cfn-guardian 0.7.7 → 0.7.11
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Dockerfile +1 -1
- data/README.md +1 -0
- data/docs/event_subscriptions.md +17 -5
- data/docs/resources.md +1 -0
- data/lib/cfnguardian/compile.rb +1 -0
- data/lib/cfnguardian/config/defaults.yaml +2 -0
- data/lib/cfnguardian/models/alarm.rb +16 -0
- data/lib/cfnguardian/resources/amazonmq_broker.rb +6 -2
- data/lib/cfnguardian/resources/apigateway.rb +0 -3
- data/lib/cfnguardian/resources/documentdb_cluster.rb +40 -0
- data/lib/cfnguardian/resources/ecs_service.rb +56 -3
- data/lib/cfnguardian/resources/http.rb +2 -0
- data/lib/cfnguardian/resources/lambda.rb +0 -5
- data/lib/cfnguardian/resources/log_group.rb +0 -1
- data/lib/cfnguardian/resources/sqs_queue.rb +0 -2
- data/lib/cfnguardian/version.rb +1 -1
- metadata +3 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ae2d9c8f676d3fede74350ec76fb2b8bddcb6f8e8762c1a5b36775c497751e01
|
4
|
+
data.tar.gz: 42057804970c06d585b61f2b678c2325835d8e625404a0bea7a47b282e70c388
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 005324bcb952e08fba96f90642f963cdc392f48aff34c40fe1d35b1ba9323a4d7bcafb4a245c74ed6eb63d3302e4feb986388063aff37d514996d6a2dc14e37a
|
7
|
+
data.tar.gz: 3101c21efc47f495cb40dd9ee887e0913a3e0d846ef14ab9671cf049a8bd09bfb72f221aace3e51d0d69b2d5a98477344044eec9bcf9ea9c4fe07a239f99d19b
|
data/Dockerfile
CHANGED
data/README.md
CHANGED
data/docs/event_subscriptions.md
CHANGED
@@ -10,14 +10,14 @@ As with the default alarms in Guardian, there are default events for some resour
|
|
10
10
|
|
11
11
|
## Overriding Defaults
|
12
12
|
|
13
|
-
Default
|
13
|
+
Default properties of the events can be overridden through the config YAML using the `EventsSubscriptions` top level key.
|
14
14
|
For example here we are changing the topic the event is being send to.
|
15
15
|
|
16
16
|
```yaml
|
17
17
|
Topics:
|
18
18
|
CustomEvents: arn:aws:sns....
|
19
19
|
|
20
|
-
|
20
|
+
EventSubscriptions:
|
21
21
|
Ec2Instance:
|
22
22
|
InstanceTerminated:
|
23
23
|
Topic: CustomEvents
|
@@ -28,12 +28,24 @@ EventSubscription:
|
|
28
28
|
Default events can be disabled, the same way default alarms can be disabled through the config YAML.
|
29
29
|
|
30
30
|
```yaml
|
31
|
-
|
31
|
+
EventSubscriptions:
|
32
32
|
Ec2Instance:
|
33
33
|
# set the instance terminated event to false to disable the event
|
34
34
|
InstanceTerminated: false
|
35
35
|
```
|
36
36
|
|
37
|
+
## Enabling Default Events
|
38
|
+
|
39
|
+
Some templates may have events that are disabled by default, they can be enabled using a slightly different syntax to disabling.
|
40
|
+
|
41
|
+
```yaml
|
42
|
+
EventSubscriptions:
|
43
|
+
RDSInstance:
|
44
|
+
# set the replication failure event to true to enable the event
|
45
|
+
ReplicationFailure:
|
46
|
+
Enabled: true
|
47
|
+
```
|
48
|
+
|
37
49
|
## Creating Custom Events
|
38
50
|
|
39
51
|
Custom events can be created if there are not defaults for that event. They can be inherited from a default event or from the base event model.
|
@@ -44,7 +56,7 @@ This is useful if you want to create a new event and a default event already has
|
|
44
56
|
The following example inherits the `MasterPasswordReset` RDS event and creates a new event that captures the security group add to an rds instance event.
|
45
57
|
|
46
58
|
```yaml
|
47
|
-
|
59
|
+
EventSubscriptions:
|
48
60
|
RDSInstance:
|
49
61
|
# Create a new event name
|
50
62
|
DBNewSecurityGroup:
|
@@ -59,7 +71,7 @@ EventSubscription:
|
|
59
71
|
If there are no default events that match the format you require you can create an event of the base event subscription model.
|
60
72
|
|
61
73
|
```yaml
|
62
|
-
|
74
|
+
EventSubscriptions:
|
63
75
|
ECSCluster:
|
64
76
|
ContainerInstanceStateChange:
|
65
77
|
Source: aws.ecs
|
data/docs/resources.md
CHANGED
data/lib/cfnguardian/compile.rb
CHANGED
@@ -12,6 +12,7 @@ require 'cfnguardian/resources/autoscaling_group'
|
|
12
12
|
require 'cfnguardian/resources/cloudfront_distribution'
|
13
13
|
require 'cfnguardian/resources/autoscaling_group'
|
14
14
|
require 'cfnguardian/resources/domain_expiry'
|
15
|
+
require 'cfnguardian/resources/documentdb_cluster'
|
15
16
|
require 'cfnguardian/resources/dynamodb_table'
|
16
17
|
require 'cfnguardian/resources/ec2_instance'
|
17
18
|
require 'cfnguardian/resources/ecs_cluster'
|
@@ -71,6 +71,7 @@ module CfnGuardian
|
|
71
71
|
@group = 'ApiGateway'
|
72
72
|
@namespace = 'AWS/ApiGateway'
|
73
73
|
@dimensions = { ApiName: resource['Id'] }
|
74
|
+
@treat_missing_data = 'notBreaching'
|
74
75
|
end
|
75
76
|
end
|
76
77
|
|
@@ -140,6 +141,7 @@ module CfnGuardian
|
|
140
141
|
}
|
141
142
|
@statistic = 'Average'
|
142
143
|
@evaluation_periods = 5
|
144
|
+
@treat_missing_data = 'notBreaching'
|
143
145
|
end
|
144
146
|
end
|
145
147
|
|
@@ -151,6 +153,15 @@ module CfnGuardian
|
|
151
153
|
@dimensions = { AutoScalingGroupName: resource['Id'] }
|
152
154
|
end
|
153
155
|
end
|
156
|
+
|
157
|
+
class DocumentDBClusterAlarm < BaseAlarm
|
158
|
+
def initialize(resource)
|
159
|
+
super(resource)
|
160
|
+
@group = 'DocumentDBCluster'
|
161
|
+
@namespace = 'AWS/DocDB'
|
162
|
+
@dimensions = { DBClusterIdentifier: resource['Id'] }
|
163
|
+
end
|
164
|
+
end
|
154
165
|
|
155
166
|
class DomainExpiryAlarm < BaseAlarm
|
156
167
|
def initialize(resource)
|
@@ -189,6 +200,7 @@ module CfnGuardian
|
|
189
200
|
@threshold = 75
|
190
201
|
@alarm_action = 'Warning'
|
191
202
|
@evaluation_periods = 10
|
203
|
+
@treat_missing_data = 'notBreaching'
|
192
204
|
end
|
193
205
|
end
|
194
206
|
|
@@ -201,6 +213,7 @@ module CfnGuardian
|
|
201
213
|
ServiceName: resource['Id'],
|
202
214
|
ClusterName: resource['Cluster']
|
203
215
|
}
|
216
|
+
@treat_missing_data = 'breaching'
|
204
217
|
end
|
205
218
|
end
|
206
219
|
|
@@ -341,6 +354,7 @@ module CfnGuardian
|
|
341
354
|
@dimensions = { FunctionName: resource['Id'] }
|
342
355
|
@statistic = 'Average'
|
343
356
|
@evaluation_periods = 5
|
357
|
+
@treat_missing_data = 'notBreaching'
|
344
358
|
end
|
345
359
|
end
|
346
360
|
|
@@ -426,6 +440,7 @@ module CfnGuardian
|
|
426
440
|
@dimensions = { QueueName: resource['Id'] }
|
427
441
|
@statistic = 'Average'
|
428
442
|
@period = 300
|
443
|
+
@treat_missing_data = 'notBreaching'
|
429
444
|
end
|
430
445
|
end
|
431
446
|
|
@@ -438,6 +453,7 @@ module CfnGuardian
|
|
438
453
|
@threshold = 1
|
439
454
|
@period = 300
|
440
455
|
@alarm_action = 'Informational'
|
456
|
+
@treat_missing_data = 'notBreaching'
|
441
457
|
end
|
442
458
|
end
|
443
459
|
|
@@ -8,7 +8,9 @@ module CfnGuardian::Resource
|
|
8
8
|
alarm.comparison_operator = 'LessThanThreshold'
|
9
9
|
alarm.statistic = 'Minimum'
|
10
10
|
alarm.threshold = 15
|
11
|
-
alarm.
|
11
|
+
alarm.period = 300
|
12
|
+
alarm.datapoints_to_alarm = 2
|
13
|
+
alarm.evaluation_periods = 2
|
12
14
|
alarm.treat_missing_data = 'notBreaching'
|
13
15
|
@alarms.push(alarm)
|
14
16
|
|
@@ -18,7 +20,9 @@ module CfnGuardian::Resource
|
|
18
20
|
alarm.comparison_operator = 'LessThanThreshold'
|
19
21
|
alarm.statistic = 'Minimum'
|
20
22
|
alarm.threshold = 30
|
21
|
-
alarm.
|
23
|
+
alarm.period = 300
|
24
|
+
alarm.datapoints_to_alarm = 2
|
25
|
+
alarm.evaluation_periods = 2
|
22
26
|
alarm.treat_missing_data = 'notBreaching'
|
23
27
|
alarm.alarm_action = 'Warning'
|
24
28
|
@alarms.push(alarm)
|
@@ -8,7 +8,6 @@ module CfnGuardian::Resource
|
|
8
8
|
alarm.statistic = 'Sum'
|
9
9
|
alarm.threshold = 5
|
10
10
|
alarm.evaluation_periods = 2
|
11
|
-
alarm.treat_missing_data = 'notBreaching'
|
12
11
|
@alarms.push(alarm)
|
13
12
|
|
14
13
|
alarm = CfnGuardian::Models::ApiGatewayAlarm.new(@resource)
|
@@ -17,7 +16,6 @@ module CfnGuardian::Resource
|
|
17
16
|
alarm.statistic = 'Sum'
|
18
17
|
alarm.threshold = 5
|
19
18
|
alarm.evaluation_periods = 2
|
20
|
-
alarm.treat_missing_data = 'notBreaching'
|
21
19
|
@alarms.push(alarm)
|
22
20
|
|
23
21
|
alarm = CfnGuardian::Models::ApiGatewayAlarm.new(@resource)
|
@@ -26,7 +24,6 @@ module CfnGuardian::Resource
|
|
26
24
|
alarm.statistic = 'Average'
|
27
25
|
alarm.threshold = 1000
|
28
26
|
alarm.evaluation_periods = 2
|
29
|
-
alarm.treat_missing_data = 'notBreaching'
|
30
27
|
@alarms.push(alarm)
|
31
28
|
end
|
32
29
|
|
@@ -0,0 +1,40 @@
|
|
1
|
+
module CfnGuardian::Resource
|
2
|
+
class DocumentDBCluster < Base
|
3
|
+
|
4
|
+
def default_alarms
|
5
|
+
alarm = CfnGuardian::Models::DocumentDBClusterAlarm.new(@resource)
|
6
|
+
alarm.name = 'CPUUtilizationHighBase'
|
7
|
+
alarm.metric_name = 'CPUUtilization'
|
8
|
+
alarm.threshold = 75
|
9
|
+
alarm.evaluation_periods = 60
|
10
|
+
alarm.alarm_action = 'Warning'
|
11
|
+
@alarms.push(alarm)
|
12
|
+
|
13
|
+
alarm = CfnGuardian::Models::DocumentDBClusterAlarm.new(@resource)
|
14
|
+
alarm.name = 'CPUUtilizationHighSpike'
|
15
|
+
alarm.metric_name = 'CPUUtilization'
|
16
|
+
alarm.threshold = 95
|
17
|
+
alarm.evaluation_periods = 10
|
18
|
+
@alarms.push(alarm)
|
19
|
+
|
20
|
+
alarm = CfnGuardian::Models::DocumentDBClusterAlarm.new(@resource)
|
21
|
+
alarm.name = 'DatabaseConnections'
|
22
|
+
alarm.metric_name = 'DatabaseConnections'
|
23
|
+
alarm.statistic = 'Minimum'
|
24
|
+
alarm.threshold = 50
|
25
|
+
alarm.evaluation_periods = 10
|
26
|
+
@alarms.push(alarm)
|
27
|
+
|
28
|
+
alarm = CfnGuardian::Models::DocumentDBClusterAlarm.new(@resource)
|
29
|
+
alarm.name = 'FreeableMemory'
|
30
|
+
alarm.metric_name = 'FreeableMemory'
|
31
|
+
alarm.threshold = 1000000000
|
32
|
+
alarm.evaluation_periods = 3
|
33
|
+
alarm.comparison_operator = 'LessThanThreshold'
|
34
|
+
@alarms.push(alarm)
|
35
|
+
end
|
36
|
+
|
37
|
+
end
|
38
|
+
end
|
39
|
+
|
40
|
+
|
@@ -10,7 +10,6 @@ module CfnGuardian
|
|
10
10
|
alarm.statistic = 'SampleCount'
|
11
11
|
alarm.threshold = 0
|
12
12
|
alarm.evaluation_periods = 10
|
13
|
-
alarm.treat_missing_data = 'breaching'
|
14
13
|
alarm.datapoints_to_alarm = 8
|
15
14
|
@alarms.push(alarm)
|
16
15
|
|
@@ -21,12 +20,66 @@ module CfnGuardian
|
|
21
20
|
alarm.statistic = 'SampleCount'
|
22
21
|
alarm.threshold = 1
|
23
22
|
alarm.evaluation_periods = 10
|
24
|
-
alarm.treat_missing_data = 'breaching'
|
25
23
|
alarm.datapoints_to_alarm = 8
|
26
24
|
alarm.alarm_action = 'Warning'
|
27
25
|
@alarms.push(alarm)
|
26
|
+
|
27
|
+
alarm = CfnGuardian::Models::ECSServiceAlarm.new(@resource)
|
28
|
+
alarm.name = 'MemoryUtilizationCritical'
|
29
|
+
alarm.metric_name = 'MemoryUtilization'
|
30
|
+
alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
|
31
|
+
alarm.statistic = 'Average'
|
32
|
+
alarm.threshold = 90
|
33
|
+
alarm.evaluation_periods = 5
|
34
|
+
alarm.treat_missing_data = 'breaching'
|
35
|
+
alarm.alarm_action = 'Critical'
|
36
|
+
alarm.datapoints_to_alarm = 4
|
37
|
+
alarm.treat_missing_data = 'notBreaching'
|
38
|
+
alarm.enabled = false
|
39
|
+
@alarms.push(alarm)
|
40
|
+
|
41
|
+
alarm = CfnGuardian::Models::ECSServiceAlarm.new(@resource)
|
42
|
+
alarm.name = 'MemoryUtilizationWarning'
|
43
|
+
alarm.metric_name = 'MemoryUtilization'
|
44
|
+
alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
|
45
|
+
alarm.statistic = 'Average'
|
46
|
+
alarm.threshold = 80
|
47
|
+
alarm.evaluation_periods = 5
|
48
|
+
alarm.treat_missing_data = 'breaching'
|
49
|
+
alarm.datapoints_to_alarm = 4
|
50
|
+
alarm.treat_missing_data = 'notBreaching'
|
51
|
+
alarm.alarm_action = 'Warning'
|
52
|
+
alarm.enabled = false
|
53
|
+
@alarms.push(alarm)
|
54
|
+
|
55
|
+
alarm = CfnGuardian::Models::ECSServiceAlarm.new(@resource)
|
56
|
+
alarm.name = 'CPUUtilizationCritical'
|
57
|
+
alarm.metric_name = 'CPUUtilization'
|
58
|
+
alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
|
59
|
+
alarm.statistic = 'Average'
|
60
|
+
alarm.threshold = 90
|
61
|
+
alarm.evaluation_periods = 5
|
62
|
+
alarm.treat_missing_data = 'breaching'
|
63
|
+
alarm.alarm_action = 'Critical'
|
64
|
+
alarm.datapoints_to_alarm = 4
|
65
|
+
alarm.treat_missing_data = 'notBreaching'
|
66
|
+
alarm.enabled = false
|
67
|
+
@alarms.push(alarm)
|
68
|
+
|
69
|
+
alarm = CfnGuardian::Models::ECSServiceAlarm.new(@resource)
|
70
|
+
alarm.name = 'CPUUtilizationWarning'
|
71
|
+
alarm.metric_name = 'CPUUtilization'
|
72
|
+
alarm.comparison_operator = 'GreaterThanOrEqualToThreshold'
|
73
|
+
alarm.statistic = 'Average'
|
74
|
+
alarm.threshold = 80
|
75
|
+
alarm.evaluation_periods = 5
|
76
|
+
alarm.treat_missing_data = 'breaching'
|
77
|
+
alarm.datapoints_to_alarm = 4
|
78
|
+
alarm.treat_missing_data = 'notBreaching'
|
79
|
+
alarm.alarm_action = 'Warning'
|
80
|
+
alarm.enabled = false
|
81
|
+
@alarms.push(alarm)
|
28
82
|
end
|
29
|
-
|
30
83
|
end
|
31
84
|
end
|
32
85
|
end
|
@@ -36,6 +36,7 @@ module CfnGuardian::Resource
|
|
36
36
|
alarm.name = 'ExpiresInDaysCritical'
|
37
37
|
alarm.metric_name = 'ExpiresInDays'
|
38
38
|
alarm.threshold = 5
|
39
|
+
alarm.treat_missing_data = 'notBreaching'
|
39
40
|
@alarms.push(alarm)
|
40
41
|
|
41
42
|
alarm = CfnGuardian::Models::SslAlarm.new(@resource)
|
@@ -43,6 +44,7 @@ module CfnGuardian::Resource
|
|
43
44
|
alarm.metric_name = 'ExpiresInDays'
|
44
45
|
alarm.alarm_action = 'Task'
|
45
46
|
alarm.threshold = 30
|
47
|
+
alarm.treat_missing_data = 'notBreaching'
|
46
48
|
@alarms.push(alarm)
|
47
49
|
end
|
48
50
|
end
|
@@ -6,28 +6,24 @@ module CfnGuardian::Resource
|
|
6
6
|
alarm.name = 'LambdaErrors'
|
7
7
|
alarm.metric_name = 'Errors'
|
8
8
|
alarm.threshold = 0.5
|
9
|
-
alarm.treat_missing_data = 'notBreaching'
|
10
9
|
@alarms.push(alarm)
|
11
10
|
|
12
11
|
alarm = CfnGuardian::Models::LambdaAlarm.new(@resource)
|
13
12
|
alarm.name = 'Throttles'
|
14
13
|
alarm.metric_name = 'Throttles'
|
15
14
|
alarm.threshold = 0.5
|
16
|
-
alarm.treat_missing_data = 'notBreaching'
|
17
15
|
@alarms.push(alarm)
|
18
16
|
|
19
17
|
alarm = CfnGuardian::Models::LambdaAlarm.new(@resource)
|
20
18
|
alarm.name = 'DeadLetterErrors'
|
21
19
|
alarm.metric_name = 'DeadLetterErrors'
|
22
20
|
alarm.threshold = 0.5
|
23
|
-
alarm.treat_missing_data = 'notBreaching'
|
24
21
|
@alarms.push(alarm)
|
25
22
|
|
26
23
|
alarm = CfnGuardian::Models::LambdaAlarm.new(@resource)
|
27
24
|
alarm.name = 'IteratorAge'
|
28
25
|
alarm.metric_name = 'IteratorAge'
|
29
26
|
alarm.threshold = 600000
|
30
|
-
alarm.treat_missing_data = 'notBreaching'
|
31
27
|
@alarms.push(alarm)
|
32
28
|
|
33
29
|
alarm = CfnGuardian::Models::LambdaAlarm.new(@resource)
|
@@ -35,7 +31,6 @@ module CfnGuardian::Resource
|
|
35
31
|
alarm.metric_name = 'Duration'
|
36
32
|
alarm.statistic = 'Average'
|
37
33
|
alarm.threshold = 30
|
38
|
-
alarm.treat_missing_data = 'notBreaching'
|
39
34
|
@alarms.push(alarm)
|
40
35
|
end
|
41
36
|
|
@@ -7,7 +7,6 @@ module CfnGuardian::Resource
|
|
7
7
|
alarm.metric_name = 'ApproximateAgeOfOldestMessage'
|
8
8
|
alarm.threshold = 0.5
|
9
9
|
alarm.evaluation_periods = 5
|
10
|
-
alarm.treat_missing_data = 'notBreaching'
|
11
10
|
@alarms.push(alarm)
|
12
11
|
|
13
12
|
alarm = CfnGuardian::Models::SQSQueueAlarm.new(@resource)
|
@@ -15,7 +14,6 @@ module CfnGuardian::Resource
|
|
15
14
|
alarm.metric_name = 'ApproximateNumberOfMessagesVisible'
|
16
15
|
alarm.threshold = 0.5
|
17
16
|
alarm.evaluation_periods = 5
|
18
|
-
alarm.treat_missing_data = 'notBreaching'
|
19
17
|
@alarms.push(alarm)
|
20
18
|
end
|
21
19
|
|
data/lib/cfnguardian/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: cfn-guardian
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.7.
|
4
|
+
version: 0.7.11
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Guslington
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2022-01-28 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: thor
|
@@ -280,6 +280,7 @@ files:
|
|
280
280
|
- lib/cfnguardian/resources/base.rb
|
281
281
|
- lib/cfnguardian/resources/batch.rb
|
282
282
|
- lib/cfnguardian/resources/cloudfront_distribution.rb
|
283
|
+
- lib/cfnguardian/resources/documentdb_cluster.rb
|
283
284
|
- lib/cfnguardian/resources/domain_expiry.rb
|
284
285
|
- lib/cfnguardian/resources/dynamodb_table.rb
|
285
286
|
- lib/cfnguardian/resources/ec2_instance.rb
|