     # Define the resource group
     ECSService:
       # define the alarms in the resource group
@@ -82,4 +88,6 @@ MaintenaceGroups:
 ```bash
 cfn-guardian disable-alarms --group AppUpdate
 cfn-guardian enable-alarms --group AppUpdate
-```
+```
+
+Optionally add a Schedule for disabling and enabling alarm actions as shown in the example above to deploy a lambda function that will be invoked by event rules created with the given cron expressions.

data/docs/resources.md

@@ -54,6 +54,7 @@ Resources:
 | Lambda                      | Id               |
 | CloudFrontDistribution      | Id               |
 | SQSQueue                    | Id               |
+| ElasticSearch               | Id, Domain       |
 
 
 ## Custom Resource Groups

data/lib/cfnguardian/compile.rb

@@ -61,7 +61,7 @@ module CfnGuardian
       @composites = config.fetch('Composites',{})
       @templates = config.fetch('Templates',{})
       @topics = config.fetch('Topics',{})
-      @maintenance_groups = config.fetch('MaintenaceGroups', {})
+      @maintenance_groups = config.fetch('MaintenanceGroups', {})
       @event_subscriptions = config.fetch('EventSubscriptions', {})
       
       # Make sure the default topics exist if they aren't supplied in the alarms.yaml
@@ -69,7 +69,6 @@ module CfnGuardian
         @topics[topic] = '' unless @topics.has_key?(topic)
       end
 
-      @maintenance_group_list = @maintenance_groups.keys.map {|group| "#{group}MaintenanceGroup"}
       @resources = []
       @stacks = []
       @checks = []
@@ -116,6 +115,9 @@ module CfnGuardian
       
       @maintenance_groups.each do |maintenance_group,resource_groups|
         resource_groups.each do |group, alarms|
+          if group == 'Schedules' 
+            next
+          end
           alarms.each do |alarm, resources|
             resources.each do |resource|
 
@@ -190,7 +192,7 @@ module CfnGuardian
       resources = split_resources(bucket,path)
       
       main_stack = CfnGuardian::Stacks::Main.new()
-      main_stack.build_template(@stacks,@checks,@topics,@maintenance_group_list,@ssm_parameters)
+      main_stack.build_template(@stacks,@checks,@topics,@maintenance_groups,@ssm_parameters)
       valid = main_stack.template.validate
       FileUtils.mkdir_p 'out'
       File.write("out/guardian.compiled.yaml", JSON.parse(valid.to_json).to_yaml)

data/lib/cfnguardian/config/defaults.yaml

@@ -41,7 +41,7 @@ Resources:
   - Id: Default
   ElasticSearch:
   - Id: Default
-  - Domain: Default
+    Domain: Default
   ElastiCacheReplicationGroup:
   - Id: Default
   Http:

data/lib/cfnguardian/models/alarm.rb

@@ -238,9 +238,12 @@ module CfnGuardian
       def initialize(resource)
         super(resource)
         @group = 'ElasticSearch'
-        @namespace = 'AWS/ElasticSearch'
-        @dimensions = { DomainName: resource['Domain'], ClientId: resource['Id']}
-        @comparison_operator = 'GreaterThanThreshold'
+        @namespace = 'AWS/ES'
+        @dimensions = { 
+          DomainName: resource['Domain'], 
+          ClientId: resource['Id'] 
+        }
+        @comparison_operator = 'GreaterThanOrEqualToThreshold'
         @threshold = 1
         @evaluation_periods = 5
         @treat_missing_data = 'breaching'

data/lib/cfnguardian/models/check.rb

@@ -40,7 +40,7 @@ module CfnGuardian
         @name = 'HttpCheck'
         @package = 'http-check'
         @handler = 'handler.http_check'
-        @version = 'f739631de74f1a882163b7e584a8b4710ccbc134'
+        @version = 'dba2670c753d0d3386937fbcc1fc89499a4a0fa7'
         @runtime = 'python3.7'
       end
     end
@@ -205,5 +205,16 @@ module CfnGuardian
       end
     end
 
+    class MaintenanceGroupCheck < BaseCheck
+      def initialize(resource)
+        super(resource)
+        @name = 'MaintenanceGroupCheck'
+        @package = 'maintenance-group-check'
+        @handler = 'handler.maintenance_group_check'
+        @version = '5b795e6509068d1767e4be80f2e6868cbeb3b425'
+        @runtime = 'python3.7'
+      end 
+    end
+
   end
-end
+end

data/lib/cfnguardian/resources/elastic_search.rb

@@ -7,7 +7,7 @@ module CfnGuardian::Resource
         alarm.metric_name = 'Nodes'
         alarm.threshold = 3
         alarm.evaluation_periods = 1440 # 24 hours
-        alarm.data_points_to_alarm = 1
+        alarm.datapoints_to_alarm = 1
         alarm.comparison_operator = 'LessThanOrEqualToThreshold'
         alarm.alarm_action = 'Critical'
         alarm.enabled = false
@@ -18,7 +18,7 @@ module CfnGuardian::Resource
         alarm.metric_name = 'JVMMemoryPressure'
         alarm.threshold = 72
         alarm.evaluation_periods = 5
-        alarm.data_points_to_alarm = 3
+        alarm.datapoints_to_alarm = 3
         alarm.alarm_action = 'Warning'
         @alarms.push(alarm)
 
@@ -61,6 +61,7 @@ module CfnGuardian::Resource
         alarm.evaluation_periods = 1
         alarm.alarm_action = 'Warning'
         alarm.statistic = 'Minimum'
+        alarm.comparison_operator = 'LessThanOrEqualToThreshold'
         @alarms.push(alarm)  
 
         alarm = CfnGuardian::Models::ElasticSearchAlarm.new(@resource)
@@ -69,6 +70,8 @@ module CfnGuardian::Resource
         alarm.threshold = 25000
         alarm.evaluation_periods = 1
         alarm.alarm_action = 'Critical'
+        alarm.statistic = 'Minimum'
+        alarm.comparison_operator = 'LessThanOrEqualToThreshold'
         @alarms.push(alarm)  
        
         alarm = CfnGuardian::Models::ElasticSearchAlarm.new(@resource)
@@ -76,7 +79,7 @@ module CfnGuardian::Resource
         alarm.metric_name = 'CPUUtilization'
         alarm.threshold = 75
         alarm.evaluation_periods = 15
-        alarm.data_points_to_alarm = 3
+        alarm.datapoints_to_alarm = 3
         alarm.alarm_action = 'Warning'
         alarm.statistic = 'Average'
         @alarms.push(alarm)  
@@ -86,7 +89,7 @@ module CfnGuardian::Resource
         alarm.metric_name = 'CPUUtilization'
         alarm.threshold = 95
         alarm.evaluation_periods = 5
-        alarm.data_points_to_alarm = 3
+        alarm.datapoints_to_alarm = 3
         alarm.alarm_action = 'Critical'
         alarm.statistic = 'Average'
         @alarms.push(alarm)  
@@ -98,7 +101,6 @@ module CfnGuardian::Resource
         alarm.evaluation_periods = 1
         alarm.alarm_action = 'Warning'
         alarm.statistic = 'Minimum'
-        alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
         @alarms.push(alarm)  
 
         alarm = CfnGuardian::Models::ElasticSearchAlarm.new(@resource)
@@ -108,7 +110,6 @@ module CfnGuardian::Resource
         alarm.evaluation_periods = 1
         alarm.alarm_action = 'Critical'
         alarm.statistic = 'Minimum'
-        alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
         alarm.enabled = false
         @alarms.push(alarm)  
 
@@ -119,7 +120,6 @@ module CfnGuardian::Resource
         alarm.evaluation_periods = 1
         alarm.alarm_action = 'Critical'
         alarm.statistic = 'Minimum'
-        alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
         @alarms.push(alarm)  
 
         alarm = CfnGuardian::Models::ElasticSearchAlarm.new(@resource)
@@ -129,7 +129,6 @@ module CfnGuardian::Resource
         alarm.evaluation_periods = 1
         alarm.alarm_action = 'Warning'
         alarm.statistic = 'Minimum'
-        alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
         @alarms.push(alarm)  
 
     end

data/lib/cfnguardian/resources/vpn_connection.rb

@@ -3,7 +3,18 @@ module CfnGuardian::Resource
       
       def default_alarms    
         alarm = CfnGuardian::Models::VPNConnectionAlarm.new(@resource)
-        alarm.name = 'VPNConnectionState'
+        alarm.name = 'VPNConnectionStateNonRedundant'
+        alarm.metric_name = 'TunnelState'
+        alarm.comparison_operator = 'LessThanThreshold'
+        alarm.statistic = 'Average'
+        alarm.threshold = 1.0
+        alarm.evaluation_periods = 3
+        alarm.treat_missing_data = 'breaching'
+        alarm.datapoints_to_alarm = 3
+        @alarms.push(alarm)
+
+        alarm = CfnGuardian::Models::VPNConnectionAlarm.new(@resource)
+        alarm.name = 'VPNConnectionStateAllDown'
         alarm.metric_name = 'TunnelState'
         alarm.comparison_operator = 'LessThanThreshold'
         alarm.statistic = 'Average'

data/lib/cfnguardian/stacks/main.rb

@@ -4,6 +4,7 @@ module CfnGuardian
   module Stacks
     class Main
       include CfnDsl::CloudFormation
+      include Logging
       
       attr_reader :parameters, :template
       
@@ -22,12 +23,10 @@ module CfnGuardian
           parameter.Default sns
           parameters[name] = Ref(name)
         end
-        
-        maintenance_groups.each do |group|
-          topic = @template.SNS_Topic(group)
-          topic.TopicName group
-          topic.Tags([{ Key: 'Environment', Value: 'guardian' }])
-          parameters[group] = Ref(group)
+
+        if maintenance_groups.any?
+          add_lambda(CfnGuardian::Models::MaintenanceGroupCheck.new(maintenance_groups))
+          maintenance_groups.each {|group,config| add_maintenance_group(group,config,parameters)}
         end
         
         add_iam_role(ssm_parameters)
@@ -73,6 +72,17 @@ module CfnGuardian
             }]
           }
         }
+        policies << {
+          PolicyName: 'maintenance-group-actions',
+          PolicyDocument: {
+            Version: '2012-10-17',
+            Statement: [{
+              Effect: 'Allow',
+              Action: [ 'cloudwatch:DescribeAlarms', 'cloudwatch:DisableAlarmActions', 'cloudwatch:EnableAlarmActions', 'cloudwatch:SetAlarmState' ],
+              Resource: FnSub("arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:*")
+            }]
+          }
+        }
         if ssm_parameters.any?
           policies << {
             PolicyName: 'ssm-parameters',
@@ -165,7 +175,37 @@ module CfnGuardian
           end
         end
       end
-      
+
+      def add_maintenance_group(group,config,parameters)
+        group_name = "#{group}MaintenanceGroup"
+        schedules = config.fetch('Schedules', {})
+        logging = config.dig('Schedules', 'Debug').to_s
+
+        topic = @template.SNS_Topic(group_name)
+        topic.TopicName group_name
+        topic.Tags([{ Key: 'Environment', Value: 'guardian' }])
+        parameters[group_name] = Ref(group_name)
+
+        if schedules.any?
+          event = @template.Events_Rule("#{group_name}EnableEvent")
+          event.Name "#{group_name}EnableEvent"
+          event.ScheduleExpression "cron(#{schedules['Enable']})"
+          event.Targets([{ 
+            Arn: FnGetAtt('MaintenanceGroupCheckFunction', 'Arn'), 
+            Id: "#{group_name}EnableTarget", 
+            Input: {action:"enable_alarms", maintenance_group: group_name, logging: logging}.to_json
+          }])
+
+          event = @template.Events_Rule("#{group_name}DisableEvent")
+          event.Name "#{group_name}DisableEvent"
+          event.ScheduleExpression "cron(#{schedules['Disable']})"            
+          event.Targets([{ 
+            Arn: FnGetAtt('MaintenanceGroupCheckFunction', 'Arn'), 
+            Id: "#{group_name}DisableTarget", 
+            Input: {action:"disable_alarms", maintenance_group: group_name, logging: logging}.to_json
+          }])
+        end
+      end
     end
   end
 end

data/lib/cfnguardian/version.rb

@@ -1,4 +1,4 @@
 module CfnGuardian
-  VERSION = "0.6.11"
+  VERSION = "0.7.1"
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-guardian
 version: !ruby/object:Gem::Version
-  version: 0.6.11
+  version: 0.7.1
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-06-30 00:00:00.000000000 Z
+date: 2021-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor