hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/fargate/extras.rb

@@ -1,5 +1,7 @@
 require_relative "check"
 require_relative "yaml"
+require_relative "extras/reading"
+require_relative "extras/rendering"
 
 module Hecks
   module Projections
@@ -8,8 +10,6 @@ module Hecks
         # The extra resources, parameters, outputs and IAM grants a stack can declare beyond
         # what the generator always makes; settings are documented in the DSL reference.
         module Extras
-          module_function
-
           BUCKET_KEYS = [:id, :name_prefix, :public_read, :cors_origins].freeze
           SECRET_KEYS = [:id, :name, :description, :key, :length].freeze
           POLICY_KEYS = [:name, :statements].freeze
@@ -19,6 +19,11 @@ module Hecks
           EXEC_ACTIONS = %w[ssmmessages:CreateControlChannel ssmmessages:CreateDataChannel
                             ssmmessages:OpenControlChannel ssmmessages:OpenDataChannel].freeze
 
+          extend Reading
+          extend Rendering
+
+          module_function
+
           # Reads and checks the resource-declaring settings.
           def normalize(settings)
             {
@@ -34,9 +39,8 @@ module Hecks
 
           # Renders the buckets and generated secrets.
           def resources_yaml(extras)
-            (extras[:buckets].flat_map { |bucket| bucket_blocks(bucket) } + extras[:secrets].map do |secret|
-              secret_yaml(secret)
-            end).join("\n\n")
+            blocks = extras[:buckets].flat_map { |bucket| bucket_blocks(bucket) }
+            blocks.concat(extras[:secrets].map { |secret| secret_yaml(secret) }).join("\n\n")
           end
 
           # Renders extra policies as entries of a role's `Policies` list.
@@ -67,159 +71,6 @@ module Hecks
           def outputs_yaml(outputs)
             outputs.map { |name, value| "#{name}:\n  Value: #{Yaml.string(value)}\n" }.join
           end
-
-          def buckets(entries)
-            Check.hashes!(entries, "buckets", allowed: BUCKET_KEYS, required: [:id, :name_prefix]).map do |entry|
-              {
-                id:           Check.logical_id!(entry[:id], "buckets id"),
-                name_prefix:  Check.resource_name!(entry[:name_prefix], "buckets name_prefix").downcase,
-                public_read:  Check.boolean!(entry.fetch(:public_read, false), "buckets public_read"),
-                cors_origins: Check.strings!(entry.fetch(:cors_origins, []), "buckets cors_origins")
-              }
-            end
-          end
-          private_class_method :buckets
-
-          def secrets(entries)
-            Check.hashes!(entries, "generated_secrets", allowed: SECRET_KEYS, required: [:id, :name]).map do |entry|
-              {
-                id:          Check.logical_id!(entry[:id], "generated_secrets id"),
-                name:        Check.resource_name!(entry[:name], "generated_secrets name"),
-                description: entry[:description]&.to_s,
-                key:         Check.resource_name!(entry.fetch(:key, "secret"), "generated_secrets key"),
-                length:      Check.integer!(entry.fetch(:length, 64), "generated_secrets length", range: 8..512)
-              }
-            end
-          end
-          private_class_method :secrets
-
-          def session_secret(value)
-            return {} if value.nil?
-
-            given = Check.hash!(value, "session_secret", allowed: [:name, :description])
-            { name:        given[:name] && Check.resource_name!(given[:name], "session_secret name"),
-              description: given[:description]&.to_s }.compact
-          end
-          private_class_method :session_secret
-
-          def policies(entries, where)
-            Check.hashes!(entries, where, allowed: POLICY_KEYS, required: [:name, :statements]).map do |entry|
-              statements = Check.hashes!(entry[:statements], "#{where}[#{entry[:name]}] statements",
-                                         allowed: STATEMENT_KEYS, required: [:actions, :resources])
-              {
-                name:       Check.logical_id!(entry[:name], "#{where} name"),
-                statements: statements.map do |statement|
-                  {
-                    effect:    Check.one_of!(statement.fetch(:effect, "Allow"), "#{where} effect", %w[Allow Deny]),
-                    actions:   Check.strings!(statement[:actions], "#{where} actions", min: 1),
-                    resources: Check.strings!(statement[:resources], "#{where} resources", min: 1)
-                  }
-                end
-              }
-            end
-          end
-          private_class_method :policies
-
-          def parameters(map)
-            raise ArgumentError, "parameters must be a hash of name to settings, got #{map.inspect}" unless map.is_a?(Hash)
-
-            map.to_h do |name, entry|
-              key = Check.logical_id!(name, "parameters name")
-              given = Check.hash!(entry, "parameters.#{key}", allowed: PARAMETER_KEYS, required: [:type])
-              unless PARAMETER_TYPE.match?(given[:type].to_s)
-                raise ArgumentError,
-                      "parameters.#{key} type #{given[:type].inspect} is not a CloudFormation parameter type"
-              end
-
-              [key, given.merge(type: given[:type].to_s, no_echo: given[:no_echo] ? true : false)]
-            end
-          end
-          private_class_method :parameters
-
-          def outputs(map)
-            raise ArgumentError, "outputs must be a hash of name to value, got #{map.inspect}" unless map.is_a?(Hash)
-
-            map.to_h do |name, value|
-              raise ArgumentError, "outputs.#{name} needs a value" if value.nil?
-
-              [Check.logical_id!(name, "outputs name"), value]
-            end
-          end
-          private_class_method :outputs
-
-          def bucket_blocks(bucket)
-            blocks = [bucket_yaml(bucket)]
-            blocks << bucket_policy_yaml(bucket) if bucket[:public_read]
-            blocks
-          end
-          private_class_method :bucket_blocks
-
-          def bucket_yaml(bucket)
-            lines = ["#{bucket[:id]}:", "  Type: AWS::S3::Bucket", "  Properties:",
-                     "    BucketName: !Sub \"#{bucket[:name_prefix]}-${AWS::AccountId}\""]
-            lines.concat(public_access_lines) if bucket[:public_read]
-            lines.concat(cors_lines(bucket[:cors_origins])) unless bucket[:cors_origins].empty?
-            lines.join("\n")
-          end
-          private_class_method :bucket_yaml
-
-          def public_access_lines
-            ["    PublicAccessBlockConfiguration:", "      BlockPublicAcls: false", "      BlockPublicPolicy: false",
-             "      IgnorePublicAcls: false", "      RestrictPublicBuckets: false"]
-          end
-          private_class_method :public_access_lines
-
-          def cors_lines(origins)
-            ["    CorsConfiguration:", "      CorsRules:", "        - AllowedOrigins: #{Yaml.flow_list(origins)}",
-             "          AllowedMethods: [GET]", "          AllowedHeaders: [\"*\"]"]
-          end
-          private_class_method :cors_lines
-
-          def bucket_policy_yaml(bucket)
-            <<~POLICY.rstrip
-              #{bucket[:id]}Policy:
-                Type: AWS::S3::BucketPolicy
-                Properties:
-                  Bucket: !Ref #{bucket[:id]}
-                  PolicyDocument:
-                    Version: "2012-10-17"
-                    Statement:
-                      - Effect: Allow
-                        Principal: "*"
-                        Action: s3:GetObject
-                        Resource: !Sub "${#{bucket[:id]}.Arn}/*"
-            POLICY
-          end
-          private_class_method :bucket_policy_yaml
-
-          def secret_yaml(secret)
-            lines = ["#{secret[:id]}:", "  Type: AWS::SecretsManager::Secret", "  Properties:", "    Name: #{secret[:name]}"]
-            lines << "    Description: #{Yaml.string(secret[:description])}" if secret[:description]
-            lines.push("    GenerateSecretString:", "      SecretStringTemplate: '{}'",
-                       "      GenerateStringKey: #{secret[:key]}", "      PasswordLength: #{secret[:length]}",
-                       "      ExcludePunctuation: true")
-            lines.join("\n")
-          end
-          private_class_method :secret_yaml
-
-          def policy_yaml(policy)
-            lines = ["- PolicyName: #{policy[:name]}", "  PolicyDocument:", "    Version: '2012-10-17'", "    Statement:"]
-            policy[:statements].each do |statement|
-              lines << "      - Effect: #{statement[:effect]}"
-              lines.concat(statement_list("Action", statement[:actions]))
-              lines.concat(statement_list("Resource", statement[:resources].map { |resource| Yaml.string(resource) }))
-            end
-            "#{lines.join("\n")}\n"
-          end
-          private_class_method :policy_yaml
-
-          # One entry is written as a scalar, the form IAM policies usually take; more are a list.
-          def statement_list(key, values)
-            return ["        #{key}: #{values.first}"] if values.one?
-
-            ["        #{key}:"] + values.map { |value| "          - #{value}" }
-          end
-          private_class_method :statement_list
         end
       end
     end

data/lib/hecks/projections/deploy/fargate/monitoring/alarms.rb

@@ -0,0 +1,115 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Monitoring
+          # The CloudWatch alarms of a stack. Extended onto `Monitoring`, which supplies the default
+          # descriptions.
+          module Alarms
+            private
+
+            def alarm_blocks(alarm, context)
+              case alarm[:kind]
+              when "alb_5xx" then [alb_alarm_yaml(alarm, context)]
+              when "target_unhealthy" then [unhealthy_alarm_yaml(alarm, context)]
+              else [cloudfront_alarm_yaml(alarm, context)]
+              end
+            end
+
+            def alarm_description(given, default)
+              "    AlarmDescription: #{Yaml.string(given || default)}"
+            end
+
+            def alarm_settings(alarm, ids, missing: "notBreaching", period: true)
+              lines = []
+              lines << "Period: #{alarm[:period]}" if period
+              lines << "EvaluationPeriods: #{alarm[:evaluation_periods]}"
+              lines << "DatapointsToAlarm: #{alarm[:datapoints_to_alarm]}" if alarm[:datapoints_to_alarm]
+              lines.push("Threshold: #{alarm[:threshold]}", "ComparisonOperator: GreaterThanOrEqualToThreshold",
+                         "TreatMissingData: #{missing}", "AlarmActions: [!Ref #{ids[:alerts_topic]}]",
+                         "OKActions: [!Ref #{ids[:alerts_topic]}]")
+            end
+
+            def with_settings(lines, alarm, ids, **options)
+              (lines + alarm_settings(alarm, ids, **options).map { |line| "    #{line}" }).join("\n")
+            end
+
+            def alb_alarm_yaml(alarm, context)
+              ids = context[:ids]
+              lines = [
+                "#{ids[:alb_5xx_alarm]}:", "  Type: AWS::CloudWatch::Alarm", "  Properties:",
+                "    AlarmName: #{context[:stack_name]}-alb-5xx",
+                alarm_description(alarm[:description], DESCRIPTIONS[:alb_5xx]),
+                "    Namespace: AWS/ApplicationELB", "    MetricName: HTTPCode_Target_5XX_Count",
+                *load_balancer_dimension(context), "    Statistic: Sum"
+              ]
+              with_settings(lines, alarm, ids)
+            end
+
+            def load_balancer_dimension(context)
+              ["    Dimensions:", "      - Name: LoadBalancer", "        Value: !GetAtt #{context[:alb_id]}.LoadBalancerFullName"]
+            end
+
+            def unhealthy_alarm_yaml(alarm, context)
+              container = alarm[:container]
+              group = context[:target_groups].fetch(container)
+              lines = unhealthy_head(alarm, context, container) + unhealthy_dimensions(context, group)
+              with_settings(lines, alarm, context[:ids])
+            end
+
+            def unhealthy_head(alarm, context, container)
+              [
+                "#{Yaml.camel(container)}TargetUnhealthyAlarm:", "  Type: AWS::CloudWatch::Alarm", "  Properties:",
+                "    AlarmName: #{context[:stack_name]}-#{container}-unhealthy",
+                alarm_description(alarm[:description], format(DESCRIPTIONS[:target_unhealthy], container: container))
+              ]
+            end
+
+            def unhealthy_dimensions(context, group)
+              [
+                "    Namespace: AWS/ApplicationELB", "    MetricName: UnHealthyHostCount",
+                "    Dimensions:", "      - Name: LoadBalancer",
+                "        Value: !GetAtt #{context[:alb_id]}.LoadBalancerFullName",
+                "      - Name: TargetGroup", "        Value: !GetAtt #{group}.TargetGroupFullName",
+                "    Statistic: Maximum"
+              ]
+            end
+
+            def cloudfront_alarm_yaml(alarm, context)
+              ids = context[:ids]
+              lines = [
+                "#{ids[:cloudfront_5xx_alarm]}:", "  Type: AWS::CloudWatch::Alarm", "  DependsOn: #{ids[:cloudfront_monitoring]}",
+                "  Properties:", "    AlarmName: #{context[:stack_name]}-cloudfront-5xx",
+                alarm_description(alarm[:description], DESCRIPTIONS[:cloudfront_5xx]),
+                "    Metrics:",
+                *edge_metric_lines(context[:distribution_id])
+              ]
+              with_settings(lines, alarm, ids, period: false)
+            end
+
+            # A count rather than the raw percentage: at low traffic one failed request reads as a
+            # large rate, so the count is the rate applied to that minute's requests.
+            def edge_metric_lines(distribution)
+              [
+                "      - Id: errors", "        Label: CloudFront 5xx responses", "        Expression: rate * requests / 100",
+                "        ReturnData: true",
+                *metric_stat_lines("rate", "Average", "5xxErrorRate", distribution),
+                *metric_stat_lines("requests", "Sum", "Requests", distribution)
+              ]
+            end
+
+            def metric_stat_lines(id, stat, metric, distribution)
+              [
+                "      - Id: #{id}", "        ReturnData: false", "        MetricStat:", "          Stat: #{stat}",
+                "          Period: 60", "          Metric:", "            Namespace: AWS/CloudFront",
+                "            MetricName: #{metric}",
+                "            Dimensions:", "              - Name: DistributionId", "                Value: !Ref #{distribution}",
+                "              - Name: Region", "                Value: Global"
+              ]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/monitoring/reading.rb

@@ -0,0 +1,84 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Monitoring
+          # Reads and checks the `alerts` setting of a world. Extended onto `Monitoring`, which
+          # supplies the key lists and defaults.
+          module Reading
+            private
+
+            def alarms(entries, containers)
+              raise ArgumentError, "alerts alarms must be a list, got #{entries.inspect}" unless entries.is_a?(Array)
+
+              entries.flat_map do |entry|
+                given = alarm_entry(entry)
+                kind = Check.one_of!(given[:kind], "alerts alarms kind", KINDS)
+                kind == "target_unhealthy" ? unhealthy_alarms(given, containers) : [alarm(kind, given, nil)]
+              end
+            end
+
+            def alarm_entry(entry)
+              return { kind: entry } unless entry.is_a?(Hash)
+
+              Check.hash!(entry, "alerts alarms", allowed: ALARM_KEYS, required: [:kind])
+            end
+
+            def unhealthy_alarms(given, containers)
+              named = given[:container]&.to_s
+              if named && !containers.include?(named)
+                raise ArgumentError,
+                      "alerts alarms container #{named.inspect} has no target group; have #{containers.join(", ")}"
+              end
+
+              (named ? [named] : containers).map { |container| alarm("target_unhealthy", given, container) }
+            end
+
+            def alarm(kind, given, container)
+              values = DEFAULTS.fetch(kind).merge(given.slice(:threshold, :period, :evaluation_periods, :datapoints_to_alarm))
+              values.each { |key, value| Check.integer!(value, "alerts alarms #{key}", range: 1..86_400) }
+              values.merge(kind: kind, container: container,
+                           description: description!(given[:description], "alerts alarms description"))
+            end
+
+            def warmer(value)
+              return nil if value.nil?
+
+              given = Check.hash!(value, "alerts warmer", allowed: WARMER_KEYS, required: [:paths])
+              paths = warmer_paths(given)
+              rate = warmer_rate(given)
+              { paths: paths, namespace: given[:namespace]&.to_s, rate: rate, code: given[:code]&.to_s,
+                schedule_description: description!(given[:schedule_description], "alerts warmer schedule_description"),
+                alarm_description: description!(given[:alarm_description], "alerts warmer alarm_description") }
+            end
+
+            def warmer_paths(given)
+              paths = Check.strings!(given[:paths], "alerts warmer paths", min: 1)
+              bad = paths.reject { |path| path.start_with?("/") }
+              return paths if bad.empty?
+
+              raise ArgumentError, "alerts warmer paths must start with /, got #{bad.join(", ")}"
+            end
+
+            def warmer_rate(given)
+              rate = given.fetch(:rate, "rate(1 minute)").to_s
+              return rate if rate.match?(/\A(rate|cron)\(.+\)\z/)
+
+              raise ArgumentError,
+                    "alerts warmer rate must be a schedule expression such as rate(1 minute), got #{rate.inspect}"
+            end
+
+            def description!(value, where)
+              return nil if value.nil?
+
+              text = value.to_s
+              return text if (1..1023).cover?(text.length)
+
+              raise ArgumentError, "#{where} must be 1 to 1023 characters, got #{value.inspect}"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/monitoring/topic.rb

@@ -0,0 +1,59 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Monitoring
+          # The alerts topic, its email subscription and the CloudFront metrics subscription.
+          # Extended onto `Monitoring`.
+          module Topic
+            private
+
+            def topic_blocks(alerts, context)
+              ids = context[:ids]
+              blocks = [topic_text(alerts, ids).rstrip]
+              blocks << subscription_text(alerts, ids).rstrip if alerts[:email]
+              return blocks unless cloudfront_metrics?(alerts)
+
+              blocks << monitoring_subscription_text(ids, context[:distribution_id]).rstrip
+            end
+
+            def topic_text(alerts, ids)
+              <<~TOPIC
+                #{ids[:alerts_topic]}:
+                  Type: AWS::SNS::Topic
+                  Properties:
+                    TopicName: #{alerts[:topic]}
+              TOPIC
+            end
+
+            def subscription_text(alerts, ids)
+              <<~SUBSCRIPTION
+                # SNS holds an email subscription as pending until the recipient follows the
+                # confirmation link SNS mails on stack creation; no alert is delivered before then.
+                #{ids[:alerts_subscription]}:
+                  Type: AWS::SNS::Subscription
+                  Properties:
+                    TopicArn: !Ref #{ids[:alerts_topic]}
+                    Protocol: email
+                    Endpoint: #{alerts[:email]}
+              SUBSCRIPTION
+            end
+
+            def monitoring_subscription_text(ids, distribution_id)
+              <<~MONITORING
+                # CloudFront publishes per-minute metrics only for a distribution that opts in.
+                #{ids[:cloudfront_monitoring]}:
+                  Type: AWS::CloudFront::MonitoringSubscription
+                  Properties:
+                    DistributionId: !Ref #{distribution_id}
+                    MonitoringSubscription:
+                      RealtimeMetricsSubscriptionConfig:
+                        RealtimeMetricsSubscriptionStatus: Enabled
+              MONITORING
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/monitoring/warmer.rb

@@ -0,0 +1,90 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Monitoring
+          # The synthetic check: a Lambda function that requests real paths through the CDN, its
+          # schedule and the alarm on what it reports. Extended onto `Monitoring`.
+          module Warmer
+            private
+
+            def warmer_blocks(alerts, context)
+              namespace = alerts[:warmer][:namespace] || "#{context[:stack_name]}/Synthetic"
+              warmer = alerts[:warmer]
+              ids = context[:ids]
+              [warmer_role_text(ids).rstrip, warmer_function_yaml(warmer, namespace, context),
+               synthetic_alarm_yaml(warmer, namespace, context), scheduler_role_text(ids).rstrip,
+               schedule_text(warmer, ids).rstrip]
+            end
+
+            def warmer_function_yaml(warmer, namespace, context)
+              code = Yaml.indent(warmer[:code] || warmer_code(warmer, namespace), "        ")
+              "#{function_head(context).rstrip}\n#{code}".rstrip
+            end
+
+            def function_head(context)
+              <<~FUNCTION
+                # Requests each real path through the CDN and reports how many failed. It always reports a
+                # data point, even zero, so the alarm below treats silence as a finding.
+                #{context[:ids][:warmer_function]}:
+                  Type: AWS::Lambda::Function
+                  Properties:
+                    FunctionName: #{context[:stack_name]}-warmer
+                    Runtime: nodejs22.x
+                    Architectures: [arm64]
+                    Handler: index.handler
+                    MemorySize: 128
+                    Timeout: 20
+                    Role: !GetAtt #{context[:ids][:warmer_role]}.Arn
+                    Environment:
+                      Variables:
+                        CLOUDFRONT_DOMAIN: !GetAtt #{context[:distribution_id]}.DomainName
+                    Code:
+                      ZipFile: |
+              FUNCTION
+            end
+
+            def warmer_code(warmer, namespace)
+              <<~CODE
+                const { CloudWatchClient, PutMetricDataCommand } = require("@aws-sdk/client-cloudwatch");
+                const cw = new CloudWatchClient({});
+                const PATHS = #{warmer[:paths].to_json};
+                exports.handler = async () => {
+                  const host = process.env.CLOUDFRONT_DOMAIN;
+                  let failures = 0;
+                  const results = await Promise.all(PATHS.map(async (path) => {
+                    try {
+                      const res = await fetch(`https://${host}${path}`);
+                      if (res.status !== 200) failures++;
+                      return `${path}: ${res.status} (x-cache: ${res.headers.get("x-cache")})`;
+                    } catch (err) {
+                      failures++;
+                      return `${path}: FAILED ${err}`;
+                    }
+                  }));
+                  console.log(results.join("\\n"));
+                  await cw.send(new PutMetricDataCommand({
+                    Namespace: #{namespace.to_json},
+                    MetricData: [{ MetricName: "SyntheticCheckFailures", Value: failures, Unit: "Count" }],
+                  }));
+                };
+              CODE
+            end
+
+            def synthetic_alarm_yaml(warmer, namespace, context)
+              ids = context[:ids]
+              alarm = { period: 60, evaluation_periods: 1, threshold: 1 }
+              lines = [
+                "#{ids[:synthetic_alarm]}:", "  Type: AWS::CloudWatch::Alarm", "  Properties:",
+                "    AlarmName: #{context[:stack_name]}-synthetic-check",
+                alarm_description(warmer[:alarm_description], DESCRIPTIONS[:synthetic]),
+                "    Namespace: #{namespace}", "    MetricName: SyntheticCheckFailures", "    Statistic: Maximum"
+              ]
+              with_settings(lines, alarm, ids, missing: "breaching")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/monitoring/warmer_roles.rb

@@ -0,0 +1,76 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Monitoring
+          # The IAM roles and the schedule of the synthetic check. Extended onto `Monitoring`.
+          module WarmerRoles
+            private
+
+            def warmer_role_text(ids)
+              <<~ROLE
+                #{ids[:warmer_role]}:
+                  Type: AWS::IAM::Role
+                  Properties:
+                    AssumeRolePolicyDocument:
+                      Version: '2012-10-17'
+                      Statement:
+                        - Effect: Allow
+                          Principal: { Service: lambda.amazonaws.com }
+                          Action: sts:AssumeRole
+                    ManagedPolicyArns:
+                      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+                    Policies:
+                      - PolicyName: PutMetric
+                        PolicyDocument:
+                          Version: '2012-10-17'
+                          Statement:
+                            # PutMetricData accepts no resource-level permission, so "*" is the only form.
+                            - Effect: Allow
+                              Action: cloudwatch:PutMetricData
+                              Resource: "*"
+              ROLE
+            end
+
+            def scheduler_role_text(ids)
+              <<~ROLE
+                #{ids[:scheduler_role]}:
+                  Type: AWS::IAM::Role
+                  Properties:
+                    AssumeRolePolicyDocument:
+                      Version: '2012-10-17'
+                      Statement:
+                        - Effect: Allow
+                          Principal: { Service: scheduler.amazonaws.com }
+                          Action: sts:AssumeRole
+                    Policies:
+                      - PolicyName: InvokeWarmer
+                        PolicyDocument:
+                          Version: '2012-10-17'
+                          Statement:
+                            - Effect: Allow
+                              Action: lambda:InvokeFunction
+                              Resource: !GetAtt #{ids[:warmer_function]}.Arn
+              ROLE
+            end
+
+            def schedule_text(warmer, ids)
+              <<~SCHEDULE
+                #{ids[:warmer_schedule]}:
+                  Type: AWS::Scheduler::Schedule
+                  Properties:
+                    Name: !Sub "${AWS::StackName}-warmer"
+                    Description: #{Yaml.string(warmer[:schedule_description] || "Runs the synthetic check against the CDN.")}
+                    ScheduleExpression: #{warmer[:rate].to_json}
+                    FlexibleTimeWindow: { Mode: "OFF" }
+                    Target:
+                      Arn: !GetAtt #{ids[:warmer_function]}.Arn
+                      RoleArn: !GetAtt #{ids[:scheduler_role]}.Arn
+              SCHEDULE
+            end
+          end
+        end
+      end
+    end
+  end
+end