ec2-instance-running-scheduler 0.4.5 → 0.5.0

package/.jsii

@@ -8435,12 +8435,12 @@
       }
     }
   },
-  "description": "AWS CDK construct library that starts and stops EC2 instances on a cron schedule using EventBridge Scheduler and a Durable Execution Lambda. The handler discovers instances with the Resource Groups Tagging API, issues start/stop, waits until each instance reaches a stable target state (durable step / wait), processes multiple instances in parallel (bounded concurrency), and posts Slack summary and per-instance thread messages using a secret from Secrets Manager. The Lambda emits structured application logs alongside JSON platform logs.",
+  "description": "AWS CDK construct library that starts and stops EC2 instances on a cron schedule using EventBridge Scheduler and a Durable Execution Lambda. Tagged instances are discovered account-wide, started or stopped in parallel, waited until stable, and reported to Slack via Secrets Manager.",
   "docs": {
     "stability": "stable"
   },
   "homepage": "https://github.com/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler.git",
-  "jsiiVersion": "6.0.15 (build 8b73573)",
+  "jsiiVersion": "6.0.16 (build 15002ec)",
   "keywords": [
     "cdk",
     "durable",
@@ -8462,7 +8462,7 @@
   },
   "name": "ec2-instance-running-scheduler",
   "readme": {
-    "markdown": "# EC2 Instance Running Scheduler (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler?style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler/blob/main/LICENSE)\n[![npm](https://img.shields.io/npm/v/ec2-instance-running-scheduler?style=flat-square)](https://www.npmjs.com/package/ec2-instance-running-scheduler)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler/releases)\n\n[![View on Construct Hub](https://constructs.dev/badge?package=ec2-instance-running-scheduler)](https://constructs.dev/packages/ec2-instance-running-scheduler)\n\nAWS CDK construct library that starts and stops EC2 instances on a cron schedule using **EventBridge Scheduler** and a **Durable Execution Lambda**. The handler discovers instances with the **Resource Groups Tagging API**, issues start/stop, **waits until each instance reaches a stable target state** (durable `step` / `wait`), processes **multiple instances in parallel** (bounded concurrency), and posts **Slack** summary and per-instance thread messages using a secret from **Secrets Manager**. The Lambda emits **structured application logs** alongside JSON platform logs.\n\n## Features\n\n- **Tag-based targeting** – Select EC2 instances by tag key and values (e.g. `Schedule` / `YES`) via `tag:GetResources`.\n- **EventBridge Scheduler** – Separate cron rules for start and stop, with per-rule timezone (`aws-cdk-lib` `TimeZone`).\n- **Durable Lambda** – One Lambda with AWS Lambda Durable Execution (`step`, `wait`, `map`, child contexts per instance) for long-running workflows without Step Functions.\n- **Stable-state waiting** – After start/stop, the function waits (`resourceWait.statusChangeWaitSeconds`, default **20** seconds between attempts) and re-describes instances until `running` (start mode) or `stopped` (stop mode).\n- **Configurable wait limits** – Per-instance **max loop count**, **max elapsed time**, and **status-change wait interval** via `resourceWait` (default: 90 loops / 1800 seconds / 20 seconds). Failures use explicit `ResourceWaitFailed:*` messages instead of running until the Durable execution timeout (construct default: 2 hours; override with `durable.executionTimeout`).\n- **Configurable Lambda runtime** – Memory, invoke timeout, and bounded instance concurrency via `runtime` (default: **512 MB** / **15 minutes** / **maxConcurrency 10**). Durable execution timeout and history retention via `durable` (default: **2 hours** / **1 day**).\n- **Configurable logs** – Log group retention and removal policy via `logGroup` (default: **3 months**, `RemovalPolicy.DESTROY`).\n- **Validated environment variables** – The bundled handler parses env vars with **strict-env-resolver** (`StrictEnvResolver`). `SLACK_SECRET_NAME` is required; wait limits and `maxConcurrency` must be **positive integers** (`>= 1`).\n- **Slack notifications** – Parent message plus threaded updates per instance; credentials from Secrets Manager JSON (`token`, `channel`). The construct sets **`SLACK_SECRET_NAME`** on the function.\n- **Structured logging** – Durable execution **`ctx.logger`** for traceable JSON application logs (invocation, describe/start/stop/wait loops, wait limit errors, Slack steps, completion).\n- **Optional failure detection** – CloudWatch alarms and log-based metrics for Lambda errors, instance wait failures (`ResourceWaitFailed`), Slack post failures, and other handler `ERROR` logs. Optional SNS notifications via a caller-supplied topic (`failureDetection.alarmTopic`).\n- **Scheduling toggle** – Enable or disable both schedules without removing the stack (`enableScheduling`).\n- **Configurable schedules** – Optional cron overrides for start and stop (`minute`, `hour`, `week`, `timezone`); sensible defaults if omitted.\n- **IAM and observability** – Start/stop is limited to EC2 instances in the stack account/region whose tags match `targetResource`. Slack secret read grant, **Parameters and Secrets Lambda Extension**, JSON logging, and a dedicated log group (override retention and removal policy via `logGroup`).\n\n## Installation\n\n**npm**\n\n```bash\nnpm install ec2-instance-running-scheduler\n```\n\n**yarn**\n\n```bash\nyarn add ec2-instance-running-scheduler\n```\n\n**pnpm**\n\n```bash\npnpm add ec2-instance-running-scheduler\n```\n\n## Usage\n\nUse the **construct** `EC2InstanceRunningScheduler` when embedding the scheduler in an existing stack or other CDK scope.\n\n```typescript\nimport * as cdk from 'aws-cdk-lib';\nimport { TimeZone } from 'aws-cdk-lib';\nimport * as logs from 'aws-cdk-lib/aws-logs';\nimport * as sns from 'aws-cdk-lib/aws-sns';\nimport { EC2InstanceRunningScheduler } from 'ec2-instance-running-scheduler';\n\nconst app = new cdk.App();\nconst stack = new cdk.Stack(app, 'MyStack');\n\nconst alarmTopic = new sns.Topic(stack, 'OpsAlerts');\n\nnew EC2InstanceRunningScheduler(stack, 'EC2InstanceRunningScheduler', {\n  targetResource: {\n    tagKey: 'Schedule',\n    tagValues: ['YES'],\n  },\n  secrets: {\n    slackSecretName: 'my-slack-secret',\n  },\n  startSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '55',\n    hour: '8',\n    week: 'MON-FRI',\n  },\n  stopSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '5',\n    hour: '19',\n    week: 'MON-FRI',\n  },\n  enableScheduling: true,\n  resourceWait: {\n    maxLoopCount: 120,\n    maxElapsedSeconds: 3600,\n    statusChangeWaitSeconds: 15,\n  },\n  runtime: {\n    memorySize: 1024,\n    timeout: cdk.Duration.minutes(15),\n    maxConcurrency: 20,\n  },\n  durable: {\n    executionTimeout: cdk.Duration.hours(4),\n    retentionPeriod: cdk.Duration.days(7),\n  },\n  logGroup: {\n    retention: logs.RetentionDays.ONE_YEAR,\n    removalPolicy: cdk.RemovalPolicy.RETAIN,\n  },\n  failureDetection: {\n    enabled: true,\n    alarmTopic,\n  },\n});\n```\n\nUse the **stack** `EC2InstanceRunningScheduleStack` when deploying the scheduler as its own stack. It accepts the same **targeting, schedules, secrets, enable flag, and failure detection** as the construct (plus standard `StackProps` such as `env`). For **`resourceWait`**, **`runtime`**, **`durable`**, and **`logGroup`**, use the construct directly or extend the stack in your app.\n\n```typescript\nimport * as cdk from 'aws-cdk-lib';\nimport { TimeZone } from 'aws-cdk-lib';\nimport * as sns from 'aws-cdk-lib/aws-sns';\nimport { EC2InstanceRunningScheduleStack } from 'ec2-instance-running-scheduler';\n\nconst app = new cdk.App();\n\nconst alarmTopic = sns.Topic.fromTopicArn(\n  app,\n  'OpsAlerts',\n  'arn:aws:sns:ap-northeast-1:123456789012:ops-alerts',\n);\n\nnew EC2InstanceRunningScheduleStack(app, 'EC2InstanceRunningScheduleStack', {\n  targetResource: {\n    tagKey: 'Schedule',\n    tagValues: ['YES'],\n  },\n  secrets: {\n    slackSecretName: 'my-slack-secret',\n  },\n  startSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '55',\n    hour: '8',\n    week: 'MON-FRI',\n  },\n  stopSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '5',\n    hour: '19',\n    week: 'MON-FRI',\n  },\n  enableScheduling: true,\n  failureDetection: {\n    enabled: true,\n    alarmTopic,\n  },\n});\n```\n\n## Tag instances before scheduling\n\nThe scheduler only starts and stops EC2 instances that **already** have the tag key and one of the tag values in `targetResource`. Tag instances in the same account and region as the stack **before** enabling schedules.\n\n**AWS CLI**\n\n```bash\naws ec2 create-tags \\\n  --resources i-0123456789abcdef0 \\\n  --tags Key=Schedule,Value=YES\n```\n\n**Console** – EC2 → Instances → select the instance → Tags → Add `Schedule` = `YES` (or your `tagKey` / `tagValues`).\n\nIAM for `ec2:StartInstances` and `ec2:StopInstances` is limited to:\n\n- instance ARNs in the stack **account** and **region** (`arn:...:ec2:<region>:<account>:instance/*`)\n- instances whose `aws:ResourceTag/<tagKey>` matches one of `tagValues`\n\nAn instance without the tag is not discovered by `tag:GetResources`, and start/stop is denied even if an instance ID is known. `tag:GetResources` and `ec2:DescribeInstances` still use `Resource: *` because those APIs do not support resource-level permissions or resource-tag conditions.\n\nEventBridge Scheduler invokes the Lambda with `Params.TagKey`, `Params.TagValues`, and `Params.Mode` (`Start` or `Stop`); the construct wires this for you. The function environment includes:\n\n| Variable | Source | Purpose |\n|----------|--------|---------|\n| `SLACK_SECRET_NAME` | `secrets.slackSecretName` | Secrets Manager secret for Slack (required) |\n| `PROCESS_RESOURCE_MAX_LOOP_COUNT` | `resourceWait.maxLoopCount` (default `90`) | Max describe/wait iterations per instance |\n| `PROCESS_RESOURCE_MAX_ELAPSED_SECONDS` | `resourceWait.maxElapsedSeconds` (default `1800`) | Max wall-clock seconds waiting for one instance |\n| `PROCESS_RESOURCE_STATUS_CHANGE_WAIT_SECONDS` | `resourceWait.statusChangeWaitSeconds` (default `20`) | Seconds between describe/wait iterations |\n| `PROCESS_RESOURCES_MAX_CONCURRENCY` | `runtime.maxConcurrency` (default `10`) | Max instances processed in parallel |\n\nWhen you set wait limits via `resourceWait` or concurrency via `runtime.maxConcurrency`, the construct writes them as decimal integer strings. At invocation the handler parses them with **strict-env-resolver**; each value must be a **positive integer** (`>= 1`). Missing `SLACK_SECRET_NAME` or invalid env values cause `StrictEnvValidationError` at the start of an invocation.\n\n## Options\n\n### EC2InstanceRunningScheduler\n\n| Option | Type | Required | Description |\n|--------|------|----------|-------------|\n| `targetResource` | `TargetResource` | Yes | Tag key and values used to select EC2 instances. |\n| `secrets` | `Secrets` | Yes | Secrets Manager secret for Slack (`slackSecretName`). |\n| `startSchedule` | `Schedule` | No | Cron for starting instances (default: `50 7 ? * MON-FRI *` in `Etc/UTC`). |\n| `stopSchedule` | `Schedule` | No | Cron for stopping instances (default: `5 19 ? * MON-FRI *` in `Etc/UTC`). |\n| `enableScheduling` | `boolean` | No | Whether both scheduler rules are enabled (default: `true`). |\n| `resourceWait` | `ResourceWaitLimits` | No | Per-instance wait caps (see below). |\n| `runtime` | `RunningSchedulerRuntimeProps` | No | Lambda memory, invoke timeout, and map concurrency. |\n| `durable` | `RunningSchedulerDurableProps` | No | Durable execution timeout and history retention. |\n| `logGroup` | `RunningSchedulerLogGroupProps` | No | Function log group retention and removal policy. |\n| `failureDetection` | `FailureDetectionAlarms` | No | Optional CloudWatch alarms and log-based metrics (see below). |\n\n### EC2InstanceRunningScheduleStack\n\nIncludes `targetResource`, `secrets`, `startSchedule`, `stopSchedule`, `enableScheduling`, `failureDetection`, and standard `StackProps`. Does **not** expose `resourceWait`, `runtime`, `durable`, or `logGroup`; use `EC2InstanceRunningScheduler` when you need custom wait, Lambda, Durable, or log settings.\n\n### TargetResource\n\n- `tagKey` – Tag key used to select instances (e.g. `Schedule`). Required on each target instance before schedules run.\n- `tagValues` – Tag values that must match (e.g. `['YES']`). At least one value is required.\n\nSee [Tag instances before scheduling](#tag-instances-before-scheduling).\n\n### Schedule\n\n- `timezone` – `TimeZone` from `aws-cdk-lib` (e.g. `TimeZone.ASIA_TOKYO`, `TimeZone.ETC_UTC`).\n- `minute` – Cron minute (`0`–`59`).\n- `hour` – Cron hour (`0`–`23`).\n- `week` – Cron day-of-week field (e.g. `MON-FRI`).\n\n### Secrets\n\n- `slackSecretName` – Name of the AWS Secrets Manager secret. The Lambda expects JSON with **`token`** (Slack bot token) and **`channel`** (channel ID or name for `chat.postMessage`).\n\n### ResourceWaitLimits\n\nWritten to `PROCESS_RESOURCE_MAX_LOOP_COUNT`, `PROCESS_RESOURCE_MAX_ELAPSED_SECONDS`, and `PROCESS_RESOURCE_STATUS_CHANGE_WAIT_SECONDS` on the running scheduler Lambda.\n\n- `maxLoopCount` – Maximum describe/wait loop iterations per instance (default: **90**). Must be a positive integer when set.\n- `maxElapsedSeconds` – Maximum wall-clock seconds spent waiting for one instance to stabilize (default: **1800**, 30 minutes). Must be a positive integer when set.\n- `statusChangeWaitSeconds` – Seconds between describe iterations after start/stop or while transitioning (default: **20**). Must be a positive integer when set.\n\nWhen a limit is exceeded during waiting, the handler throws an error with prefix `ResourceWaitFailed:` (`MaxLoopCountExceeded`, `MaxElapsedTimeExceeded`, or `UnexpectedInstanceState` for unknown EC2 states).\n\n### RunningSchedulerRuntimeProps\n\nLambda invoke settings. Written `maxConcurrency` to `PROCESS_RESOURCES_MAX_CONCURRENCY`.\n\n- `memorySize` – Memory in MB (default: **512**). Must be a positive integer when set.\n- `timeout` – Lambda invoke timeout (default: **15 minutes**). AWS maximum is 15 minutes; durable waits continue under `durable.executionTimeout`.\n- `maxConcurrency` – Max instances processed in parallel (default: **10**). Must be a positive integer when set. Increase with instance count.\n\n### RunningSchedulerDurableProps\n\n- `executionTimeout` – Maximum durable execution duration (default: **2 hours**). Increase when many instances wait in sequence of batches.\n- `retentionPeriod` – Durable execution history retention (default: **1 day**).\n\n### RunningSchedulerLogGroupProps\n\n- `retention` – CloudWatch Logs retention (default: **`RetentionDays.THREE_MONTHS`**).\n- `removalPolicy` – Log group removal policy (default: **`RemovalPolicy.DESTROY`**).\n\n### FailureDetectionAlarms\n\nOptional operational failure detection. Alarms are created only when `enabled` is `true`.\n\n- `enabled` – When `true`, creates four CloudWatch alarms and three log metric filters (default: disabled when omitted).\n- `alarmTopic` – Optional `sns.ITopic` for alarm actions. The construct does **not** create an SNS topic; pass an existing or imported topic. When omitted, alarms are created without SNS actions.\n\nWhen enabled, the construct creates:\n\n| Alarm | Trigger |\n|-------|---------|\n| Lambda errors | `AWS/Lambda` `Errors` metric |\n| Instance status failure | Log filter: `ResourceWaitFailed` |\n| Slack post failure | Log filter: `running-scheduler: Slack post failed` |\n| Durable execution failure | Other handler `ERROR` logs (excluding the above) |\n\nCustom metrics are published under the `EC2InstanceRunningScheduler` namespace. Access the created alarms via `EC2InstanceRunningScheduler.failureDetection` when enabled.\n\n## Requirements\n\n- **Node.js** ≥ 20.0.0 (for developing or synthesizing CDK apps that depend on this package).\n- **aws-cdk-lib** ^2.232.0 and **constructs** ^10.5.1 (peer dependencies).\n- **AWS** – EventBridge Scheduler; Lambda with **Durable Execution** (Node.js **24.x** runtime in the construct; Durable Execution requires a supported Node.js runtime in your region), a **live alias**, **Parameters and Secrets Lambda Extension**; EC2 (`DescribeInstances`, `StartInstances`, `StopInstances`); Resource Groups Tagging API (`tag:GetResources`); Secrets Manager. The deployed function uses **arm64**, Durable Execution IAM policies, a 2-hour Durable execution timeout (construct default), and a bundled handler that loads secrets via **aws-lambda-secret-fetcher** (^0.7) and parses env vars via **strict-env-resolver** (^0.6). Secret fetch runs only inside Lambda (requires runtime `AWS_SESSION_TOKEN` and the extension layer); the library retries transient extension errors including cold-start \"not ready\" responses.\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
+    "markdown": "# EC2 Instance Running Scheduler (CDK v2)\n\n[![npm version](https://img.shields.io/npm/v/ec2-instance-running-scheduler?style=flat-square)](https://www.npmjs.com/package/ec2-instance-running-scheduler)\n[![license](https://img.shields.io/npm/l/ec2-instance-running-scheduler?style=flat-square)](https://www.npmjs.com/package/ec2-instance-running-scheduler)\n[![Node.js](https://img.shields.io/node/v/ec2-instance-running-scheduler?style=flat-square)](https://www.npmjs.com/package/ec2-instance-running-scheduler)\n[![build](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler/build.yml?label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/ec2-instance-running-scheduler/actions/workflows/build.yml)\n\n[![View on Construct Hub](https://constructs.dev/badge?package=ec2-instance-running-scheduler)](https://constructs.dev/packages/ec2-instance-running-scheduler)\n\nAWS CDK construct library that starts and stops EC2 instances on a cron schedule using EventBridge Scheduler and a Durable Execution Lambda. Tagged instances are discovered account-wide, started or stopped in parallel, waited until stable, and reported to Slack via Secrets Manager.\n\n## Features\n\n- **Tag-based targeting** – Select EC2 instances by tag key and values (e.g. `Schedule` / `YES`) via `tag:GetResources`.\n- **EventBridge Scheduler** – Separate cron rules for start and stop, with per-rule timezone (`aws-cdk-lib` `TimeZone`).\n- **Durable Lambda** – One Lambda with AWS Lambda Durable Execution (`step`, `wait`, `map`, child contexts per instance) for long-running workflows without Step Functions.\n- **Stable-state waiting** – After start/stop, waits and re-describes until `running` or `stopped`, with configurable wait limits (`resourceWait`).\n- **Configurable Lambda runtime** – Memory, invoke timeout, and bounded concurrency via `runtime`; Durable timeout and retention via `durable`.\n- **Slack notifications** – Parent message plus threaded updates per instance; credentials from Secrets Manager JSON (`token`, `channel`).\n- **Optional failure detection** – Opt-in CloudWatch alarms via `failureDetection` (`enabled` / optional `alarmTopic`). Uses `LambdaFailureDetector` for platform Lambda `Errors` plus scheduler-specific log filters (`ResourceWaitFailed`, Slack post failures, other handler `ERROR` logs). The construct never creates an SNS topic.\n- **Scheduling toggle** – Enable or disable both schedules without removing the stack (`enableScheduling`).\n\n## How it works\n\n1. Tag EC2 instances in the same account and region with the `targetResource` tag key and one of the tag values **before** enabling schedules.\n2. EventBridge Scheduler invokes the Lambda alias on the start/stop cron with `Params.TagKey`, `Params.TagValues`, and `Params.Mode` (`Start` or `Stop`).\n3. The Durable handler discovers matching instances via the Resource Groups Tagging API, then starts or stops them in parallel (bounded by `runtime.maxConcurrency`).\n4. For each instance it waits (`resourceWait`) until the desired stable state, or fails with a `ResourceWaitFailed:*` error.\n5. Slack receives a summary and per-instance thread updates when the secret is configured.\n6. When `failureDetection.enabled` is `true`, CloudWatch alarms cover Lambda platform errors and the scheduler log filters above. Pass `failureDetection.alarmTopic` to attach SNS actions to an existing topic.\n\n**Tag an instance (AWS CLI)**\n\n```bash\naws ec2 create-tags \\\n  --resources i-0123456789abcdef0 \\\n  --tags Key=Schedule,Value=YES\n```\n\nStart/stop IAM is limited to instance ARNs in the stack account and region whose `aws:ResourceTag/<tagKey>` matches `tagValues`. `tag:GetResources` and `ec2:DescribeInstances` still use `Resource: *` because those APIs do not support resource-level permissions or resource-tag conditions.\n\n## Installation\n\n### npm\n\n```bash\nnpm install ec2-instance-running-scheduler\n```\n\n### yarn\n\n```bash\nyarn add ec2-instance-running-scheduler\n```\n\n### pnpm\n\n```bash\npnpm add ec2-instance-running-scheduler\n```\n\n## Usage\n\nUse the **construct** `EC2InstanceRunningScheduler` when embedding the scheduler in an existing stack or other CDK scope.\n\n```typescript\nimport * as cdk from 'aws-cdk-lib';\nimport { TimeZone } from 'aws-cdk-lib';\nimport * as logs from 'aws-cdk-lib/aws-logs';\nimport * as sns from 'aws-cdk-lib/aws-sns';\nimport { EC2InstanceRunningScheduler } from 'ec2-instance-running-scheduler';\n\nconst app = new cdk.App();\nconst stack = new cdk.Stack(app, 'MyStack');\n\nconst alarmTopic = new sns.Topic(stack, 'OpsAlerts');\n\nnew EC2InstanceRunningScheduler(stack, 'EC2InstanceRunningScheduler', {\n  targetResource: {\n    tagKey: 'Schedule',\n    tagValues: ['YES'],\n  },\n  secrets: {\n    slackSecretName: 'my-slack-secret',\n  },\n  startSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '55',\n    hour: '8',\n    week: 'MON-FRI',\n  },\n  stopSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '5',\n    hour: '19',\n    week: 'MON-FRI',\n  },\n  enableScheduling: true,\n  resourceWait: {\n    maxLoopCount: 120,\n    maxElapsedSeconds: 3600,\n    statusChangeWaitSeconds: 15,\n  },\n  runtime: {\n    memorySize: 1024,\n    timeout: cdk.Duration.minutes(15),\n    maxConcurrency: 20,\n  },\n  durable: {\n    executionTimeout: cdk.Duration.hours(4),\n    retentionPeriod: cdk.Duration.days(7),\n  },\n  logGroup: {\n    retention: logs.RetentionDays.ONE_YEAR,\n    removalPolicy: cdk.RemovalPolicy.RETAIN,\n  },\n  failureDetection: {\n    enabled: true,\n    alarmTopic,\n  },\n});\n```\n\nUse the **stack** `EC2InstanceRunningScheduleStack` when deploying the scheduler as its own stack. It accepts the same targeting, schedules, secrets, enable flag, and failure detection as the construct (plus standard `StackProps`). For `resourceWait`, `runtime`, `durable`, and `logGroup`, use the construct directly.\n\n```typescript\nimport * as cdk from 'aws-cdk-lib';\nimport { TimeZone } from 'aws-cdk-lib';\nimport * as sns from 'aws-cdk-lib/aws-sns';\nimport { EC2InstanceRunningScheduleStack } from 'ec2-instance-running-scheduler';\n\nconst app = new cdk.App();\n\nconst alarmTopic = sns.Topic.fromTopicArn(\n  app,\n  'OpsAlerts',\n  'arn:aws:sns:ap-northeast-1:123456789012:ops-alerts',\n);\n\nnew EC2InstanceRunningScheduleStack(app, 'EC2InstanceRunningScheduleStack', {\n  targetResource: {\n    tagKey: 'Schedule',\n    tagValues: ['YES'],\n  },\n  secrets: {\n    slackSecretName: 'my-slack-secret',\n  },\n  startSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '55',\n    hour: '8',\n    week: 'MON-FRI',\n  },\n  stopSchedule: {\n    timezone: TimeZone.ASIA_TOKYO,\n    minute: '5',\n    hour: '19',\n    week: 'MON-FRI',\n  },\n  enableScheduling: true,\n  failureDetection: {\n    enabled: true,\n    alarmTopic,\n  },\n});\n```\n\n## Options\n\n### EC2InstanceRunningScheduler\n\n| Option | Type | Required | Description |\n|--------|------|----------|-------------|\n| `targetResource` | `TargetResource` | Yes | Tag key and values used to select EC2 instances. |\n| `secrets` | `Secrets` | Yes | Secrets Manager secret for Slack (`slackSecretName`). |\n| `startSchedule` | `Schedule` | No | Cron for starting instances (default: `50 7 ? * MON-FRI *` in `Etc/UTC`). |\n| `stopSchedule` | `Schedule` | No | Cron for stopping instances (default: `5 19 ? * MON-FRI *` in `Etc/UTC`). |\n| `enableScheduling` | `boolean` | No | Whether both scheduler rules are enabled (default: `true`). |\n| `resourceWait` | `ResourceWaitLimits` | No | Per-instance wait caps (see below). |\n| `runtime` | `RunningSchedulerRuntimeProps` | No | Lambda memory, invoke timeout, and map concurrency. |\n| `durable` | `RunningSchedulerDurableProps` | No | Durable execution timeout and history retention. |\n| `logGroup` | `RunningSchedulerLogGroupProps` | No | Function log group retention and removal policy. |\n| `failureDetection` | `RunningSchedulerFailureDetectionProps` | No | Optional CloudWatch alarms and log-based metrics (see below). |\n\n### EC2InstanceRunningScheduleStack\n\nIncludes `targetResource`, `secrets`, `startSchedule`, `stopSchedule`, `enableScheduling`, `failureDetection`, and standard `StackProps`. Does **not** expose `resourceWait`, `runtime`, `durable`, or `logGroup`; use `EC2InstanceRunningScheduler` when you need custom wait, Lambda, Durable, or log settings.\n\n### TargetResource\n\n- `tagKey` – Tag key used to select instances (e.g. `Schedule`). Required on each target instance before schedules run.\n- `tagValues` – Tag values that must match (e.g. `['YES']`). At least one value is required.\n\n### Schedule\n\n- `timezone` – `TimeZone` from `aws-cdk-lib` (e.g. `TimeZone.ASIA_TOKYO`, `TimeZone.ETC_UTC`).\n- `minute` – Cron minute (`0`–`59`).\n- `hour` – Cron hour (`0`–`23`).\n- `week` – Cron day-of-week field (e.g. `MON-FRI`).\n\n### Secrets\n\n- `slackSecretName` – Name of the AWS Secrets Manager secret. The Lambda expects JSON with **`token`** (Slack bot token) and **`channel`** (channel ID or name for `chat.postMessage`).\n\n### ResourceWaitLimits\n\nWritten to `PROCESS_RESOURCE_MAX_LOOP_COUNT`, `PROCESS_RESOURCE_MAX_ELAPSED_SECONDS`, and `PROCESS_RESOURCE_STATUS_CHANGE_WAIT_SECONDS` on the running scheduler Lambda.\n\n- `maxLoopCount` – Maximum describe/wait loop iterations per instance (default: **90**). Must be a positive integer when set.\n- `maxElapsedSeconds` – Maximum wall-clock seconds spent waiting for one instance to stabilize (default: **1800**, 30 minutes). Must be a positive integer when set.\n- `statusChangeWaitSeconds` – Seconds between describe iterations after start/stop or while transitioning (default: **20**). Must be a positive integer when set.\n\nWhen a limit is exceeded during waiting, the handler throws an error with prefix `ResourceWaitFailed:` (`MaxLoopCountExceeded`, `MaxElapsedTimeExceeded`, or `UnexpectedInstanceState` for unknown EC2 states).\n\n### RunningSchedulerRuntimeProps\n\nLambda invoke settings. Written `maxConcurrency` to `PROCESS_RESOURCES_MAX_CONCURRENCY`.\n\n- `memorySize` – Memory in MB (default: **512**). Must be a positive integer when set.\n- `timeout` – Lambda invoke timeout (default: **15 minutes**). AWS maximum is 15 minutes; durable waits continue under `durable.executionTimeout`.\n- `maxConcurrency` – Max instances processed in parallel (default: **10**). Must be a positive integer when set. Increase with instance count.\n\n### RunningSchedulerDurableProps\n\n- `executionTimeout` – Maximum durable execution duration (default: **2 hours**). Increase when many instances wait in sequence of batches.\n- `retentionPeriod` – Durable execution history retention (default: **1 day**).\n\n### RunningSchedulerLogGroupProps\n\n- `retention` – CloudWatch Logs retention (default: **`RetentionDays.THREE_MONTHS`**).\n- `removalPolicy` – Log group removal policy (default: **`RemovalPolicy.DESTROY`**).\n\n### RunningSchedulerFailureDetectionProps\n\nExtends `LambdaFailureDetection` (`enabled` / `alarmTopic`). Alarms are created only when `enabled` is `true`. Internally uses `LambdaFailureDetector` with scheduler-specific log filters. The construct does **not** create an SNS topic.\n\n- `enabled` – When `true`, creates four CloudWatch alarms and three log metric filters (default: disabled when omitted).\n- `alarmTopic` – Optional `sns.ITopic` for alarm actions. When omitted, alarms are created without SNS actions.\n\nWhen enabled:\n\n| Alarm | Trigger |\n|-------|---------|\n| Lambda errors | `AWS/Lambda` `Errors` metric (platform) |\n| Instance status failure | Log filter: `ResourceWaitFailed` |\n| Slack post failure | Log filter: `running-scheduler: Slack post failed` |\n| Durable execution failure | Other handler `ERROR` logs (excluding the above) |\n\nCustom metrics use the `EC2InstanceRunningScheduler` namespace. Access created alarms via `EC2InstanceRunningScheduler.failureDetection` when enabled.\n\n## API\n\nSee [API.md](./API.md).\n\n## Requirements\n\n- **Node.js** ≥ 20.0.0 (for developing or synthesizing CDK apps that depend on this package).\n- **aws-cdk-lib** ^2.232.0 and **constructs** ^10.5.1 (peer dependencies).\n- **AWS** – EventBridge Scheduler; Lambda with Durable Execution (Node.js **24.x** runtime in the construct); Parameters and Secrets Lambda Extension; EC2 (`DescribeInstances`, `StartInstances`, `StopInstances`); Resource Groups Tagging API (`tag:GetResources`); Secrets Manager.\n\n## License\n\nThis project is licensed under the (Apache-2.0) License.\n"
   },
   "repository": {
     "type": "git",
@@ -8475,11 +8475,102 @@
     }
   },
   "types": {
+    "ec2-instance-running-scheduler.CreateLambdaFailureDetectorProps": {
+      "assembly": "ec2-instance-running-scheduler",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Props accepted by {@link createLambdaFailureDetector}."
+      },
+      "fqn": "ec2-instance-running-scheduler.CreateLambdaFailureDetectorProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+        "line": 62
+      },
+      "name": "CreateLambdaFailureDetectorProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Lambda function to monitor."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 66
+          },
+          "name": "lambdaFunction",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.IFunction"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Application log group for log-based filters."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 68
+          },
+          "name": "logGroup",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_logs.ILogGroup"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "alarms are created only when {@link LambdaFailureDetection.enabled} is true.",
+            "stability": "stable",
+            "summary": "Opt-in options;"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 64
+          },
+          "name": "failureDetection",
+          "optional": true,
+          "type": {
+            "fqn": "ec2-instance-running-scheduler.LambdaFailureDetection"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "no log-based alarms",
+            "stability": "stable",
+            "summary": "Log-based failure filters."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 74
+          },
+          "name": "logFilters",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "ec2-instance-running-scheduler.LogFailureFilter"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/constructs/lambda-failure-detector/lambda-failure-detector:CreateLambdaFailureDetectorProps"
+    },
     "ec2-instance-running-scheduler.EC2InstanceRunningScheduleStack": {
       "assembly": "ec2-instance-running-scheduler",
       "base": "aws-cdk-lib.Stack",
       "docs": {
-        "remarks": "Wires {@link EC2InstanceRunningScheduler} with targeting, schedules, secrets, scheduling toggle,\nand optional {@link FailureDetectionAlarms}. Does not expose {@link ResourceWaitLimits },\n{@link RunningSchedulerRuntimeProps }, {@link RunningSchedulerDurableProps }, or\n{@link RunningSchedulerLogGroupProps }; use the construct directly when custom runtime,\nwait, durable, or log group settings are required.",
+        "remarks": "Wires {@link EC2InstanceRunningScheduler} with targeting, schedules, secrets, scheduling toggle,\nand optional {@link RunningSchedulerFailureDetectionProps}. Does not expose {@link ResourceWaitLimits },\n{@link RunningSchedulerRuntimeProps }, {@link RunningSchedulerDurableProps }, or\n{@link RunningSchedulerLogGroupProps }; use the construct directly when custom runtime,\nwait, durable, or log group settings are required.",
         "stability": "stable",
         "summary": "CDK stack that deploys the EC2 instance running scheduler (EventBridge Scheduler + Durable Lambda)."
       },
@@ -8614,7 +8705,7 @@
           "name": "failureDetection",
           "optional": true,
           "type": {
-            "fqn": "ec2-instance-running-scheduler.FailureDetectionAlarms"
+            "fqn": "ec2-instance-running-scheduler.RunningSchedulerFailureDetectionProps"
           }
         },
         {
@@ -8670,7 +8761,7 @@
         },
         "locationInModule": {
           "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-          "line": 323
+          "line": 333
         },
         "parameters": [
           {
@@ -8693,7 +8784,7 @@
           },
           {
             "docs": {
-              "summary": "- Target tags, schedules, Slack secret, schedule enable flag, optional {@link ResourceWaitLimits}, {@link RunningSchedulerRuntimeProps}, {@link RunningSchedulerDurableProps}, {@link RunningSchedulerLogGroupProps}, and optional {@link FailureDetectionAlarms}."
+              "summary": "- Target tags, schedules, Slack secret, schedule enable flag, optional {@link ResourceWaitLimits}, {@link RunningSchedulerRuntimeProps}, {@link RunningSchedulerDurableProps}, {@link RunningSchedulerLogGroupProps}, and optional {@link RunningSchedulerFailureDetectionProps}."
             },
             "name": "props",
             "type": {
@@ -8705,7 +8796,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 308
+        "line": 318
       },
       "name": "EC2InstanceRunningScheduler",
       "properties": [
@@ -8717,7 +8808,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 310
+            "line": 320
           },
           "name": "failureDetection",
           "optional": true,
@@ -8739,7 +8830,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 171
+        "line": 181
       },
       "name": "EC2InstanceRunningSchedulerProps",
       "properties": [
@@ -8752,7 +8843,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 177
+            "line": 187
           },
           "name": "secrets",
           "type": {
@@ -8768,7 +8859,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 173
+            "line": 183
           },
           "name": "targetResource",
           "type": {
@@ -8785,7 +8876,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 199
+            "line": 209
           },
           "name": "durable",
           "optional": true,
@@ -8803,7 +8894,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 175
+            "line": 185
           },
           "name": "enableScheduling",
           "optional": true,
@@ -8822,12 +8913,12 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 213
+            "line": 223
           },
           "name": "failureDetection",
           "optional": true,
           "type": {
-            "fqn": "ec2-instance-running-scheduler.FailureDetectionAlarms"
+            "fqn": "ec2-instance-running-scheduler.RunningSchedulerFailureDetectionProps"
           }
         },
         {
@@ -8840,7 +8931,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 205
+            "line": 215
           },
           "name": "logGroup",
           "optional": true,
@@ -8858,7 +8949,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 187
+            "line": 197
           },
           "name": "resourceWait",
           "optional": true,
@@ -8876,7 +8967,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 193
+            "line": 203
           },
           "name": "runtime",
           "optional": true,
@@ -8893,7 +8984,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 181
+            "line": 191
           },
           "name": "startSchedule",
           "optional": true,
@@ -8910,7 +9001,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 179
+            "line": 189
           },
           "name": "stopSchedule",
           "optional": true,
@@ -8921,21 +9012,21 @@
       ],
       "symbolId": "src/constructs/ec2-instance-running-scheduler:EC2InstanceRunningSchedulerProps"
     },
-    "ec2-instance-running-scheduler.FailureDetectionAlarms": {
+    "ec2-instance-running-scheduler.LambdaFailureDetection": {
       "assembly": "ec2-instance-running-scheduler",
       "datatype": true,
       "docs": {
-        "remarks": "When {@link FailureDetectionAlarms.enabled} is true, the construct creates alarms for Lambda\nerrors, Durable handler failures, EC2 instance status wait failures, and Slack post failures.\nAlarms can optionally notify an SNS topic supplied by the caller.",
+        "remarks": "When {@link LambdaFailureDetection.enabled} is true, alarms are created.\n{@link LambdaFailureDetection.alarmTopic} is optional; when omitted, alarms have no SNS actions.\nThe construct never creates an SNS topic.",
         "stability": "stable",
-        "summary": "Optional CloudWatch alarms and log-based metrics for operational failure detection."
+        "summary": "Opt-in options for {@link LambdaFailureDetector }."
       },
-      "fqn": "ec2-instance-running-scheduler.FailureDetectionAlarms",
+      "fqn": "ec2-instance-running-scheduler.LambdaFailureDetection",
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/constructs/running-scheduler-failure-detection.ts",
-        "line": 31
+        "filename": "src/constructs/lambda-failure-detector/lambda-failure-detection.ts",
+        "line": 10
       },
-      "name": "FailureDetectionAlarms",
+      "name": "LambdaFailureDetection",
       "properties": [
         {
           "abstract": true,
@@ -8946,8 +9037,8 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 43
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detection.ts",
+            "line": 22
           },
           "name": "alarmTopic",
           "optional": true,
@@ -8964,8 +9055,8 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 37
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detection.ts",
+            "line": 16
           },
           "name": "enabled",
           "optional": true,
@@ -8974,7 +9065,372 @@
           }
         }
       ],
-      "symbolId": "src/constructs/running-scheduler-failure-detection:FailureDetectionAlarms"
+      "symbolId": "src/constructs/lambda-failure-detector/lambda-failure-detection:LambdaFailureDetection"
+    },
+    "ec2-instance-running-scheduler.LambdaFailureDetector": {
+      "assembly": "ec2-instance-running-scheduler",
+      "base": "constructs.Construct",
+      "docs": {
+        "remarks": "Always creates a platform `AWS/Lambda` `Errors` alarm. Optionally creates one\nmetric filter + alarm per {@link LogFailureFilter}. Does not create an SNS topic;\npass {@link LambdaFailureDetectorProps.alarmTopic} to attach notifications.\n\nEntry module for `lambda-failure-detector/`: import types and helpers from this file only.",
+        "stability": "stable",
+        "summary": "CloudWatch failure detection for a Lambda function."
+      },
+      "fqn": "ec2-instance-running-scheduler.LambdaFailureDetector",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+          "line": 139
+        },
+        "parameters": [
+          {
+            "docs": {
+              "summary": "- Parent construct."
+            },
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "docs": {
+              "summary": "- Construct id."
+            },
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "docs": {
+              "summary": "- Lambda, log group, optional topic, and log filters."
+            },
+            "name": "props",
+            "type": {
+              "fqn": "ec2-instance-running-scheduler.LambdaFailureDetectorProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+        "line": 123
+      },
+      "methods": [
+        {
+          "docs": {
+            "returns": "Matching alarm, or undefined when the id was not in `logFilters`.",
+            "stability": "stable",
+            "summary": "Returns the log-filter alarm for the given filter id, or undefined when missing."
+          },
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 180
+          },
+          "name": "findLogFilterAlarm",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "- Same as {@link LogFailureFilter.id}."
+              },
+              "name": "id",
+              "type": {
+                "primitive": "string"
+              }
+            }
+          ],
+          "returns": {
+            "optional": true,
+            "type": {
+              "fqn": "aws-cdk-lib.aws_cloudwatch.Alarm"
+            }
+          }
+        }
+      ],
+      "name": "LambdaFailureDetector",
+      "properties": [
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "Fires when the Lambda `Errors` metric is non-zero."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 127
+          },
+          "name": "lambdaErrorsAlarm",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_cloudwatch.Alarm"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "Alarms for each log filter, in the same order as {@link LambdaFailureDetectorProps.logFilters}."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 132
+          },
+          "name": "logFilterAlarms",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "ec2-instance-running-scheduler.LogFailureAlarm"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "SNS topic used for alarm actions, when configured."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 125
+          },
+          "name": "alarmTopic",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_sns.ITopic"
+          }
+        }
+      ],
+      "symbolId": "src/constructs/lambda-failure-detector/lambda-failure-detector:LambdaFailureDetector"
+    },
+    "ec2-instance-running-scheduler.LambdaFailureDetectorProps": {
+      "assembly": "ec2-instance-running-scheduler",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Props for {@link LambdaFailureDetector}."
+      },
+      "fqn": "ec2-instance-running-scheduler.LambdaFailureDetectorProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+        "line": 40
+      },
+      "name": "LambdaFailureDetectorProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Lambda function whose platform `Errors` metric is alarmed."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 42
+          },
+          "name": "lambdaFunction",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.IFunction"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Log group used for {@link LogFailureFilter} metric filters."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 44
+          },
+          "name": "logGroup",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_logs.ILogGroup"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "When omitted, alarms are created without SNS actions.",
+            "stability": "stable",
+            "summary": "Optional SNS topic for all alarm actions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 50
+          },
+          "name": "alarmTopic",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_sns.ITopic"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "no log-based alarms",
+            "remarks": "Each entry creates a metric filter and alarm.",
+            "stability": "stable",
+            "summary": "Log-based failure filters."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 56
+          },
+          "name": "logFilters",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "ec2-instance-running-scheduler.LogFailureFilter"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/constructs/lambda-failure-detector/lambda-failure-detector:LambdaFailureDetectorProps"
+    },
+    "ec2-instance-running-scheduler.LogFailureAlarm": {
+      "assembly": "ec2-instance-running-scheduler",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Alarm created for one {@link LogFailureFilter}."
+      },
+      "fqn": "ec2-instance-running-scheduler.LogFailureAlarm",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+        "line": 30
+      },
+      "name": "LogFailureAlarm",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Alarm on the log metric filter sum."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 34
+          },
+          "name": "alarm",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_cloudwatch.Alarm"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Same as {@link LogFailureFilter.id}."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/lambda-failure-detector.ts",
+            "line": 32
+          },
+          "name": "id",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/constructs/lambda-failure-detector/lambda-failure-detector:LogFailureAlarm"
+    },
+    "ec2-instance-running-scheduler.LogFailureFilter": {
+      "assembly": "ec2-instance-running-scheduler",
+      "datatype": true,
+      "docs": {
+        "remarks": "Creates a CloudWatch Logs metric filter and an alarm on the resulting sum metric.",
+        "stability": "stable",
+        "summary": "One log-based failure signal for {@link LambdaFailureDetector }."
+      },
+      "fqn": "ec2-instance-running-scheduler.LogFailureFilter",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/constructs/lambda-failure-detector/log-failure-filter.ts",
+        "line": 6
+      },
+      "name": "LogFailureFilter",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "example": "'\"ResourceWaitFailed\"'",
+            "stability": "stable",
+            "summary": "CloudWatch Logs filter pattern string passed to `FilterPattern.literal`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/log-failure-filter.ts",
+            "line": 17
+          },
+          "name": "filterPattern",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Stable id used as the MetricFilter / Alarm construct id prefix (e.g. `InstanceStatusFailure` → `InstanceStatusFailureMetric`)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/log-failure-filter.ts",
+            "line": 11
+          },
+          "name": "id",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Custom metric name for the metric filter."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/log-failure-filter.ts",
+            "line": 21
+          },
+          "name": "metricName",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Custom metric namespace for the metric filter."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/constructs/lambda-failure-detector/log-failure-filter.ts",
+            "line": 19
+          },
+          "name": "metricNamespace",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/constructs/lambda-failure-detector/log-failure-filter:LogFailureFilter"
     },
     "ec2-instance-running-scheduler.ResourceWaitLimits": {
       "assembly": "ec2-instance-running-scheduler",
@@ -8989,7 +9445,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 77
+        "line": 87
       },
       "name": "ResourceWaitLimits",
       "properties": [
@@ -9003,7 +9459,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 89
+            "line": 99
           },
           "name": "maxElapsedSeconds",
           "optional": true,
@@ -9021,7 +9477,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 83
+            "line": 93
           },
           "name": "maxLoopCount",
           "optional": true,
@@ -9040,7 +9496,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 97
+            "line": 107
           },
           "name": "statusChangeWaitSeconds",
           "optional": true,
@@ -9062,7 +9518,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 133
+        "line": 143
       },
       "name": "RunningSchedulerDurableProps",
       "properties": [
@@ -9077,7 +9533,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 141
+            "line": 151
           },
           "name": "executionTimeout",
           "optional": true,
@@ -9095,7 +9551,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 147
+            "line": 157
           },
           "name": "retentionPeriod",
           "optional": true,
@@ -9108,11 +9564,11 @@
     },
     "ec2-instance-running-scheduler.RunningSchedulerFailureDetection": {
       "assembly": "ec2-instance-running-scheduler",
-      "base": "constructs.Construct",
+      "base": "ec2-instance-running-scheduler.LambdaFailureDetector",
       "docs": {
-        "remarks": "When enabled, creates four alarms:\n- `lambdaErrorsAlarm` – `AWS/Lambda` `Errors` metric.\n- `instanceStatusFailureAlarm` – log filter for `ResourceWaitFailed:*`.\n- `slackPostFailureAlarm` – log filter for `running-scheduler: Slack post failed`.\n- `durableExecutionFailureAlarm` – other handler-level `ERROR` logs (excluding the above).\n\nCustom metrics are published under the `EC2InstanceRunningScheduler` namespace.",
+        "remarks": "Extends {@link LambdaFailureDetector} with scheduler-specific log filters:\n- `lambdaErrorsAlarm` – `AWS/Lambda` `Errors` metric.\n- `instanceStatusFailureAlarm` – log filter for `ResourceWaitFailed:*`.\n- `slackPostFailureAlarm` – log filter for `running-scheduler: Slack post failed`.\n- `durableExecutionFailureAlarm` – other handler-level `ERROR` logs (excluding the above).\n\nCustom metrics are published under the `EC2InstanceRunningScheduler` namespace.",
         "stability": "stable",
-        "summary": "CloudWatch alarms and log-based metrics for the running scheduler Lambda."
+        "summary": "CloudWatch alarms and log-based metrics for the EC2 instance running scheduler."
       },
       "fqn": "ec2-instance-running-scheduler.RunningSchedulerFailureDetection",
       "initializer": {
@@ -9121,7 +9577,7 @@
         },
         "locationInModule": {
           "filename": "src/constructs/running-scheduler-failure-detection.ts",
-          "line": 132
+          "line": 123
         },
         "parameters": [
           {
@@ -9144,11 +9600,11 @@
           },
           {
             "docs": {
-              "summary": "- Lambda, log group, and {@link FailureDetectionAlarms} (must have `enabled: true`)."
+              "summary": "- Lambda, log group, and optional alarm notification topic."
             },
             "name": "props",
             "type": {
-              "fqn": "ec2-instance-running-scheduler.RunningSchedulerFailureDetectionProps"
+              "fqn": "ec2-instance-running-scheduler.RunningSchedulerFailureDetectionResourcesProps"
             }
           }
         ]
@@ -9156,7 +9612,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/constructs/running-scheduler-failure-detection.ts",
-        "line": 115
+        "line": 110
       },
       "name": "RunningSchedulerFailureDetection",
       "properties": [
@@ -9168,7 +9624,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 121
+            "line": 116
           },
           "name": "durableExecutionFailureAlarm",
           "type": {
@@ -9183,28 +9639,13 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 123
+            "line": 112
           },
           "name": "instanceStatusFailureAlarm",
           "type": {
             "fqn": "aws-cdk-lib.aws_cloudwatch.Alarm"
           }
         },
-        {
-          "docs": {
-            "stability": "stable",
-            "summary": "Fires when the Lambda `Errors` metric is non-zero."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 119
-          },
-          "name": "lambdaErrorsAlarm",
-          "type": {
-            "fqn": "aws-cdk-lib.aws_cloudwatch.Alarm"
-          }
-        },
         {
           "docs": {
             "stability": "stable",
@@ -9213,28 +9654,12 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 125
+            "line": 114
           },
           "name": "slackPostFailureAlarm",
           "type": {
             "fqn": "aws-cdk-lib.aws_cloudwatch.Alarm"
           }
-        },
-        {
-          "docs": {
-            "stability": "stable",
-            "summary": "SNS topic used for alarm actions, when configured."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 117
-          },
-          "name": "alarmTopic",
-          "optional": true,
-          "type": {
-            "fqn": "aws-cdk-lib.aws_sns.ITopic"
-          }
         }
       ],
       "symbolId": "src/constructs/running-scheduler-failure-detection:RunningSchedulerFailureDetection"
@@ -9243,67 +9668,86 @@
       "assembly": "ec2-instance-running-scheduler",
       "datatype": true,
       "docs": {
+        "remarks": "Pass as `EC2InstanceRunningSchedulerProps.failureDetection`. Extends\n{@link LambdaFailureDetection} (`enabled` / `alarmTopic`). Which log failures are\nmonitored is defined in this module and applied by {@link RunningSchedulerFailureDetection}.",
         "stability": "stable",
-        "summary": "Props for {@link RunningSchedulerFailureDetection}."
+        "summary": "Opt-in failure detection for `EC2InstanceRunningScheduler`."
       },
       "fqn": "ec2-instance-running-scheduler.RunningSchedulerFailureDetectionProps",
+      "interfaces": [
+        "ec2-instance-running-scheduler.LambdaFailureDetection"
+      ],
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/running-scheduler-failure-detection.ts",
-        "line": 49
+        "line": 65
       },
       "name": "RunningSchedulerFailureDetectionProps",
+      "symbolId": "src/constructs/running-scheduler-failure-detection:RunningSchedulerFailureDetectionProps"
+    },
+    "ec2-instance-running-scheduler.RunningSchedulerFailureDetectionResourcesProps": {
+      "assembly": "ec2-instance-running-scheduler",
+      "datatype": true,
+      "docs": {
+        "remarks": "Normally `EC2InstanceRunningScheduler` creates this binding. Use directly only when\ncomposing failure detection outside the scheduler construct.",
+        "stability": "stable",
+        "summary": "Lambda and log group monitored by {@link RunningSchedulerFailureDetection}."
+      },
+      "fqn": "ec2-instance-running-scheduler.RunningSchedulerFailureDetectionResourcesProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/constructs/running-scheduler-failure-detection.ts",
+        "line": 73
+      },
+      "name": "RunningSchedulerFailureDetectionResourcesProps",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "stability": "stable",
-            "summary": "Alarm configuration (must have {@link FailureDetectionAlarms.enabled} true)."
+            "stability": "stable"
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 51
+            "line": 76
           },
-          "name": "failureDetection",
+          "name": "logGroup",
           "type": {
-            "fqn": "ec2-instance-running-scheduler.FailureDetectionAlarms"
+            "fqn": "aws-cdk-lib.aws_logs.ILogGroup"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "stability": "stable",
-            "summary": "Application log group for the running scheduler Lambda."
+            "stability": "stable"
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 55
+            "line": 75
           },
-          "name": "logGroup",
+          "name": "runningScheduleFunction",
           "type": {
-            "fqn": "aws-cdk-lib.aws_logs.ILogGroup"
+            "fqn": "aws-cdk-lib.aws_lambda.IFunction"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "stability": "stable",
-            "summary": "Running scheduler Lambda to monitor."
+            "stability": "stable"
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/running-scheduler-failure-detection.ts",
-            "line": 53
+            "line": 74
           },
-          "name": "runningScheduleFunction",
+          "name": "alarmTopic",
+          "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.aws_lambda.IFunction"
+            "fqn": "aws-cdk-lib.aws_sns.ITopic"
           }
         }
       ],
-      "symbolId": "src/constructs/running-scheduler-failure-detection:RunningSchedulerFailureDetectionProps"
+      "symbolId": "src/constructs/running-scheduler-failure-detection:RunningSchedulerFailureDetectionResourcesProps"
     },
     "ec2-instance-running-scheduler.RunningSchedulerLogGroupProps": {
       "assembly": "ec2-instance-running-scheduler",
@@ -9316,7 +9760,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 153
+        "line": 163
       },
       "name": "RunningSchedulerLogGroupProps",
       "properties": [
@@ -9330,7 +9774,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 165
+            "line": 175
           },
           "name": "removalPolicy",
           "optional": true,
@@ -9348,7 +9792,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 159
+            "line": 169
           },
           "name": "retention",
           "optional": true,
@@ -9371,7 +9815,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 106
+        "line": 116
       },
       "name": "RunningSchedulerRuntimeProps",
       "properties": [
@@ -9385,7 +9829,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 127
+            "line": 137
           },
           "name": "maxConcurrency",
           "optional": true,
@@ -9403,7 +9847,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 112
+            "line": 122
           },
           "name": "memorySize",
           "optional": true,
@@ -9422,7 +9866,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 121
+            "line": 131
           },
           "name": "timeout",
           "optional": true,
@@ -9444,7 +9888,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 35
+        "line": 45
       },
       "name": "Schedule",
       "properties": [
@@ -9457,7 +9901,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 37
+            "line": 47
           },
           "name": "timezone",
           "type": {
@@ -9473,7 +9917,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 41
+            "line": 51
           },
           "name": "hour",
           "optional": true,
@@ -9490,7 +9934,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 39
+            "line": 49
           },
           "name": "minute",
           "optional": true,
@@ -9507,7 +9951,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 43
+            "line": 53
           },
           "name": "week",
           "optional": true,
@@ -9529,7 +9973,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 63
+        "line": 73
       },
       "name": "Secrets",
       "properties": [
@@ -9542,7 +9986,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 65
+            "line": 75
           },
           "name": "slackSecretName",
           "type": {
@@ -9564,7 +10008,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-        "line": 53
+        "line": 63
       },
       "name": "TargetResource",
       "properties": [
@@ -9577,7 +10021,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 55
+            "line": 65
           },
           "name": "tagKey",
           "type": {
@@ -9593,7 +10037,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/ec2-instance-running-scheduler.ts",
-            "line": 57
+            "line": 67
           },
           "name": "tagValues",
           "type": {
@@ -9609,6 +10053,6 @@
       "symbolId": "src/constructs/ec2-instance-running-scheduler:TargetResource"
     }
   },
-  "version": "0.4.5",
-  "fingerprint": "KIXp/hEBB6dvz2xnN1zwSYun+5pbMu1V1ZuljHen1j8="
+  "version": "0.5.0",
+  "fingerprint": "Y4AgVRtKrZ81hhbEaSnSXMSRTasWZAGCNvoEpY16slM="
 }