sensu-plugins-aws 3.1.0 → 3.2.0

checksums.yaml

@@ -1,15 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    NWI2YzJmMzQ4ZWVkZTI4YjI0N2EzMTA5YWMwZjU4ODcxNTFkMTAyMA==
-  data.tar.gz: !binary |-
-    ZjY3ZTk3ODIzODhhNzUwODI1ZmUzM2YzYWUxNDUzMzJlMDUzNWYyNQ==
+SHA1:
+  metadata.gz: 65a658312741eaa7884c4c1c12cad191fa918902
+  data.tar.gz: 79db3d111315f8eeb145ddfefb975851f0c6e3b7
 SHA512:
-  metadata.gz: !binary |-
-    NDQyYzk2ZDQ3OGQwOWVmY2Q3Njk3M2FlNzgxYTQzNjBjZjIzYTc5YjI0MTMz
-    YWI5NjM0MmZiODU5YTI0NTBlMDA5NWM0Y2I0NzQ1N2FkNzMzZTUzNDgyMDVk
-    MGU2MzJkOGUzMThmODZmYjNlZTg2OTA2M2U3N2EwODQzMjg3MTk=
-  data.tar.gz: !binary |-
-    ZDk3YmU4ZmM4OWEyOTRjMmVmNTI1MTc3Mzc4YTAwYTgzMzU4NzM4Y2VmZTQy
-    ZTc3YjNiYjQ3N2JmNGNjMDM4OTNmZmI4ODZlNWUxMzQ1ZWFiMzg4ODM4OTIy
-    MmJiYTg5MTU3MTZlNzA0ODhmNTFjNmE4NzIwMDlhYzlhYmE1MGY=
+  metadata.gz: 72da4039f685bf1ec8f5a95f8fccd88c827a0a0e225089224627334bbf0646cd2c290aee3b3ed5947dac99ecc76aac1bfcaaeab7a2318170540c4908337064fb
+  data.tar.gz: 04324188dc9b85f734b8928c845d6bb4acad5c66e9e8932697395a99d6361f937968f12c66fd06e596f69a64e3efcf75aab3d606b84b318a4efd2aa92fde5a50

data/CHANGELOG.md

@@ -5,6 +5,33 @@ This CHANGELOG follows the format listed at [Keep A Changelog](http://keepachang
 
 ## [Unreleased]
 
+## [3.2.0] - 2016-08-03
+### Fixed
+- metrics-emr-steps.rb: fixed typo in variable name (@babsher)
+- metrics-sqs.rb: --scheme option now works with --prefix (@mool)
+- check-ecs-service-health.rb:
+  - `service_list` retrieves all records when services not provided through options (@marckysharky)
+  - `service_details` - handles scenario whereby services array is greater than aws limit (10) (@marckysharky)
+- exit code for tests did not respect rspec exit codes due to autorun feature. (#133 @zbintliff)
+- syntax error in check-sensu-clients (@sstarcher)
+- check-rds-pending: Fix uninitialized constant (@obazoud)
+
+### Added
+- check-rds.rb: Add support for assuming a role in another account (@oba11)
+- check-instance-events.rb: Add instance_id option (@Jeppesen-io)
+- check-sensu-clients.rb: SSL support (@sstarcher)
+- common.rb: adding support for environment variable AWS_REGION when region is specified as an empty string (@sstarcher)
+- metrics-sqs.rb: Add support for recording additional per-queue SQS metrics (counts of not-visible and delayed messages) (@paddycarey)
+- check-subnet-ip-consumption.rb: to check consumption of IP addresses in subnets and alert if consumption exceeds a threshold (@nickjacques)
+- check-beanstalk-health.rb: Add optional region support
+- check-rds-events.rb: Added '-r all' region support (@swibowo)
+- check-instance-events.rb: Added '-r all' region support and description of the event. Minor change to output message (@swibowo)
+- check-elb-health-sdk.rb: Updated available regions fetch (@swibowo)
+- handler-ec2_node.rb: Add region support (@runningman84)
+
+### Changed
+- Update `aws-sdk` dependency pin to ~> 2.3 (@sstarcher)
+
 ## [3.1.0] - 2016-05-15
 ### Fixed
 - check-instance-events.rb: Ignore completed instance-stop ec2 events
@@ -26,6 +53,7 @@ This CHANGELOG follows the format listed at [Keep A Changelog](http://keepachang
 
 ### Added
 - Support for Ruby 2.3
+- check-elb-health-sdk.rb: Added multi-region support and specify instance tag to display on check output
 - check-rds.rb: Added check for IOPS
 
 ## [2.4.3] - 2016-04-13
@@ -198,7 +226,8 @@ WARNING:  This release contains major breaking changes that will impact all user
 ### Added
 - initial release
 
-[Unreleased]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/3.1.0...HEAD
+[Unreleased]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/3.2.0...HEAD
+[3.2.0]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/3.1.0...3.2.0
 [3.1.0]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/3.0.0...3.1.0
 [3.0.0]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/2.4.3...3.0.0
 [2.4.3]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/2.4.2...2.4.3

data/README.md

@@ -82,6 +82,8 @@
 
 **check-sqs-messages.rb**
 
+**check-subnet-ip-consumption**
+
 **check-vpc-nameservers**
 
 **check_vpc_vpn.py**
@@ -151,6 +153,7 @@
 * /bin/check-ses-limit.rb
 * /bin/check-ses-statistics.rb
 * /bin/check-sqs-messages.rb
+* /bin/check-subnet-ip-consumption.rb
 * /bin/check-vpc-nameservers.rb
 * /bin/check_vpc_vpn.py
 * /bin/check_vpc_vpn.rb

data/bin/check-beanstalk-health.rb

@@ -45,6 +45,11 @@ class BeanstalkHealth < Sensu::Plugin::Check::CLI
          boolean: true,
          default: true
 
+  option :aws_region,
+         short:       '-r AWS_REGION',
+         long:        '--aws-region REGION',
+         description: 'Optional parameter to specify AWS Region.'
+
   def env_health
     @env_health ||= beanstalk_client
                     .describe_environment_health(
@@ -54,7 +59,13 @@ class BeanstalkHealth < Sensu::Plugin::Check::CLI
   end
 
   def beanstalk_client
-    @beanstalk_client ||= Aws::ElasticBeanstalk::Client.new
+    @beanstalk_client ||= if config[:aws_region]
+                            Aws::ElasticBeanstalk::Client.new(
+                              region: config[:aws_region]
+                            )
+                          else
+                            Aws::ElasticBeanstalk::Client.new
+                          end
   end
 
   def instances_health

data/bin/check-ec2-filter.rb

@@ -78,7 +78,7 @@ class EC2Filter < Sensu::Plugin::Check::CLI
   option :compare,
          description: 'Comparision operator for threshold: equal, not, greater, less',
          short: '-o OPERATION',
-         long: '--opertor OPERATION',
+         long: '--operator OPERATION',
          default: 'equal'
 
   def aws_config

data/bin/check-ecs-service-health.rb

@@ -68,11 +68,20 @@ class CheckEcsServiceHealth < Sensu::Plugin::Check::CLI
   # List of requested services or all services registered to the cluster
   def service_list(cluster = 'default', services = nil)
     return services.split ',' if services
-    ecs_client.list_services(cluster: cluster)['service_arns']
+    collect_services(cluster)
+  end
+
+  def collect_services(cluster = 'default', token: nil)
+    response = ecs_client.list_services(cluster: cluster, next_token: token)
+    services = response.service_arns
+    services.push(*collect_services(cluster, token: response.next_token)) if response.next_token
+    services
   end
 
   def service_details(cluster = 'default', services = nil)
-    ecs_client.describe_services(cluster: cluster, services: service_list(cluster, services))['services']
+    service_list(cluster, services).each_slice(10).to_a.map do |s|
+      ecs_client.describe_services(cluster: cluster, services: s)['services']
+    end.flatten
   end
 
   def bucket_service(running_count, desired_count)

data/bin/check-elb-health-sdk.rb

@@ -26,8 +26,6 @@
 # for details.
 
 require 'sensu-plugin/check/cli'
-require 'net/http'
-require 'uri'
 require 'aws-sdk-v1'
 
 class ELBHealth < Sensu::Plugin::Check::CLI
@@ -54,6 +52,11 @@ class ELBHealth < Sensu::Plugin::Check::CLI
          long: '--elb-name ELB_NAME',
          description: 'The Elastic Load Balancer name of which you want to check the health'
 
+  option :instance_tag,
+         short: '-t',
+         long: '--instance-tag INSTANCE_TAG',
+         description: "Specify instance tag to be included in the check output. E.g. 'Name' tag"
+
   option :instances,
          short: '-i INSTANCES',
          long: '--instances INSTANCES',
@@ -79,11 +82,21 @@ class ELBHealth < Sensu::Plugin::Check::CLI
   end
 
   def elb
-    @elb ||= AWS::ELB.new aws_config
+    @elb = AWS::ELB.new aws_config
+  end
+
+  def ec2
+    @ec2 = AWS::EC2::Client.new aws_config
+  end
+
+  def ec2_regions
+    # This is for SDK v2
+    # Aws.partition('aws').regions.map(&:name)
+
+    AWS::EC2.regions.map(&:name)
   end
 
   def elbs
-    return @elbs if @elbs
     @elbs = elb.load_balancers.to_a
     @elbs.select! { |elb| config[:elb_name].include? elb.name } if config[:elb_name]
     @elbs
@@ -98,7 +111,18 @@ class ELBHealth < Sensu::Plugin::Check::CLI
                            end
     instance_health_hash.each do |instance_health|
       if instance_health[:state] != 'InService'
-        unhealthy_instances[instance_health[:instance].id] = instance_health[:state]
+        instance_id = instance_health[:instance].id
+        state_message = instance_health[:state]
+
+        if config[:instance_tag]
+          instance = ec2.describe_instances(instance_ids: [instance_id])
+          selected_tag = instance[:reservation_index][instance_id][:instances_set][0][:tag_set].select { |tag| tag[:key] == config[:instance_tag] }
+          unless selected_tag.empty?
+            state_message = "#{selected_tag[0][:value]}::#{instance_health[:state]}"
+          end
+        end
+
+        unhealthy_instances[instance_id] = state_message
       end
     end
     if unhealthy_instances.empty?
@@ -109,17 +133,37 @@ class ELBHealth < Sensu::Plugin::Check::CLI
   end
 
   def run
-    @message = (elbs.size > 1 ? config[:aws_region] + ': ' : '')
+    aws_regions = ec2_regions
+    @message = ''
     critical = false
-    elbs.each do |elb|
-      result = check_health elb
-      if result != 'OK'
-        @message += "#{elb.name} unhealthy => #{result.map { |id, state| '[' + id + '::' + state + ']' }.join(' ')}. "
-        critical = true
+
+    unless config[:aws_region].casecmp('all') == 0
+      if aws_regions.include? config[:aws_region]
+        aws_regions.clear.push(config[:aws_region])
       else
-        @message += "#{elb.name} => healthy. "
+        critical 'Invalid region specified!'
       end
     end
+
+    aws_regions.each do |r| # Iterate each possible region
+      config[:aws_region] = r
+      region_critical = false
+      @message += (elbs.size > 1 ? config[:aws_region] + ': ' : '')
+      elbs.each do |elb|
+        result = check_health elb
+        if result != 'OK'
+          @message += "#{elb.name} unhealthy => #{result.map { |id, state| '[' + id + '::' + state + ']' }.join(' ')}. "
+          critical = true
+          region_critical = true
+        else
+          @message += "#{elb.name} => healthy. " unless config[:verbose] == false
+        end
+      end
+      if elbs.size > 1 && config[:verbose] != true && region_critical == false
+        @message += 'OK. '
+      end
+    end
+
     if critical
       if config[:warn_only]
         warning @message

data/bin/check-instance-events.rb

@@ -54,6 +54,13 @@ class CheckInstanceEvents < Sensu::Plugin::Check::CLI
          long: '--use-iam',
          description: 'Use IAM role authenticiation. Instance must have IAM role assigned for this to work'
 
+  option :instance_id,
+         short: '-i INSTANCE_IDS',
+         long: '--instances INSTANCES_IDS',
+         description: 'Comma separated list of instances ids to check. Defaults to all instances in the region',
+         proc: proc { |a| a.split(',') },
+         default: []
+
   option :include_name,
          short: '-n',
          long: '--include-name',
@@ -66,59 +73,78 @@ class CheckInstanceEvents < Sensu::Plugin::Check::CLI
       region: config[:aws_region] }
   end
 
+  def ec2_regions
+    # This is for SDK v2
+    # Aws.partition('aws').regions.map(&:name)
+
+    AWS::EC2.regions.map(&:name)
+  end
+
   def run
     event_instances = []
     aws_config = {}
 
+    aws_regions = ec2_regions
+
+    unless config[:aws_region].casecmp('all') == 0
+      if aws_regions.include? config[:aws_region]
+        aws_regions.clear.push(config[:aws_region])
+      else
+        critical 'Invalid region specified!'
+      end
+    end
+
     if config[:use_iam_role].nil?
       aws_config[:access_key_id] = config[:aws_access_key]
       aws_config[:secret_access_key] = config[:aws_secret_access_key]
     end
 
-    ec2 = AWS::EC2::Client.new(aws_config.merge!(region: config[:aws_region]))
-    begin
-      ec2.describe_instance_status[:instance_status_set].each do |i|
-        next if i[:events_set].empty?
-
-        # Exclude completed reboots since the events API appearently returns these even after they have been completed:
-        # Example:
-        #  "events_set": [
-        #     {
-        #         "code": "system-reboot",
-        #         "description": "[Completed] Scheduled reboot",
-        #         "not_before": "2015-01-05 12:00:00 UTC",
-        #         "not_after": "2015-01-05 18:00:00 UTC"
-        #     }
-        # ]
-        useful_events =
-          i[:events_set].reject { |x| (x[:code] == 'system-reboot' || x[:code] == 'instance-stop' || x[:code] == 'system-maintenance') && (x[:description] =~ /\[Completed\]/ || x[:description] =~ /\[Canceled\]/) }
-        unless useful_events.empty?
-          event_instances << i[:instance_id]
+    aws_regions.each do |r| # Iterate each possible region
+      ec2 = AWS::EC2::Client.new(aws_config.merge!(region: r))
+      begin
+        describe_instance_options = {}
+        if config[:instance_id].any?
+          describe_instance_options = describe_instance_options.merge(instance_ids: config[:instance_id])
         end
-      end
-    rescue => e
-      unknown "An error occurred processing AWS EC2 API: #{e.message}"
-    end
 
-    if config[:include_name]
-      event_instances_with_names = []
-      event_instances.each do |id|
-        name = ''
-        begin
-          instance = ec2.describe_instances(instance_ids: [id])
-          # Harvests the 'Name' tag for the instance
-          name = instance[:reservation_index][id][:instances_set][0][:tag_set].select { |tag| tag[:key] == 'Name' }[0][:value]
-        rescue => e
-          puts "Issue getting instance details for #{id}.  Exception = #{e}"
+        ec2.describe_instance_status(describe_instance_options)[:instance_status_set].each do |i|
+          next if i[:events_set].empty?
+
+          # Exclude completed reboots since the events API appearently returns these even after they have been completed:
+          # Example:
+          #  "events_set": [
+          #     {
+          #         "code": "system-reboot",
+          #         "description": "[Completed] Scheduled reboot",
+          #         "not_before": "2015-01-05 12:00:00 UTC",
+          #         "not_after": "2015-01-05 18:00:00 UTC"
+          #     }
+          # ]
+          useful_events =
+            i[:events_set].reject { |x| (x[:code] =~ /system-reboot|instance-stop|system-maintenance/) && (x[:description] =~ /\[Completed\]|\[Canceled\]/) }
+
+          unless useful_events.empty?
+            if config[:include_name]
+              name = ''
+              begin
+                instance_desc = ec2.describe_instances(instance_ids: [i[:instance_id]])
+                name = instance_desc[:reservation_index][i[:instance_id]][:instances_set][0][:tag_set].select { |tag| tag[:key] == 'Name' }[0][:value]
+              rescue => e
+                puts "Issue getting instance details for #{i[:instance_id]} (#{r}).  Exception = #{e}"
+              end
+              event_instances << "#{name} (#{i[:instance_id]} #{r}) (#{i[:events_set][0][:code]}) #{i[:events_set][0][:description]}"
+            else
+              event_instances << "#{i[:instance_id]} (#{r}) (#{i[:events_set][0][:code]}) #{i[:events_set][0][:description]}"
+            end
+          end
         end
-        # Pushes 'name(i-xxx)' if the Name tag was found, else it just pushes the id
-        event_instances_with_names << (name == '' ? id : "#{name}(#{id})")
+      rescue => e
+        unknown "An error occurred processing AWS EC2 API (#{r}): #{e.message}"
       end
-      event_instances = event_instances_with_names
     end
 
     if event_instances.count > 0
-      critical("#{event_instances.count} instances #{event_instances.count > 1 ? 'have' : 'has'} upcoming scheduled events: #{event_instances.join(',')}")
+      critical("#{event_instances.count} instance#{event_instances.count > 1 ? 's have' : ' has'} upcoming scheduled events: #{event_instances.join(',')}")
     else
       ok
     end

data/bin/check-rds-events.rb

@@ -73,6 +73,13 @@ class CheckRDSEvents < Sensu::Plugin::Check::CLI
       region: config[:aws_region] }
   end
 
+  def rds_regions
+    # This is for SDK v2
+    # Aws.partition('aws').regions.map(&:name)
+
+    AWS::RDS.regions.map(&:name)
+  end
+
   def run
     clusters = maint_clusters
     if clusters.empty?
@@ -83,44 +90,56 @@ class CheckRDSEvents < Sensu::Plugin::Check::CLI
   end
 
   def maint_clusters
-    rds = AWS::RDS::Client.new aws_config
+    maint_clusters = []
+    aws_regions = rds_regions
 
-    begin
-      if !config[:db_instance_id].nil? && !config[:db_instance_id].empty?
-        db_instance = rds.describe_db_instances(db_instance_identifier: config[:db_instance_id])
-        if db_instance.nil? || db_instance.empty?
-          unknown "#{config[:db_instance_id]} instance not found"
-        else
-          clusters = [config[:db_instance_id]]
-        end
+    unless config[:aws_region].casecmp('all') == 0
+      if aws_regions.include? config[:aws_region]
+        aws_regions.clear.push(config[:aws_region])
       else
-        # fetch all clusters identifiers
-        clusters = rds.describe_db_instances[:db_instances].map { |db| db[:db_instance_identifier] }
+        critical 'Invalid region specified!'
       end
+    end
 
-      maint_clusters = []
+    aws_regions.each do |r|
+      rds = AWS::RDS::Client.new aws_config.merge!(region: r)
 
-      # fetch the last 15 minutes of events for each cluster
-      # that way, we're only spammed with persistent notifications that we'd care about.
-      clusters.each do |cluster_name|
-        events_record = rds.describe_events(start_time: (Time.now - 900).iso8601, source_type: 'db-instance', source_identifier: cluster_name)
-        next if events_record[:events].empty?
+      begin
+        if !config[:db_instance_id].nil? && !config[:db_instance_id].empty?
+          db_instance = rds.describe_db_instances(db_instance_identifier: config[:db_instance_id])
+          if db_instance.nil? || db_instance.empty?
+            unknown "#{config[:db_instance_id]} instance not found"
+          else
+            clusters = [config[:db_instance_id]]
+          end
+        else
+          # fetch all clusters identifiers
+          clusters = rds.describe_db_instances[:db_instances].map { |db| db[:db_instance_identifier] }
+        end
 
-        # we will need to filter out non-disruptive/basic operation events.
-        # ie. the regular backup operations
-        next if events_record[:events][-1][:message] =~ /Backing up DB instance|Finished DB Instance backup|Restored from snapshot/
-        # ie. Replication resumed
-        next if events_record[:events][-1][:message] =~ /Replication for the Read Replica resumed/
-        # you can add more filters to skip more events.
+        # fetch the last 15 minutes of events for each cluster
+        # that way, we're only spammed with persistent notifications that we'd care about.
+        clusters.each do |cluster_name|
+          events_record = rds.describe_events(start_time: (Time.now - 900).iso8601, source_type: 'db-instance', source_identifier: cluster_name)
+          next if events_record[:events].empty?
 
-        # draft the messages
-        cluster_name_long = "#{cluster_name} (#{aws_config[:region]}) #{events_record[:events][-1][:message]}"
-        maint_clusters.push(cluster_name_long)
-      end
+          # we will need to filter out non-disruptive/basic operation events.
+          # ie. the regular backup operations
+          next if events_record[:events][-1][:message] =~ /Backing up DB instance|Finished DB Instance backup|Restored from snapshot/
+          # ie. Replication resumed
+          next if events_record[:events][-1][:message] =~ /Replication for the Read Replica resumed/
+          # you can add more filters to skip more events.
+
+          # draft the messages
+          cluster_name_long = "#{cluster_name} (#{r}) #{events_record[:events][-1][:message]}"
+          maint_clusters.push(cluster_name_long)
+        end
 
-    rescue => e
-      unknown "An error occurred processing AWS RDS API: #{e.message}"
+      rescue => e
+        unknown "An error occurred processing AWS RDS API (#{r}): #{e.message}"
+      end
     end
+
     maint_clusters
   end
 end

data/bin/check-rds-pending.rb

@@ -1,13 +1,10 @@
 #! /usr/bin/env ruby
 #
-# check-rds-events
+# check-rds-pending
 #
 #
 # DESCRIPTION:
-#   This plugin checks rds clusters for critical events.
-#   Due to the number of events types on RDS clusters the check searches for
-#   events containing the text string 'has started' or 'is being'.  These events all have
-#   accompanying completiion events and are impacting events
+#   This plugin checks rds clusters for pending maintenance action.
 #
 # OUTPUT:
 #   plain-text
@@ -20,7 +17,7 @@
 #   gem: sensu-plugin
 #
 # USAGE:
-#  ./check-rds-events.rb -r ${you_region}
+#  ./check-rds-pending.rb -r ${you_region}
 #
 # NOTES:
 #
@@ -31,6 +28,7 @@
 #
 
 require 'sensu-plugin/check/cli'
+require 'sensu-plugins-aws'
 require 'aws-sdk'
 
 class CheckRDSEvents < Sensu::Plugin::Check::CLI

data/bin/check-rds.rb

@@ -70,6 +70,11 @@ class CheckRDS < Sensu::Plugin::Check::CLI
          description: "AWS Secret Access Key. Either set ENV['AWS_SECRET_KEY'] or provide it as an option",
          default:     ENV['AWS_SECRET_KEY']
 
+  option :role_arn,
+         long:        '--role-arn ROLE_ARN',
+         description: 'AWS role arn of the role of the third party account to switch to',
+         default:     false
+
   option :aws_region,
          short:       '-r AWS_REGION',
          long:        '--aws-region REGION',
@@ -127,12 +132,20 @@ class CheckRDS < Sensu::Plugin::Check::CLI
       region: config[:aws_region] }
   end
 
+  def role_credentials
+    @role_credentials = Aws::AssumeRoleCredentials.new(
+      client: Aws::STS::Client.new(aws_config),
+      role_arn: config[:role_arn],
+      role_session_name: "role@#{Time.now.to_i}"
+    )
+  end
+
   def rds
-    @rds ||= Aws::RDS::Client.new aws_config
+    @rds ||= config[:role_arn] ? Aws::RDS::Client.new(credentials: role_credentials, region: aws_config[:region]) : Aws::RDS::Client.new(aws_config)
   end
 
   def cloud_watch
-    @cloud_watch ||= Aws::CloudWatch::Client.new aws_config
+    @cloud_watch ||= config[:role_arn] ? Aws::CloudWatch::Client.new(credentials: role_credentials, region: aws_config[:region]) : Aws::CloudWatch::Client.new(aws_config)
   end
 
   def find_db_instance(id)

data/bin/check-sensu-client.rb

@@ -33,7 +33,7 @@
 require 'sensu-plugins-aws'
 require 'sensu-plugin/check/cli'
 require 'aws-sdk'
-require 'net/http'
+require 'rest-client'
 require 'json'
 
 class CheckSensuClient < Sensu::Plugin::Check::CLI
@@ -51,6 +51,12 @@ class CheckSensuClient < Sensu::Plugin::Check::CLI
          description: 'Sensu host to query',
          default: 'sensu'
 
+  option :insecure,
+         short: '-k',
+         boolean: true,
+         description: 'Enabling insecure connections',
+         default: false
+
   option :sensu_port,
          short: '-p SENSU_PORT',
          long: '--port SENSU_PORT',
@@ -97,7 +103,7 @@ class CheckSensuClient < Sensu::Plugin::Check::CLI
     end.reduce(:merge)
     filter_list.delete(nil)
     filter_list.each { |x, y| filter_list[x] = y.strip.gsub(/[\[\]]/, '') }
-    client = Aws::EC2::Client.new aws_config
+    client = Aws::EC2::Client.new
 
     parsed_filter = Filter.parse(config[:filter])
 
@@ -162,8 +168,11 @@ class CheckSensuClient < Sensu::Plugin::Check::CLI
   end
 
   def client_check
-    uri = URI("http://#{config[:sensu_host]}:#{config[:sensu_port]}/clients")
-    response = JSON.parse(Net::HTTP.get(uri))
+    verify_mode = OpenSSL::SSL::VERIFY_PEER
+    verify_mode = OpenSSL::SSL::VERIFY_NONE if config[:insecure]
+    request = RestClient::Resource.new("#{config[:sensu_host]}:#{config[:sensu_port]}/clients",
+                                       verify_ssl: verify_mode)
+    response = JSON.parse(request.get)
 
     clients = Set.new
     response.each do |client|

data/bin/check-subnet-ip-consumption.rb

@@ -0,0 +1,229 @@
+#! /usr/bin/env ruby
+#
+# check-subnet-ip-consumption
+#
+#
+# DESCRIPTION:
+#   This plugin uses the EC2 API to determine if any subnet in a given region
+#   has consumed IP addresses such that the consumption exceeds a user-specified threshold.
+#   This plugin additionally uses the IAM API to resolve the account alias,
+#   if the user uses the -s/--show-account-alias flag.
+#
+# OUTPUT:
+#   plain-text
+#
+# PLATFORMS:
+#   Linux
+#
+# DEPENDENCIES:
+#   gem: aws-sdk
+#   gem: sensu-plugin
+#   gem: sensu-plugins-aws
+#
+# USAGE:
+#  ./check-subnet-ip-consumption.rb -a <access key> -k <secret key> -r <region> -t <integer percentage>
+#
+# NOTES:
+#   Special thanks to Garrett Kuchta and Antonio Beyah for their assistance.
+#
+# LICENSE:
+#   Nick Jacques <Nick.Jacques@target.com>
+#   Released under the same terms as Sensu (the MIT license); see LICENSE
+#   for details.
+
+require 'sensu-plugin/check/cli'
+require 'sensu-plugins-aws'
+require 'aws-sdk'
+
+class CheckSubnetIpConsumption < Sensu::Plugin::Check::CLI
+  include Common
+
+  option :aws_region,
+         short:       '-r AWS_REGION',
+         long:        '--aws-region REGION',
+         description: 'AWS Region (defaults to us-east-1).',
+         default:     'us-east-1'
+
+  option :alert_threshold,
+         short:       '-t <threshold percentage>',
+         long:        '--threshold <threshold percentage>',
+         proc:        proc { |a| a.to_i },
+         default:     85,
+         in:          (0..100).to_a,
+         description: 'Threshold (in percent) of consumed IP addresses (per subnet) to alert on'
+
+  option :show_friendly_names,
+         short:       '-f',
+         long:        '--show-friendly-names',
+         boolean:     true,
+         default:     false,
+         description: 'Show friendly names (using the Name tag) for AWS objects such as subnets or VPCs'
+
+  option :show_account_alias,
+         short:       '-s',
+         long:        '--show-account-alias',
+         boolean:     true,
+         default:     false,
+         description: 'Show the account alias in the alert output. Requires IAM read privileges.'
+
+  option :verbosity,
+         short:       '-v <level>',
+         long:        '--verbosity <level>',
+         proc:        proc { |a| a.to_i },
+         in:          (0..2).to_a,
+         default:     0,
+         description: 'Manipulate the verbosity of the alert output. Valid options are 0, 1, and 2 (from least to most verbose). Default is 0.'
+
+  def iam_client
+    @iam_client ||= Aws::IAM::Client.new
+  end
+
+  def ec2_client
+    @ec2_client ||= Aws::EC2::Client.new
+  end
+
+  # Returns the alias of the AWS account (if there is one), "<no name>" (if there is not), or nil if -s/--show-account-alias is not used.
+  def account_alias
+    # Do not execute IAM API call unless the -s/--show_account_alias flag is specified
+    # (to prevent excess API calls *and* errors if IAM rights are not allowed)
+    return nil unless config[:show_account_alias]
+
+    begin
+      iam_account_alias = iam_client.list_account_aliases[:account_aliases].first
+
+      return '<no alias>' if iam_account_alias.empty? || iam_account_alias.nil?
+      return iam_account_alias
+    rescue => e
+      unknown "An error occured while using AWS IAM to collect the account alias: #{e.message}"
+    end
+  end
+
+  # Returns the value of the Name tag (if there is one) or "<no name>" (if there is not). Used with VPC and subnet objects.
+  def extract_name_tag(tags)
+    # Find the 'Name' key in the tags object and extract it. If the key isn't found, we get nil instead.
+    name_tag = tags.find { |tag| tag.key == 'Name' }
+    # If extracting the key/value was successful...
+    if name_tag
+      # ...extract the value (if there is one), or return <no name>
+      !name_tag[:value].empty? ? name_tag[:value] : '<no name>'
+    else
+      # Otherwise, there's not a Name key, and thus the object has no name.
+      '<no name>'
+    end
+  end
+
+  # Returns the subnet's friendly name if -f/--show-friendly-names is used, otherwise returns the ID
+  def display_subnet(alert)
+    return alert[:subnet_name] if config[:show_friendly_names]
+    alert[:subnet_id]
+  end
+
+  # Returns the VPC's friendly name if -f/--show-friendly-names is used, otherwise returns the ID
+  def display_vpc(alert)
+    return alert[:vpc_friendly_name] if config[:show_friendly_names]
+    alert[:subnet_vpc_id]
+  end
+
+  def run
+    # Subnets that meet the threshold criteria will store info hashes in this array
+    consumption_alert = []
+
+    begin
+      subnets = ec2_client.describe_subnets[:subnets]
+
+      subnets.each do |subnet|
+        # subnet.cidr_block contains '0.0.0.0/0' notation. We want the mask number after the slash.
+        subnet_netblock = subnet.cidr_block.split('/')[1].to_i
+        # Subtract the mask number from 32 and use the result as the exponent of 2 to get the number of possible addresses in the netblock.
+        # Then, subtract 5 from that number. Rationale: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html#VPC_Sizing
+        # AWS reserves the first four addresses and the last address in any netblock.
+        subnet_total_capacity = (2**(32 - subnet_netblock)) - 5
+        # Determine how many IP addresses have been consumed
+        subnet_consumed_capacity = (subnet_total_capacity - subnet.available_ip_address_count)
+        # Divide consumed IPs by total IPs to get percentage. Multiply by 100 and round to get integer percents.
+        subnet_consumed_pct = ((subnet_consumed_capacity.to_f / subnet_total_capacity.to_f) * 100).round(0)
+
+        # Get the subnet's friendly name
+        subnet_name_tag = extract_name_tag subnet[:tags]
+        # Only get the VPC friendly names if explicitly asked for (otherwise this is a useless API hit)
+        if config[:show_friendly_names]
+          vpc = ec2_client.describe_vpcs(vpc_ids: [subnet.vpc_id])[:vpcs].first
+          vpc_friendly_name = extract_name_tag vpc[:tags]
+        end
+
+        # Test if the subnet consumption % meets or exceeds the threshold %
+        if subnet_consumed_pct >= config[:alert_threshold]
+          # Add a hash containing subnet info to the consumption_alert array
+          consumption_alert.push(subnet_id: subnet.subnet_id,
+                                 subnet_name: subnet_name_tag,
+                                 subnet_consumed_pct: subnet_consumed_pct,
+                                 subnet_vpc_id: subnet.vpc_id,
+                                 subnet_consumed_capacity: subnet_consumed_capacity,
+                                 subnet_total_capacity: subnet_total_capacity,
+                                 subnet_az: subnet[:availability_zone],
+                                 cidr_block: subnet[:cidr_block],
+                                 vpc_friendly_name: vpc_friendly_name)
+        end
+      end
+    rescue => e
+      unknown "An error occurred processing AWS EC2: #{e.message}"
+    end
+
+    # Process any alerts that might've been generated.
+    if consumption_alert.empty?
+      ok
+    else
+      # Compose alert messages at the configured verbosity
+      alert_msg = []
+
+      verbosity0 = '%{subnet} at %{percent}%% [%{vpc}]'
+      verbosity1 = '%{subnet} at %{percent}%% (%{consumed}/%{total}) [%{vpc}]'
+      verbosity2 = '%{subnet} (%{cidr} in %{az}) at %{percent}%% (%{consumed}/%{total}) [%{vpc}]'
+
+      case config[:verbosity]
+      when 0
+        consumption_alert.each do |alert|
+          alert_msg.push(verbosity0 % { subnet: (display_subnet alert).to_s,
+                                        percent: alert[:subnet_consumed_pct],
+                                        vpc: (display_vpc alert).to_s })
+        end
+      when 1
+        consumption_alert.each do |alert|
+          alert_msg.push(verbosity1 % { subnet: (display_subnet alert).to_s,
+                                        percent: alert[:subnet_consumed_pct],
+                                        consumed: alert[:subnet_consumed_capacity],
+                                        total: alert[:subnet_total_capacity],
+                                        vpc: (display_vpc alert).to_s })
+        end
+      when 2
+        consumption_alert.each do |alert|
+          alert_msg.push(verbosity2 % { subnet: (display_subnet alert).to_s,
+                                        cidr: alert[:cidr_block],
+                                        az: alert[:subnet_az],
+                                        percent: alert[:subnet_consumed_pct],
+                                        consumed: alert[:subnet_consumed_capacity],
+                                        total: alert[:subnet_total_capacity],
+                                        vpc: (display_vpc alert).to_s })
+        end
+      end
+
+      # Throw critical alert with optional account alias display
+      alert_prefix = '%{count} subnets in %{region} exceeding %{threshold}%% IP consumption threshold: %{alerts}'
+      alert_prefix_with_alias = '%{count} subnets in %{alias} (%{region}) exceeding %{threshold}%% IP consumption threshold: %{alerts}'
+
+      case config[:show_account_alias]
+      when true
+        critical(alert_prefix_with_alias % { count: alert_msg.length,
+                                             alias: account_alias,
+                                             region: config[:aws_region],
+                                             threshold: config[:alert_threshold],
+                                             alerts: alert_msg.join(', ') })
+      when false
+        critical(alert_prefix % { count: alert_msg.length,
+                                  region: config[:aws_region],
+                                  threshold: config[:alert_threshold],
+                                  alerts: alert_msg.join(', ') })
+      end
+    end
+  end
+end

data/bin/handler-ec2_node.rb

@@ -1,10 +1,11 @@
 #!/usr/bin/env ruby
 #
 # CHANGELOG:
+# * 0.8.0:
+#   - Added support to use ec2_region from client definition
 # * 0.7.0:
 #   - Added method instance_id to check in client config section
-#     ['client']['aws']['instance_id'] first.
-#    - Update to new API event naming and simplifying ec2_node_should_be_deleted method and fixing
+#   - Update to new API event naming and simplifying ec2_node_should_be_deleted method and fixing
 #      match that will work with any user state defined.
 # * 0.6.0:
 #   - Fixed ec2_node_should_be_deleted to account for an empty insances array
@@ -61,7 +62,28 @@
 # handler to suit your needs.
 #
 #
-# Optional a Sensu configuration snippet:
+# A Sensu Client configuration using the ec2_region attribute:
+#   {
+#     "client": {
+#       "name": "i-424242",
+#       "address": "127.0.0.1",
+#       "ec2_region": "eu-west-1",
+#       "subscriptions": ["all"]
+#     }
+#   }
+# or embeded in the ec2 block
+#   {
+#     "client": {
+#       "name": "i-424242",
+#       "address": "127.0.0.1",
+#       "ec2" : {
+#         "region": "eu-west-1"
+#       },
+#       "subscriptions": ["all"]
+#     }
+#   }
+#
+# Or a Sensu Server configuration snippet:
 #   {
 #     "aws": {
 #       "access_key": "adsafdafda",
@@ -78,7 +100,7 @@
 # If none of the settings are found it will then attempt to
 # generate temporary credentials from the IAM instance profile
 #
-# If region is not specified in either of the above 2 mechanisms
+# If region is not specified in either of the above 3 mechanisms
 # we will make a request for the EC2 instances current region.
 #
 # To use, you can set it as the keepalive handler for a client:
@@ -153,14 +175,6 @@ class Ec2Node < Sensu::Handler
   end
 
   def instance_id
-    if @event['client'].key?('aws') && @event['client']['aws'].key?('instance_id')
-      @event['client']['aws']['instance_id']
-    else
-      @event['client']['name']
-    end
-  end
-
-  def instance_name
     @event['client']['name']
   end
 
@@ -198,7 +212,9 @@ class Ec2Node < Sensu::Handler
   def region
     @region ||= begin
       region_check = ENV['EC2_REGION']
-      region_check = settings['aws']['region'] if settings.key? 'aws'
+      region_check = settings['aws']['region'] if settings.key?('aws')
+      region_check = @event['client']['ec2_region'] if @event['client'].key?('ec2_region')
+      region_check = @event['client']['ec2']['region'] if @event['client'].key?('ec2') && @event['client']['ec2'].key?('region')
       if region_check.nil? || region_check.empty?
         region_check = Net::HTTP.get(URI('http://169.254.169.254/latest/meta-data/placement/availability-zone'))
         matches = /(\w+\-\w+\-\d+)/.match(region_check)

data/bin/metrics-emr-steps.rb

@@ -74,7 +74,7 @@ class EMRStepMetrics < Sensu::Plugin::Metric::CLI::Graphite
       STATUS.each_entry { |status| data[status] = 0 }
       cluster_steps(emr, cluster.id, data)
       safe_name = config[:cluster_name].tr(' ', '_')
-      output config[:scheme] + '.' + safe_name + '.id.' + cluster_id
+      output config[:scheme] + '.' + safe_name + '.id.' + cluster.id
       STATUS.each_entry { |status| output config[:scheme] + '.' + safe_name + '.step.' + status, data[status] }
     end
     ok

data/bin/metrics-sqs.rb

@@ -74,7 +74,14 @@ class SQSMetrics < Sensu::Plugin::Metric::CLI::Graphite
   end
 
   def scheme(queue_name)
-    "aws.sqs.queue.#{queue_name.tr('-', '_')}.message_count"
+    scheme = config[:scheme].empty? ? 'aws.sqs.queue' : config[:scheme]
+    "#{scheme}.#{queue_name.tr('-', '_')}.message_count"
+  end
+
+  def record_queue_metrics(q_name, q)
+    output scheme(q_name), q.approximate_number_of_messages
+    output "#{scheme(q_name)}.delayed", q.approximate_number_of_messages_delayed
+    output "#{scheme(q_name)}.not_visible", q.approximate_number_of_messages_not_visible
   end
 
   def run
@@ -86,18 +93,10 @@ class SQSMetrics < Sensu::Plugin::Metric::CLI::Graphite
           critical 'Error, either QUEUE or PREFIX must be specified'
         end
 
-        scheme = if config[:scheme] == ''
-                   scheme config[:queue]
-                 else
-                   config[:scheme]
-                 end
-
-        messages = sqs.queues.named(config[:queue]).approximate_number_of_messages
-        output scheme, messages
+        record_queue_metrics(config[:queue], sqs.queues.named(config[:queue]))
       else
         sqs.queues.with_prefix(config[:prefix]).each do |q|
-          queue_name = q.arn.split(':').last
-          output scheme(queue_name), q.approximate_number_of_messages
+          record_queue_metrics(q.arn.split(':').last, q)
         end
       end
     rescue => e

data/lib/sensu-plugins-aws/common.rb

@@ -27,6 +27,6 @@ module Common
 
     Aws.config.update(
       region: config[:aws_region]
-    )
+    ) if config.key?(:aws_region)
   end
 end

data/lib/sensu-plugins-aws/version.rb

@@ -1,7 +1,7 @@
 module SensuPluginsAWS
   module Version
     MAJOR = 3
-    MINOR = 1
+    MINOR = 2
     PATCH = 0
     VER_STRING = [MAJOR, MINOR, PATCH].compact.join('.')
   end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: sensu-plugins-aws
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Sensu-Plugins and contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-15 00:00:00.000000000 Z
+date: 2016-08-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.28
+        version: '2.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.28
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-v1
   requirement: !ruby/object:Gem::Requirement
@@ -70,16 +70,16 @@ dependencies:
   name: sensu-plugin
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: erubis
   requirement: !ruby/object:Gem::Requirement
@@ -94,138 +94,153 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 2.7.0
+- !ruby/object:Gem::Dependency
+  name: rest-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.8.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.8.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.7'
 - !ruby/object:Gem::Dependency
   name: codeclimate-test-reporter
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.4'
 - !ruby/object:Gem::Dependency
   name: github-markup
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
 - !ruby/object:Gem::Dependency
   name: pry
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.10'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.10'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '10.5'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '10.5'
 - !ruby/object:Gem::Dependency
   name: redcarpet
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '3.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '3.2'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.40.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.40.0
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '3.4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '3.4'
 - !ruby/object:Gem::Dependency
   name: yard
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.8'
-description: ! "This plugin provides native AWS instrumentation\n                              for
-  monitoring and metrics collection, including:\n                              health
-  and metrics for various AWS services, such\n                              as EC2,
-  RDS, ELB, and more, as well as handlers\n                              for EC2,
-  SES, and SNS."
-email: <sensu-users@googlegroups.com>
+description: |-
+  This plugin provides native AWS instrumentation
+                                for monitoring and metrics collection, including:
+                                health and metrics for various AWS services, such
+                                as EC2, RDS, ELB, and more, as well as handlers
+                                for EC2, SES, and SNS.
+email: "<sensu-users@googlegroups.com>"
 executables:
 - check-autoscaling-cpucredits.rb
 - check-beanstalk-elb-metric.rb
@@ -270,6 +285,7 @@ executables:
 - check-ses-statistics.rb
 - check-sns-subscriptions.rb
 - check-sqs-messages.rb
+- check-subnet-ip-consumption.rb
 - check-trustedadvisor-service-limits.rb
 - check-vpc-nameservers.rb
 - check-vpc-vpn.rb
@@ -336,6 +352,7 @@ files:
 - bin/check-ses-statistics.rb
 - bin/check-sns-subscriptions.rb
 - bin/check-sqs-messages.rb
+- bin/check-subnet-ip-consumption.rb
 - bin/check-trustedadvisor-service-limits.rb
 - bin/check-vpc-nameservers.rb
 - bin/check-vpc-vpn.rb
@@ -375,17 +392,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: 2.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Sensu plugins for working with an AWS environment