cfn-guardian 0.6.5 → 0.6.10
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Dockerfile +2 -2
- data/docs/custom_checks/ecs_container_instance_check.md +18 -0
- data/docs/overview.md +1 -0
- data/lib/cfnguardian.rb +8 -4
- data/lib/cfnguardian/codecommit.rb +11 -2
- data/lib/cfnguardian/compile.rb +2 -0
- data/lib/cfnguardian/config/defaults.yaml +5 -1
- data/lib/cfnguardian/models/alarm.rb +25 -3
- data/lib/cfnguardian/models/event_subscription.rb +2 -0
- data/lib/cfnguardian/resources/ec2_instance.rb +11 -0
- data/lib/cfnguardian/resources/elastic_file_system.rb +11 -0
- data/lib/cfnguardian/resources/redshift_cluster.rb +22 -5
- data/lib/cfnguardian/resources/vpn_connection.rb +18 -0
- data/lib/cfnguardian/resources/vpn_tunnel.rb +18 -0
- data/lib/cfnguardian/version.rb +1 -1
- metadata +6 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 355680f054f4e9550f1709780e0b3a5d72c8773c0222bb2307621080a76728b2
|
4
|
+
data.tar.gz: 840685a1d7f15409e809e71944c90e433d428123d204e38c37113444c9508d44
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 5c8bb52fbeed1bcad2b05776798e5bd21861e08631801e607b6219bb93c5c1e53993355826b9f561aa6099364af09e9e1defa0ddf93f829db325499cc359ba3d
|
7
|
+
data.tar.gz: eff695bda7e0e2e9325f0f7ef332f6e2c7f12a1a32ed8dabfca0a04d7c61a93c5616df8711a7daff6f64bcbbf8b3808b9d01b080334d80c163bcc2712f7431cb
|
data/Dockerfile
CHANGED
@@ -0,0 +1,18 @@
|
|
1
|
+
# ECS Container Instance Check
|
2
|
+
|
3
|
+
Source: https://github.com/base2Services/aws-lambda-ecs-container-instance-check
|
4
|
+
|
5
|
+
Checks the agent status of a ECS container instance for a ECS cluster.
|
6
|
+
This check and alarms are created by default when a ECS cluster resource is specified in the config.
|
7
|
+
|
8
|
+
```yaml
|
9
|
+
Resources:
|
10
|
+
ECSCluster:
|
11
|
+
- Id: my-cluster
|
12
|
+
|
13
|
+
Templates:
|
14
|
+
ECSCluster:
|
15
|
+
# override the alarm defaults
|
16
|
+
ECSContianerInstancesDisconnected:
|
17
|
+
...
|
18
|
+
```
|
data/docs/overview.md
CHANGED
@@ -14,6 +14,7 @@
|
|
14
14
|
7. [SQL](custom_checks/sql.md)
|
15
15
|
8. [TLS](custom_checks/tls.md)
|
16
16
|
9. [Azure File Check](custom_checks/azure_file_check.md)
|
17
|
+
10. [ECS Container Instance Check](custom_checks/ecs_container_instance_check.md)
|
17
18
|
5. [Event Subscriptions](event_subscriptions.md)
|
18
19
|
6. [Notifiers](notifiers.md)
|
19
20
|
7. [Maintenance Mode](maintenance_mode.md)
|
data/lib/cfnguardian.rb
CHANGED
@@ -299,14 +299,18 @@ module CfnGuardian
|
|
299
299
|
LONG
|
300
300
|
method_option :region, aliases: :r, type: :string, desc: "set the AWS region"
|
301
301
|
method_option :repository, type: :string, default: 'guardian', desc: "codecommit repository name"
|
302
|
+
method_option :branch, type: :string, default: 'master', desc: "codecommit branch"
|
303
|
+
method_option :count, type: :numeric, default: 10, desc: "number of last commits to retrieve"
|
302
304
|
|
303
305
|
def show_config_history
|
304
306
|
set_region(options[:region],true)
|
305
307
|
|
306
|
-
history = CfnGuardian::CodeCommit.new(options[:repository]).get_commit_history()
|
307
|
-
|
308
|
-
|
309
|
-
|
308
|
+
history = CfnGuardian::CodeCommit.new(options[:repository]).get_commit_history(options[:branch], options[:count])
|
309
|
+
if history.any?
|
310
|
+
puts Terminal::Table.new(
|
311
|
+
:headings => history.first.keys.map{|h| h.to_s.to_heading},
|
312
|
+
:rows => history.map(&:values))
|
313
|
+
end
|
310
314
|
end
|
311
315
|
|
312
316
|
desc "show-pipeline", "Shows the current state of the AWS code pipeline"
|
@@ -19,9 +19,18 @@ module CfnGuardian
|
|
19
19
|
return resp.branch.commit_id
|
20
20
|
end
|
21
21
|
|
22
|
-
def get_commit_history(branch
|
22
|
+
def get_commit_history(branch,count)
|
23
23
|
history = []
|
24
|
-
|
24
|
+
|
25
|
+
begin
|
26
|
+
commit = get_last_commit(branch)
|
27
|
+
rescue Aws::CodeCommit::Errors::BranchDoesNotExistException => e
|
28
|
+
logger.error "Branch #{branch} does not exist in the #{@repo_name} repository"
|
29
|
+
return []
|
30
|
+
rescue Aws::CodeCommit::Errors::RepositoryDoesNotExistException => e
|
31
|
+
logger.error "Respository #{@repo_name} does not exist in this AWS account or region"
|
32
|
+
return []
|
33
|
+
end
|
25
34
|
|
26
35
|
count.times do
|
27
36
|
|
data/lib/cfnguardian/compile.rb
CHANGED
@@ -40,6 +40,8 @@ require 'cfnguardian/resources/amazonmq_rabbitmq'
|
|
40
40
|
require 'cfnguardian/resources/batch'
|
41
41
|
require 'cfnguardian/resources/glue'
|
42
42
|
require 'cfnguardian/resources/step_functions'
|
43
|
+
require 'cfnguardian/resources/vpn_tunnel'
|
44
|
+
require 'cfnguardian/resources/vpn_connection'
|
43
45
|
require 'cfnguardian/version'
|
44
46
|
require 'cfnguardian/error'
|
45
47
|
|
@@ -8,7 +8,7 @@ Resources:
|
|
8
8
|
Node: Default
|
9
9
|
AmazonMQRabbitMQQueue:
|
10
10
|
- Id: Default
|
11
|
-
|
11
|
+
Broker: Default
|
12
12
|
Vhost: Default
|
13
13
|
ApiGateway:
|
14
14
|
- Id: Default
|
@@ -100,4 +100,8 @@ Resources:
|
|
100
100
|
Query: Default
|
101
101
|
SQSQueue:
|
102
102
|
- Id: Default
|
103
|
+
VPNTunnel:
|
104
|
+
- Id: Default
|
105
|
+
VPNConnection:
|
106
|
+
- Id: Default
|
103
107
|
|
@@ -122,8 +122,8 @@ module CfnGuardian
|
|
122
122
|
@group = 'AmazonMQRabbitMQQueue'
|
123
123
|
@namespace = 'AWS/AmazonMQ'
|
124
124
|
@dimensions = {
|
125
|
-
Broker: resource['
|
126
|
-
Queue: resource['
|
125
|
+
Broker: resource['Broker'],
|
126
|
+
Queue: resource['Id'],
|
127
127
|
VirtualHost: resource['Vhost']
|
128
128
|
}
|
129
129
|
end
|
@@ -445,6 +445,28 @@ module CfnGuardian
|
|
445
445
|
@dimensions = { StorageAccount: resource['Id'], StorageContainer: resource['Container'] }
|
446
446
|
end
|
447
447
|
end
|
448
|
-
|
448
|
+
|
449
|
+
class VPNTunnelAlarm < BaseAlarm
|
450
|
+
def initialize(resource)
|
451
|
+
super(resource)
|
452
|
+
@group = 'VPNTunnel'
|
453
|
+
@namespace = 'AWS/VPN'
|
454
|
+
@dimensions = {
|
455
|
+
TunnelIpAddress: resource['Id']
|
456
|
+
}
|
457
|
+
end
|
458
|
+
end
|
459
|
+
|
460
|
+
class VPNConnectionAlarm < BaseAlarm
|
461
|
+
def initialize(resource)
|
462
|
+
super(resource)
|
463
|
+
@group = 'VPNConnection'
|
464
|
+
@namespace = 'AWS/VPN'
|
465
|
+
@dimensions = {
|
466
|
+
VpnId: resource['Id']
|
467
|
+
}
|
468
|
+
end
|
469
|
+
end
|
470
|
+
|
449
471
|
end
|
450
472
|
end
|
@@ -107,5 +107,7 @@ module CfnGuardian
|
|
107
107
|
class NetworkTargetGroupEventSubscription < BaseEventSubscription; end
|
108
108
|
class RedshiftClusterEventSubscription < BaseEventSubscription; end
|
109
109
|
class StepFunctionsSubscription < BaseEventSubscription; end
|
110
|
+
class VPNTunnelEventSubscription < BaseEventSubscription; end
|
111
|
+
class VPNConnectionEventSubscription < BaseEventSubscription; end
|
110
112
|
end
|
111
113
|
end
|
@@ -17,6 +17,17 @@ module CfnGuardian
|
|
17
17
|
alarm.threshold = 90
|
18
18
|
alarm.evaluation_periods = 10
|
19
19
|
@alarms.push(alarm)
|
20
|
+
|
21
|
+
alarm = CfnGuardian::Models::Ec2InstanceAlarm.new(@resource)
|
22
|
+
alarm.name = 'CPUCreditBalanceLow'
|
23
|
+
alarm.metric_name = 'CPUCreditBalance'
|
24
|
+
alarm.comparison_operator = 'LessThanThreshold'
|
25
|
+
alarm.statistic = 'Minimum'
|
26
|
+
alarm.threshold = 100
|
27
|
+
alarm.evaluation_periods = 5
|
28
|
+
alarm.treat_missing_data = 'notBreaching'
|
29
|
+
alarm.datapoints_to_alarm = 5
|
30
|
+
@alarms.push(alarm)
|
20
31
|
end
|
21
32
|
|
22
33
|
def default_event_subscriptions()
|
@@ -11,6 +11,17 @@ module CfnGuardian
|
|
11
11
|
alarm.evaluation_periods = 5
|
12
12
|
alarm.statistic = 'Minimum'
|
13
13
|
@alarms.push(alarm)
|
14
|
+
|
15
|
+
alarm = CfnGuardian::Models::ElasticFileSystemAlarm.new(@resource)
|
16
|
+
alarm.name = 'BurstCreditBalanceLow'
|
17
|
+
alarm.metric_name = 'BurstCreditBalance'
|
18
|
+
alarm.comparison_operator = 'LessThanThreshold'
|
19
|
+
alarm.statistic = 'Minimum'
|
20
|
+
alarm.threshold = 1000000000000
|
21
|
+
alarm.evaluation_periods = 5
|
22
|
+
alarm.treat_missing_data = 'notBreaching'
|
23
|
+
alarm.datapoints_to_alarm = 5
|
24
|
+
@alarms.push(alarm)
|
14
25
|
end
|
15
26
|
end
|
16
27
|
end
|
@@ -1,14 +1,14 @@
|
|
1
1
|
module CfnGuardian::Resource
|
2
2
|
class RedshiftCluster < Base
|
3
|
-
|
4
|
-
def default_alarms
|
3
|
+
|
4
|
+
def default_alarms
|
5
5
|
alarm = CfnGuardian::Models::RedshiftClusterAlarm.new(@resource)
|
6
6
|
alarm.name = 'CPUUtilizationHighSpike'
|
7
7
|
alarm.metric_name = 'CPUUtilization'
|
8
8
|
alarm.threshold = 95
|
9
9
|
alarm.evaluation_periods = 10
|
10
10
|
@alarms.push(alarm)
|
11
|
-
|
11
|
+
|
12
12
|
alarm = CfnGuardian::Models::RedshiftClusterAlarm.new(@resource)
|
13
13
|
alarm.name = 'CPUUtilizationHighBase'
|
14
14
|
alarm.metric_name = 'CPUUtilization'
|
@@ -16,7 +16,7 @@ module CfnGuardian::Resource
|
|
16
16
|
alarm.evaluation_periods = 60
|
17
17
|
alarm.alarm_action = 'Warning'
|
18
18
|
@alarms.push(alarm)
|
19
|
-
|
19
|
+
|
20
20
|
alarm = CfnGuardian::Models::RedshiftClusterAlarm.new(@resource)
|
21
21
|
alarm.name = 'UnHealthyCluster'
|
22
22
|
alarm.metric_name = 'HealthStatus'
|
@@ -24,7 +24,24 @@ module CfnGuardian::Resource
|
|
24
24
|
alarm.threshold = 1
|
25
25
|
alarm.evaluation_periods = 10
|
26
26
|
@alarms.push(alarm)
|
27
|
+
|
28
|
+
alarm = CfnGuardian::Models::RedshiftClusterAlarm.new(@resource)
|
29
|
+
alarm.name = 'DiskSpaceUsedCrit'
|
30
|
+
alarm.metric_name = 'PercentageDiskSpaceUsed'
|
31
|
+
alarm.comparison_operator = 'GreaterThanThreshold'
|
32
|
+
alarm.threshold = 90
|
33
|
+
alarm.evaluation_periods = 10
|
34
|
+
@alarms.push(alarm)
|
35
|
+
|
36
|
+
alarm = CfnGuardian::Models::RedshiftClusterAlarm.new(@resource)
|
37
|
+
alarm.name = 'DiskSpaceUsedWarm'
|
38
|
+
alarm.metric_name = 'PercentageDiskSpaceUsed'
|
39
|
+
alarm.comparison_operator = 'GreaterThanThreshold'
|
40
|
+
alarm.threshold = 80
|
41
|
+
alarm.evaluation_periods = 10
|
42
|
+
alarm.alarm_action = 'Warning'
|
43
|
+
@alarms.push(alarm)
|
27
44
|
end
|
28
|
-
|
45
|
+
|
29
46
|
end
|
30
47
|
end
|
@@ -0,0 +1,18 @@
|
|
1
|
+
module CfnGuardian::Resource
|
2
|
+
class VPNConnection < Base
|
3
|
+
|
4
|
+
def default_alarms
|
5
|
+
alarm = CfnGuardian::Models::VPNConnectionAlarm.new(@resource)
|
6
|
+
alarm.name = 'VPNConnectionState'
|
7
|
+
alarm.metric_name = 'TunnelState'
|
8
|
+
alarm.comparison_operator = 'LessThanThreshold'
|
9
|
+
alarm.statistic = 'Average'
|
10
|
+
alarm.threshold = 0.5
|
11
|
+
alarm.evaluation_periods = 3
|
12
|
+
alarm.treat_missing_data = 'breaching'
|
13
|
+
alarm.datapoints_to_alarm = 3
|
14
|
+
@alarms.push(alarm)
|
15
|
+
end
|
16
|
+
|
17
|
+
end
|
18
|
+
end
|
@@ -0,0 +1,18 @@
|
|
1
|
+
module CfnGuardian::Resource
|
2
|
+
class VPNTunnel < Base
|
3
|
+
|
4
|
+
def default_alarms
|
5
|
+
alarm = CfnGuardian::Models::VPNTunnelAlarm.new(@resource)
|
6
|
+
alarm.name = 'VPNTunnelState'
|
7
|
+
alarm.metric_name = 'TunnelState'
|
8
|
+
alarm.comparison_operator = 'LessThanThreshold'
|
9
|
+
alarm.statistic = 'Minimum'
|
10
|
+
alarm.threshold = 1
|
11
|
+
alarm.evaluation_periods = 5
|
12
|
+
alarm.treat_missing_data = 'breaching'
|
13
|
+
alarm.datapoints_to_alarm = 5
|
14
|
+
@alarms.push(alarm)
|
15
|
+
end
|
16
|
+
|
17
|
+
end
|
18
|
+
end
|
data/lib/cfnguardian/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: cfn-guardian
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.6.
|
4
|
+
version: 0.6.10
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Guslington
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2021-
|
11
|
+
date: 2021-06-25 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: thor
|
@@ -238,6 +238,7 @@ files:
|
|
238
238
|
- docs/composite_alarms.md
|
239
239
|
- docs/custom_checks/azure_file_check.md
|
240
240
|
- docs/custom_checks/domain_expiry.md
|
241
|
+
- docs/custom_checks/ecs_container_instance_check.md
|
241
242
|
- docs/custom_checks/http.md
|
242
243
|
- docs/custom_checks/log_group_metric_filters.md
|
243
244
|
- docs/custom_checks/nrpe.md
|
@@ -306,6 +307,8 @@ files:
|
|
306
307
|
- lib/cfnguardian/resources/sqs_queue.rb
|
307
308
|
- lib/cfnguardian/resources/step_functions.rb
|
308
309
|
- lib/cfnguardian/resources/tls.rb
|
310
|
+
- lib/cfnguardian/resources/vpn_connection.rb
|
311
|
+
- lib/cfnguardian/resources/vpn_tunnel.rb
|
309
312
|
- lib/cfnguardian/s3.rb
|
310
313
|
- lib/cfnguardian/stacks/main.rb
|
311
314
|
- lib/cfnguardian/stacks/resources.rb
|
@@ -334,7 +337,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
334
337
|
- !ruby/object:Gem::Version
|
335
338
|
version: '0'
|
336
339
|
requirements: []
|
337
|
-
rubygems_version: 3.1.
|
340
|
+
rubygems_version: 3.1.6
|
338
341
|
signing_key:
|
339
342
|
specification_version: 4
|
340
343
|
summary: Manages AWS cloudwatch alarms with default templates using cloudformation
|