rds-database-auto-start-preventer 0.5.2 → 0.6.0

package/.jsii

@@ -8,7 +8,8 @@
   },
   "dependencies": {
     "aws-cdk-lib": "^2.232.0",
-    "constructs": "^10.5.1"
+    "constructs": "^10.5.1",
+    "lambda-failure-detector": "^0.2.3"
   },
   "dependencyClosure": {
     "@aws-cdk/asset-awscli-v1": {
@@ -8433,6 +8434,13 @@
           "module": "constructs"
         }
       }
+    },
+    "lambda-failure-detector": {
+      "targets": {
+        "js": {
+          "npm": "lambda-failure-detector"
+        }
+      }
     }
   },
   "description": "CDK construct library that stops RDS DB instances and clusters after they are auto-started by AWS (RDS-EVENT-0154 / RDS-EVENT-0153), using EventBridge and a Durable Lambda to filter by tags in the handler, stop matching available resources, and post to Slack only after a successful stop when a Slack secret name is set.",
@@ -8440,7 +8448,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer.git",
-  "jsiiVersion": "6.0.20 (build 338bb97)",
+  "jsiiVersion": "6.0.21 (build c0277eb)",
   "keywords": [
     "aws",
     "aws-cdk",
@@ -8459,7 +8467,7 @@
   },
   "name": "rds-database-auto-start-preventer",
   "readme": {
-    "markdown": "# RDS Database Auto Start Preventer (CDK v2)\n\n[![npm version](https://img.shields.io/npm/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![license](https://img.shields.io/npm/l/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![Node.js](https://img.shields.io/node/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![build](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/build.yml?label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/actions/workflows/build.yml)\n\n[![View on Construct Hub](https://constructs.dev/badge?package=rds-database-auto-start-preventer)](https://constructs.dev/packages/rds-database-auto-start-preventer)\n\nCDK construct library that stops RDS DB instances and clusters after they are auto-started by AWS (RDS-EVENT-0154 / RDS-EVENT-0153). It uses EventBridge rules and a Durable Lambda to detect auto-start events, filter resources by tags in the handler, stop matching resources when they are `available`, and post a Slack notification only when this Lambda invoked the stop API successfully and a Slack secret name is set.\n\n## Features\n\n- **EventBridge integration** – Listens for RDS DB Instance (RDS-EVENT-0154) and DB Cluster (RDS-EVENT-0153) auto-start events\n- **Handler-side tag filtering** – EventBridge rules match all auto-start events; the Lambda evaluates `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters`. Tag mismatch is a no-op (no StopDB*, no Slack)\n- **Durable Lambda** – Uses AWS Lambda Durable Execution for a long-running workflow (initial wait, status wait, stop, and post-stop wait) with a 2-hour execution timeout\n- **Least-privilege IAM** – Describe is scoped to account/region `db` / `cluster` ARNs; Stop is further limited by `aws:ResourceTag` matching `tagKey` / `tagValues` (no Resource Groups Tagging API)\n- **Slack notifications** – When `slackSecretName` is set, sends a message when this invocation called `StopDBInstance` / `StopDBCluster` and the resource reached `stopped` (no notification when the secret name is omitted, the resource was already stopped, or tags did not match)\n- **Optional rule toggle** – EventBridge rules can be enabled or disabled via `enableRule`\n\n## How it works\n\n1. EventBridge invokes the Durable Lambda with the RDS auto-start event and tag filter parameters (`tagKey`, `tagValues`).\n2. The handler waits **1 minute**, then calls DescribeDB* until the resource leaves transitional statuses. While the status stays transitional (or stopping after StopDB*), it waits up to **5 minutes** between describes.\n3. If the resource tag does not match, the handler exits as a **no-op** (no StopDB*, no Slack).\n4. If the resource is `available` and tags match, the handler calls StopDB* and waits until `stopped` (again using up to 5-minute intervals while transitional).\n5. If the resource is already `stopped` (for example, stopped by another process), the handler exits without calling StopDB* and without posting to Slack.\n6. When `slackSecretName` is set, Slack is notified only when StopDB* was invoked by this invocation and the resource reached `stopped`. When it is omitted, the handler does not post to Slack.\n\nTiming defaults (not configurable via props today):\n\n| Setting | Value |\n|---------|-------|\n| Initial wait before the first describe | 1 minute |\n| Wait between describes while status is transitional / stopping | up to 5 minutes |\n| Lambda invocation `timeout` | 15 minutes |\n| Durable `executionTimeout` | 2 hours |\n| Durable history `retentionPeriod` | 1 day |\n\nTag the RDS instances or clusters you want to protect (for example, `AutoStartPrevent=YES`). Resources without a matching tag are left running (no-op).\n\n## Installation\n\n### npm\n\n```bash\nnpm install rds-database-auto-start-preventer\n```\n\n### yarn\n\n```bash\nyarn add rds-database-auto-start-preventer\n```\n\n### pnpm\n\n```bash\npnpm add rds-database-auto-start-preventer\n```\n\n## Usage\n\n### Minimal deployable app\n\nUse `RDSDatabaseAutoStartPreventStack` when you want a dedicated stack you can deploy as-is. Put this in your CDK app entry (for example `bin/app.ts`), then deploy.\n\n```typescript\nimport { App } from 'aws-cdk-lib';\nimport { RDSDatabaseAutoStartPreventStack } from 'rds-database-auto-start-preventer';\n\nconst app = new App();\n\nnew RDSDatabaseAutoStartPreventStack(app, 'RDSDatabaseAutoStartPreventStack', {\n  env: {\n    account: process.env.CDK_DEFAULT_ACCOUNT,\n    region: process.env.CDK_DEFAULT_REGION,\n  },\n  stackName: 'rds-database-auto-start-prevent',\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  // Omit slackSecretName to skip Slack; set it when stop should notify Slack.\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n\napp.synth();\n```\n\nDeploy checklist:\n\n1. Install this package and peers (`aws-cdk-lib`, `constructs`) in your CDK app.\n2. Tag the RDS instances or clusters to protect (for example `AutoStartPrevent=YES`).\n3. Optional: create the Secrets Manager secret described in [Slack secret](#slack-secret-aws-secrets-manager). Omit `slackSecretName` if you do not need Slack.\n4. From the CDK app: `npx cdk deploy RDSDatabaseAutoStartPreventStack`\n\n### Construct in an existing stack\n\nUse `RDSDatabaseAutoStartPreventer` when you want to add auto-start prevention to an existing stack or compose it with other constructs. Omit `slackSecretName` to stop matching resources without Slack.\n\n```typescript\nimport { App, Stack } from 'aws-cdk-lib';\nimport { RDSDatabaseAutoStartPreventer } from 'rds-database-auto-start-preventer';\n\nconst app = new App();\nconst stack = new Stack(app, 'MyStack');\n\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  secrets: {},\n});\n```\n\nPass `slackSecretName` when a successful stop should post to Slack. `enableRule` defaults to `true`.\n\n```typescript\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  enableRule: true,\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n```\n\n### Slack secret (AWS Secrets Manager)\n\nCreate the secret **before** deploy when you want Slack notifications. Omit `slackSecretName` to skip Slack entirely (no secret and no Secrets Manager IAM are required in that case).\n\nStore a JSON object in AWS Secrets Manager with the Slack Bot Token and channel ID:\n\n| Key | Value |\n|-----|-------|\n| `token` | Slack Bot Token (e.g. `xoxb-...`) |\n| `channel` | Slack channel ID (e.g. `C01234ABCD`) |\n\nExample secret value:\n\n```json\n{\n  \"token\": \"xoxb-...\",\n  \"channel\": \"C01234ABCD\"\n}\n```\n\nWhen `slackSecretName` is set, the construct grants the Lambda role read access to that secret and attaches the AWS Parameters and Secrets Extension. You do not need to add a separate Secrets Manager policy yourself for this secret.\n\n## Options\n\n| Option | Type | Required | Description |\n|--------|------|----------|-------------|\n| `targetResource` | `TargetResource` | Yes | Tag-based criteria evaluated in the Lambda handler. |\n| `targetResource.tagKey` | `string` | Yes | Tag key to match (e.g. `AutoStartPrevent`, `Environment`). |\n| `targetResource.tagValues` | `string[]` | Yes | Tag values that indicate the resource should be stopped (e.g. `['YES']`, `['production']`). |\n| `enableRule` | `boolean` | No | Whether the EventBridge rules are enabled. Defaults to `true` if omitted. |\n| `secrets` | `Secrets` | Yes | External secrets for notifications. |\n| `secrets.slackSecretName` | `string` | No | Name of the Secrets Manager secret containing Slack `token` and `channel`. Omit it to skip Slack notifications. |\n\nEmpty `tagKey`, an empty `tagValues` array (or blank entries), and a blank `slackSecretName` fail at synthesis. Omitting `slackSecretName` is allowed. Unresolved CDK tokens are not checked.\n\n## API\n\nSee [API.md](./API.md).\n\n## Requirements\n\n- **Node.js** >= 20.0.0 (for your CDK app)\n- **AWS CDK** ^2.232.0\n- **constructs** ^10.5.1\n- **AWS Lambda** runtime Node.js 24.x with Durable Execution (deployed by the construct)\n\n## Notes\n\n- **Aurora / dual events:** An Aurora auto-start can emit both a DB cluster event (`RDS-EVENT-0153`) and DB instance event(s) (`RDS-EVENT-0154`). This package listens for both and may run separate Durable executions. Tag mismatch remains a no-op; if the resource is already `stopped`, the handler does not call StopDB* and does not post to Slack.\n- **IAM:** RDS Describe is limited to account/region `db` / `cluster` ARNs. Stop requires a matching `aws:ResourceTag` for your `tagKey` / `tagValues`. Slack secret read is granted only when `slackSecretName` is set.\n\n## Troubleshooting\n\n- **CloudWatch Logs:** The construct creates a dedicated Log Group for the Durable Lambda (JSON logs, 3-month retention). After a successful create, the log group uses `RetainExceptOnCreate` so it remains available for incident review after stack delete or replace.\n- **Nothing stopped / no Slack:** Confirm the resource tag matches `tagKey` / `tagValues`. Mismatch is intentional no-op with no Slack message.\n- **Stop attempted but Slack missing:** Slack runs only when this invocation called StopDB* and the resource reached `stopped`, and only when `slackSecretName` is set. Already-stopped resources skip Slack.\n- **Secret errors:** Ensure the secret exists before deploy, JSON has non-empty `token` and `channel`, and the name passed as `slackSecretName` matches Secrets Manager.\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
+    "markdown": "# RDS Database Auto Start Preventer (CDK v2)\n\n[![npm version](https://img.shields.io/npm/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![license](https://img.shields.io/npm/l/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![Node.js](https://img.shields.io/node/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![build](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/build.yml?label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/actions/workflows/build.yml)\n\n[![View on Construct Hub](https://constructs.dev/badge?package=rds-database-auto-start-preventer)](https://constructs.dev/packages/rds-database-auto-start-preventer)\n\nCDK construct library that stops RDS DB instances and clusters after they are auto-started by AWS (RDS-EVENT-0154 / RDS-EVENT-0153). It uses EventBridge rules and a Durable Lambda to detect auto-start events, filter resources by tags in the handler, stop matching resources when they are `available`, and post a Slack notification only when this Lambda invoked the stop API successfully and a Slack secret name is set.\n\n## Features\n\n- **EventBridge integration** – Listens for RDS DB Instance (RDS-EVENT-0154) and DB Cluster (RDS-EVENT-0153) auto-start events\n- **Handler-side tag filtering** – EventBridge rules match all auto-start events; the Lambda evaluates `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters`. Tag mismatch is a no-op (no StopDB*, no Slack)\n- **Durable Lambda** – Uses AWS Lambda Durable Execution for a long-running workflow (initial wait, status wait, stop, and post-stop wait) with a 2-hour execution timeout\n- **Least-privilege IAM** – Describe is scoped to account/region `db` / `cluster` ARNs; Stop is further limited by `aws:ResourceTag` matching `tagKey` / `tagValues` (no Resource Groups Tagging API)\n- **Slack notifications** – When `slackSecretName` is set, sends a message when this invocation called `StopDBInstance` / `StopDBCluster` and the resource reached `stopped` (no notification when the secret name is omitted, the resource was already stopped, or tags did not match)\n- **Optional rule toggle** – EventBridge rules can be enabled or disabled via `enableRule`\n- **Optional failure detection** – With `failureDetection.enabled`, creates CloudWatch alarms for Lambda errors, throttles, and failed executions, notifying an existing SNS topic when one is passed\n\n## How it works\n\n1. EventBridge invokes the Durable Lambda with the RDS auto-start event and tag filter parameters (`tagKey`, `tagValues`).\n2. The handler waits **1 minute**, then calls DescribeDB* until the resource leaves transitional statuses. While the status stays transitional (or stopping after StopDB*), it waits up to **5 minutes** between describes.\n3. If the resource tag does not match, the handler exits as a **no-op** (no StopDB*, no Slack).\n4. If the resource is `available` and tags match, the handler calls StopDB* and waits until `stopped` (again using up to 5-minute intervals while transitional).\n5. If the resource is already `stopped` (for example, stopped by another process), the handler exits without calling StopDB* and without posting to Slack.\n6. When `slackSecretName` is set, Slack is notified only when StopDB* was invoked by this invocation and the resource reached `stopped`. When it is omitted, the handler does not post to Slack.\n7. If the execution fails (invalid input or Slack secret, unexpected RDS status, stop not reaching `stopped`, or Slack post failure), the handler logs `AutoStartPreventFailed` with the DB identifier and error message, and the durable execution ends as failed. With `failureDetection.enabled`, this log raises a CloudWatch alarm.\n\nTiming defaults (not configurable via props today):\n\n| Setting | Value |\n|---------|-------|\n| Initial wait before the first describe | 1 minute |\n| Wait between describes while status is transitional / stopping | up to 5 minutes |\n| Lambda invocation `timeout` | 3 minutes |\n| Durable `executionTimeout` | 2 hours |\n| Durable history `retentionPeriod` | 1 day |\n\nTag the RDS instances or clusters you want to protect (for example, `AutoStartPrevent=YES`). Resources without a matching tag are left running (no-op).\n\n## Installation\n\n### npm\n\n```bash\nnpm install rds-database-auto-start-preventer\n```\n\n### yarn\n\n```bash\nyarn add rds-database-auto-start-preventer\n```\n\n### pnpm\n\n```bash\npnpm add rds-database-auto-start-preventer\n```\n\n## Usage\n\n### Minimal deployable app\n\nUse `RDSDatabaseAutoStartPreventStack` when you want a dedicated stack you can deploy as-is. Put this in your CDK app entry (for example `bin/app.ts`), then deploy.\n\n```typescript\nimport { App } from 'aws-cdk-lib';\nimport { RDSDatabaseAutoStartPreventStack } from 'rds-database-auto-start-preventer';\n\nconst app = new App();\n\nnew RDSDatabaseAutoStartPreventStack(app, 'RDSDatabaseAutoStartPreventStack', {\n  env: {\n    account: process.env.CDK_DEFAULT_ACCOUNT,\n    region: process.env.CDK_DEFAULT_REGION,\n  },\n  stackName: 'rds-database-auto-start-prevent',\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  // Omit slackSecretName to skip Slack; set it when stop should notify Slack.\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n\napp.synth();\n```\n\nDeploy checklist:\n\n1. Install this package and peers (`aws-cdk-lib`, `constructs`, `lambda-failure-detector`) in your CDK app.\n2. Tag the RDS instances or clusters to protect (for example `AutoStartPrevent=YES`).\n3. Optional: create the Secrets Manager secret described in [Slack secret](#slack-secret-aws-secrets-manager). Omit `slackSecretName` if you do not need Slack.\n4. From the CDK app: `npx cdk deploy RDSDatabaseAutoStartPreventStack`\n\n### Construct in an existing stack\n\nUse `RDSDatabaseAutoStartPreventer` when you want to add auto-start prevention to an existing stack or compose it with other constructs. Omit `slackSecretName` to stop matching resources without Slack.\n\n```typescript\nimport { App, Stack } from 'aws-cdk-lib';\nimport { RDSDatabaseAutoStartPreventer } from 'rds-database-auto-start-preventer';\n\nconst app = new App();\nconst stack = new Stack(app, 'MyStack');\n\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  secrets: {},\n});\n```\n\nPass `slackSecretName` when a successful stop should post to Slack. `enableRule` defaults to `true`.\n\n```typescript\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  enableRule: true,\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n```\n\n### Failure detection (CloudWatch alarms)\n\nFailure detection is off by default. Set `failureDetection.enabled` to `true` to create the alarms. The construct does not create an SNS topic: pass an existing topic as `alarmTopic` to receive notifications, or omit it to create alarms without actions.\n\n```typescript\nimport { Topic } from 'aws-cdk-lib/aws-sns';\n\nconst alarmTopic = new Topic(stack, 'AlarmTopic');\n\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  secrets: {},\n  failureDetection: {\n    enabled: true,\n    alarmTopic,\n  },\n});\n```\n\nAlarms created when enabled (threshold 1 in a 5-minute period):\n\n| Alarm | Metric | Fires when |\n|-------|--------|------------|\n| Lambda errors | `AWS/Lambda` `Errors` | An invocation fails at the platform level (for example a crash or invocation timeout). |\n| Lambda throttles | `AWS/Lambda` `Throttles` | An invocation is throttled. |\n| Failed execution | `RDSDatabaseAutoStartPreventer` `AutoStartPreventFailed` | The handler logs `AutoStartPreventFailed` because the durable execution failed (invalid input or Slack secret, unexpected RDS status, stop not reaching `stopped`, or Slack post failure after retries). |\n\n### Slack secret (AWS Secrets Manager)\n\nCreate the secret **before** deploy when you want Slack notifications. Omit `slackSecretName` to skip Slack entirely (no secret and no Secrets Manager IAM are required in that case).\n\nStore a JSON object in AWS Secrets Manager with the Slack Bot Token and channel ID:\n\n| Key | Value |\n|-----|-------|\n| `token` | Slack Bot Token (e.g. `xoxb-...`) |\n| `channel` | Slack channel ID (e.g. `C01234ABCD`) |\n\nExample secret value:\n\n```json\n{\n  \"token\": \"xoxb-...\",\n  \"channel\": \"C01234ABCD\"\n}\n```\n\nWhen `slackSecretName` is set, the construct grants the Lambda role read access to that secret and attaches the AWS Parameters and Secrets Extension. You do not need to add a separate Secrets Manager policy yourself for this secret.\n\n## Options\n\n| Option | Type | Required | Description |\n|--------|------|----------|-------------|\n| `targetResource` | `TargetResource` | Yes | Tag-based criteria evaluated in the Lambda handler. |\n| `targetResource.tagKey` | `string` | Yes | Tag key to match (e.g. `AutoStartPrevent`, `Environment`). |\n| `targetResource.tagValues` | `string[]` | Yes | Tag values that indicate the resource should be stopped (e.g. `['YES']`, `['production']`). |\n| `enableRule` | `boolean` | No | Whether the EventBridge rules are enabled. Defaults to `true` if omitted. |\n| `secrets` | `Secrets` | Yes | External secrets for notifications. |\n| `secrets.slackSecretName` | `string` | No | Name of the Secrets Manager secret containing Slack `token` and `channel`. Omit it to skip Slack notifications. |\n| `failureDetection` | `AutoStartPreventFailureDetectionProps` | No | CloudWatch failure detection for the Lambda. No alarms when omitted. |\n| `failureDetection.enabled` | `boolean` | No | Creates the failure alarms only when `true`. |\n| `failureDetection.alarmTopic` | `ITopic` | No | Existing SNS topic notified by every alarm. Alarms have no actions when omitted. |\n\nEmpty `tagKey`, an empty `tagValues` array (or blank entries), and a blank `slackSecretName` fail at synthesis. Omitting `slackSecretName` is allowed. Unresolved CDK tokens are not checked.\n\n## API\n\nSee [API.md](./API.md).\n\n## Requirements\n\n- **Node.js** >= 20.0.0 (for your CDK app)\n- **AWS CDK** ^2.232.0\n- **constructs** ^10.5.1\n- **lambda-failure-detector** ^0.2.3 (peer dependency, used for `failureDetection`)\n- **AWS Lambda** runtime Node.js 24.x with Durable Execution (deployed by the construct)\n\n## Notes\n\n- **Aurora / dual events:** An Aurora auto-start can emit both a DB cluster event (`RDS-EVENT-0153`) and DB instance event(s) (`RDS-EVENT-0154`). This package listens for both and may run separate Durable executions. Tag mismatch remains a no-op; if the resource is already `stopped`, the handler does not call StopDB* and does not post to Slack.\n- **IAM:** RDS Describe is limited to account/region `db` / `cluster` ARNs. Stop requires a matching `aws:ResourceTag` for your `tagKey` / `tagValues`. Slack secret read is granted only when `slackSecretName` is set.\n- **Failure alarms:** A failed durable execution ends the invocation normally, so it does not raise the Lambda `Errors` metric. The `AutoStartPreventFailed` log alarm covers those failures. The log line contains the DB identifier and error message, never the Slack token or channel.\n\n## Troubleshooting\n\n- **CloudWatch Logs:** The construct creates a dedicated Log Group for the Durable Lambda (JSON logs, 3-month retention). After a successful create, the log group uses `RetainExceptOnCreate` so it remains available for incident review after stack delete or replace.\n- **Nothing stopped / no Slack:** Confirm the resource tag matches `tagKey` / `tagValues`. Mismatch is intentional no-op with no Slack message.\n- **Stop attempted but Slack missing:** Slack runs only when this invocation called StopDB* and the resource reached `stopped`, and only when `slackSecretName` is set. Already-stopped resources skip Slack.\n- **`AutoStartPreventFailed` alarm:** Search the Lambda log group for `AutoStartPreventFailed` to find the DB identifier and error message of the failed execution.\n- **Secret errors:** Ensure the secret exists before deploy, JSON has non-empty `token` and `channel`, and the name passed as `slackSecretName` matches Secrets Manager.\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
   },
   "repository": {
     "type": "git",
@@ -8472,6 +8480,26 @@
     }
   },
   "types": {
+    "rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps": {
+      "assembly": "rds-database-auto-start-preventer",
+      "datatype": true,
+      "docs": {
+        "remarks": "When `enabled` is true, creates alarms on the Lambda `Errors` and `Throttles` metrics and on\nfailed executions logged by the handler (custom metric `RDSDatabaseAutoStartPreventer` / `AutoStartPreventFailed`).\nNo SNS topic is created; alarms notify `alarmTopic` only when it is set.",
+        "stability": "stable",
+        "summary": "Opt-in CloudWatch failure detection for the auto-start prevent Lambda."
+      },
+      "fqn": "rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps",
+      "interfaces": [
+        "lambda-failure-detector.LambdaFailureDetection"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/rds-database-auto-start-preventer.ts",
+        "line": 70
+      },
+      "name": "AutoStartPreventFailureDetectionProps",
+      "symbolId": "src/rds-database-auto-start-preventer:AutoStartPreventFailureDetectionProps"
+    },
     "rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStack": {
       "assembly": "rds-database-auto-start-preventer",
       "base": "aws-cdk-lib.Stack",
@@ -8510,7 +8538,7 @@
           },
           {
             "docs": {
-              "summary": "- Stack props (target resource, enable rule, secrets)."
+              "summary": "- Stack props (target resource, enable rule, secrets, failure detection)."
             },
             "name": "props",
             "type": {
@@ -8551,7 +8579,7 @@
       "assembly": "rds-database-auto-start-preventer",
       "base": "constructs.Construct",
       "docs": {
-        "remarks": "EventBridge rules match all auto-start events; tag filtering runs in the handler\nusing `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters`.\nIAM grants account/region-scoped describe on `db` / `cluster` ARNs, and stop only\nwhen `aws:ResourceTag` matches {@link TargetResource} (no Resource Groups Tagging API).",
+        "remarks": "EventBridge rules match all auto-start events; tag filtering runs in the handler\nusing `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters`.\nIAM grants account/region-scoped describe on `db` / `cluster` ARNs, and stop only\nwhen `aws:ResourceTag` matches {@link TargetResource} (no Resource Groups Tagging API).\nCloudWatch failure alarms are created only when\n{@link RDSDatabaseAutoStartPreventerProps.failureDetection} is enabled.",
         "stability": "stable",
         "summary": "Deploys EventBridge rules and a Durable Lambda to stop matching RDS resources after auto-start events (RDS-EVENT-0154 / RDS-EVENT-0153)."
       },
@@ -8563,11 +8591,11 @@
           },
           "remarks": "The Lambda receives `{ event, params }` where `params` carries `tagKey` and `tagValues`\nfrom {@link RDSDatabaseAutoStartPreventerProps.targetResource}. Tag filters are passed\nonly via that payload (not via `TAG_KEY` / `TAG_VALUES` environment variables).",
           "stability": "stable",
-          "summary": "Creates the Durable Lambda, EventBridge rules, and IAM policies."
+          "summary": "Creates the Durable Lambda, EventBridge rules, IAM policies, and optional failure alarms."
         },
         "locationInModule": {
           "filename": "src/rds-database-auto-start-preventer.ts",
-          "line": 104
+          "line": 149
         },
         "parameters": [
           {
@@ -8602,7 +8630,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/rds-database-auto-start-preventer.ts",
-        "line": 90
+        "line": 135
       },
       "name": "RDSDatabaseAutoStartPreventer",
       "symbolId": "src/rds-database-auto-start-preventer:RDSDatabaseAutoStartPreventer"
@@ -8618,7 +8646,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/rds-database-auto-start-preventer.ts",
-        "line": 38
+        "line": 75
       },
       "name": "RDSDatabaseAutoStartPreventerProps",
       "properties": [
@@ -8631,7 +8659,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/rds-database-auto-start-preventer.ts",
-            "line": 44
+            "line": 81
           },
           "name": "secrets",
           "type": {
@@ -8647,7 +8675,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/rds-database-auto-start-preventer.ts",
-            "line": 40
+            "line": 77
           },
           "name": "targetResource",
           "type": {
@@ -8664,13 +8692,31 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/rds-database-auto-start-preventer.ts",
-            "line": 42
+            "line": 79
           },
           "name": "enableRule",
           "optional": true,
           "type": {
             "primitive": "boolean"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "no alarms",
+            "stability": "stable",
+            "summary": "CloudWatch failure detection for the Lambda."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/rds-database-auto-start-preventer.ts",
+            "line": 87
+          },
+          "name": "failureDetection",
+          "optional": true,
+          "type": {
+            "fqn": "rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps"
+          }
         }
       ],
       "symbolId": "src/rds-database-auto-start-preventer:RDSDatabaseAutoStartPreventerProps"
@@ -8686,7 +8732,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/rds-database-auto-start-preventer.ts",
-        "line": 27
+        "line": 55
       },
       "name": "Secrets",
       "properties": [
@@ -8700,7 +8746,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/rds-database-auto-start-preventer.ts",
-            "line": 32
+            "line": 60
           },
           "name": "slackSecretName",
           "optional": true,
@@ -8723,7 +8769,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/rds-database-auto-start-preventer.ts",
-        "line": 16
+        "line": 44
       },
       "name": "TargetResource",
       "properties": [
@@ -8736,7 +8782,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/rds-database-auto-start-preventer.ts",
-            "line": 18
+            "line": 46
           },
           "name": "tagKey",
           "type": {
@@ -8752,7 +8798,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/rds-database-auto-start-preventer.ts",
-            "line": 20
+            "line": 48
           },
           "name": "tagValues",
           "type": {
@@ -8768,6 +8814,6 @@
       "symbolId": "src/rds-database-auto-start-preventer:TargetResource"
     }
   },
-  "version": "0.5.2",
-  "fingerprint": "0FwdzwVdNrix/Y2jPnJWrHvGDaWQCJen6/MNkxiiIsM="
+  "version": "0.6.0",
+  "fingerprint": "tCB64hT1n6oAbF9gHEPApTXJCuBCu/bOu/Q4ScG9SGc="
 }

package/API.md

@@ -10,6 +10,8 @@ EventBridge rules match all auto-start events; tag filtering runs in the handler
 using `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters`.
 IAM grants account/region-scoped describe on `db` / `cluster` ARNs, and stop only
 when `aws:ResourceTag` matches {@link TargetResource} (no Resource Groups Tagging API).
+CloudWatch failure alarms are created only when
+{@link RDSDatabaseAutoStartPreventerProps.failureDetection} is enabled.
 
 #### Initializers <a name="Initializers" id="rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventer.Initializer"></a>
 
@@ -166,7 +168,7 @@ new RDSDatabaseAutoStartPreventStack(scope: Construct, id: string, props: RDSDat
 | --- | --- | --- |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStack.Initializer.parameter.scope">scope</a></code> | <code>constructs.Construct</code> | - Parent construct. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStack.Initializer.parameter.id">id</a></code> | <code>string</code> | - Stack id. |
-| <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStack.Initializer.parameter.props">props</a></code> | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps">RDSDatabaseAutoStartPreventStackProps</a></code> | - Stack props (target resource, enable rule, secrets). |
+| <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStack.Initializer.parameter.props">props</a></code> | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps">RDSDatabaseAutoStartPreventStackProps</a></code> | - Stack props (target resource, enable rule, secrets, failure detection). |
 
 ---
 
@@ -190,7 +192,7 @@ Stack id.
 
 - *Type:* <a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps">RDSDatabaseAutoStartPreventStackProps</a>
 
-Stack props (target resource, enable rule, secrets).
+Stack props (target resource, enable rule, secrets, failure detection).
 
 ---
 
@@ -1109,6 +1111,58 @@ Whether termination protection is enabled for this stack.
 
 ## Structs <a name="Structs" id="Structs"></a>
 
+### AutoStartPreventFailureDetectionProps <a name="AutoStartPreventFailureDetectionProps" id="rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps"></a>
+
+Opt-in CloudWatch failure detection for the auto-start prevent Lambda.
+
+When `enabled` is true, creates alarms on the Lambda `Errors` and `Throttles` metrics and on
+failed executions logged by the handler (custom metric `RDSDatabaseAutoStartPreventer` / `AutoStartPreventFailed`).
+No SNS topic is created; alarms notify `alarmTopic` only when it is set.
+
+#### Initializer <a name="Initializer" id="rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps.Initializer"></a>
+
+```typescript
+import { AutoStartPreventFailureDetectionProps } from 'rds-database-auto-start-preventer'
+
+const autoStartPreventFailureDetectionProps: AutoStartPreventFailureDetectionProps = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps.property.alarmTopic">alarmTopic</a></code> | <code>aws-cdk-lib.aws_sns.ITopic</code> | SNS topic for alarm notifications. |
+| <code><a href="#rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps.property.enabled">enabled</a></code> | <code>boolean</code> | When true, creates failure detection alarms and log-based metrics. |
+
+---
+
+##### `alarmTopic`<sup>Optional</sup> <a name="alarmTopic" id="rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps.property.alarmTopic"></a>
+
+```typescript
+public readonly alarmTopic: ITopic;
+```
+
+- *Type:* aws-cdk-lib.aws_sns.ITopic
+
+SNS topic for alarm notifications.
+
+When omitted, alarms are created without SNS actions.
+
+---
+
+##### `enabled`<sup>Optional</sup> <a name="enabled" id="rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps.property.enabled"></a>
+
+```typescript
+public readonly enabled: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false when omitted
+
+When true, creates failure detection alarms and log-based metrics.
+
+---
+
 ### RDSDatabaseAutoStartPreventerProps <a name="RDSDatabaseAutoStartPreventerProps" id="rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventerProps"></a>
 
 Props for the RDS database auto-start preventer construct.
@@ -1128,6 +1182,7 @@ const rDSDatabaseAutoStartPreventerProps: RDSDatabaseAutoStartPreventerProps = {
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventerProps.property.secrets">secrets</a></code> | <code><a href="#rds-database-auto-start-preventer.Secrets">Secrets</a></code> | Secrets used for notifications (e.g. Slack). |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventerProps.property.targetResource">targetResource</a></code> | <code><a href="#rds-database-auto-start-preventer.TargetResource">TargetResource</a></code> | Tag-based target resource criteria for RDS instances/clusters to protect. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventerProps.property.enableRule">enableRule</a></code> | <code>boolean</code> | Whether the EventBridge rules are enabled. |
+| <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventerProps.property.failureDetection">failureDetection</a></code> | <code><a href="#rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps">AutoStartPreventFailureDetectionProps</a></code> | CloudWatch failure detection for the Lambda. |
 
 ---
 
@@ -1169,6 +1224,19 @@ Defaults to true if omitted.
 
 ---
 
+##### `failureDetection`<sup>Optional</sup> <a name="failureDetection" id="rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventerProps.property.failureDetection"></a>
+
+```typescript
+public readonly failureDetection: AutoStartPreventFailureDetectionProps;
+```
+
+- *Type:* <a href="#rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps">AutoStartPreventFailureDetectionProps</a>
+- *Default:* no alarms
+
+CloudWatch failure detection for the Lambda.
+
+---
+
 ### RDSDatabaseAutoStartPreventStackProps <a name="RDSDatabaseAutoStartPreventStackProps" id="rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps"></a>
 
 Props for the RDS database auto start prevent CDK stack.
@@ -1188,6 +1256,7 @@ const rDSDatabaseAutoStartPreventStackProps: RDSDatabaseAutoStartPreventStackPro
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.secrets">secrets</a></code> | <code><a href="#rds-database-auto-start-preventer.Secrets">Secrets</a></code> | Secrets used for notifications (e.g. Slack). |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.targetResource">targetResource</a></code> | <code><a href="#rds-database-auto-start-preventer.TargetResource">TargetResource</a></code> | Tag-based target resource criteria for RDS instances/clusters to protect. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.enableRule">enableRule</a></code> | <code>boolean</code> | Whether the EventBridge rules are enabled. |
+| <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.failureDetection">failureDetection</a></code> | <code><a href="#rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps">AutoStartPreventFailureDetectionProps</a></code> | CloudWatch failure detection for the Lambda. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.analyticsReporting">analyticsReporting</a></code> | <code>boolean</code> | Include runtime versioning information in this Stack. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.crossRegionReferences">crossRegionReferences</a></code> | <code>boolean</code> | Enable this flag to allow native cross region stack references. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.description">description</a></code> | <code>string</code> | A description of the stack. |
@@ -1241,6 +1310,19 @@ Defaults to true if omitted.
 
 ---
 
+##### `failureDetection`<sup>Optional</sup> <a name="failureDetection" id="rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.failureDetection"></a>
+
+```typescript
+public readonly failureDetection: AutoStartPreventFailureDetectionProps;
+```
+
+- *Type:* <a href="#rds-database-auto-start-preventer.AutoStartPreventFailureDetectionProps">AutoStartPreventFailureDetectionProps</a>
+- *Default:* no alarms
+
+CloudWatch failure detection for the Lambda.
+
+---
+
 ##### `analyticsReporting`<sup>Optional</sup> <a name="analyticsReporting" id="rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.analyticsReporting"></a>
 
 ```typescript

package/README.md

@@ -17,6 +17,7 @@ CDK construct library that stops RDS DB instances and clusters after they are au
 - **Least-privilege IAM** – Describe is scoped to account/region `db` / `cluster` ARNs; Stop is further limited by `aws:ResourceTag` matching `tagKey` / `tagValues` (no Resource Groups Tagging API)
 - **Slack notifications** – When `slackSecretName` is set, sends a message when this invocation called `StopDBInstance` / `StopDBCluster` and the resource reached `stopped` (no notification when the secret name is omitted, the resource was already stopped, or tags did not match)
 - **Optional rule toggle** – EventBridge rules can be enabled or disabled via `enableRule`
+- **Optional failure detection** – With `failureDetection.enabled`, creates CloudWatch alarms for Lambda errors, throttles, and failed executions, notifying an existing SNS topic when one is passed
 
 ## How it works
 
@@ -26,6 +27,7 @@ CDK construct library that stops RDS DB instances and clusters after they are au
 4. If the resource is `available` and tags match, the handler calls StopDB* and waits until `stopped` (again using up to 5-minute intervals while transitional).
 5. If the resource is already `stopped` (for example, stopped by another process), the handler exits without calling StopDB* and without posting to Slack.
 6. When `slackSecretName` is set, Slack is notified only when StopDB* was invoked by this invocation and the resource reached `stopped`. When it is omitted, the handler does not post to Slack.
+7. If the execution fails (invalid input or Slack secret, unexpected RDS status, stop not reaching `stopped`, or Slack post failure), the handler logs `AutoStartPreventFailed` with the DB identifier and error message, and the durable execution ends as failed. With `failureDetection.enabled`, this log raises a CloudWatch alarm.
 
 Timing defaults (not configurable via props today):
 
@@ -33,7 +35,7 @@ Timing defaults (not configurable via props today):
 |---------|-------|
 | Initial wait before the first describe | 1 minute |
 | Wait between describes while status is transitional / stopping | up to 5 minutes |
-| Lambda invocation `timeout` | 15 minutes |
+| Lambda invocation `timeout` | 3 minutes |
 | Durable `executionTimeout` | 2 hours |
 | Durable history `retentionPeriod` | 1 day |
 
@@ -92,7 +94,7 @@ app.synth();
 
 Deploy checklist:
 
-1. Install this package and peers (`aws-cdk-lib`, `constructs`) in your CDK app.
+1. Install this package and peers (`aws-cdk-lib`, `constructs`, `lambda-failure-detector`) in your CDK app.
 2. Tag the RDS instances or clusters to protect (for example `AutoStartPrevent=YES`).
 3. Optional: create the Secrets Manager secret described in [Slack secret](#slack-secret-aws-secrets-manager). Omit `slackSecretName` if you do not need Slack.
 4. From the CDK app: `npx cdk deploy RDSDatabaseAutoStartPreventStack`
@@ -132,6 +134,36 @@ new RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {
 });
 ```
 
+### Failure detection (CloudWatch alarms)
+
+Failure detection is off by default. Set `failureDetection.enabled` to `true` to create the alarms. The construct does not create an SNS topic: pass an existing topic as `alarmTopic` to receive notifications, or omit it to create alarms without actions.
+
+```typescript
+import { Topic } from 'aws-cdk-lib/aws-sns';
+
+const alarmTopic = new Topic(stack, 'AlarmTopic');
+
+new RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {
+  targetResource: {
+    tagKey: 'AutoStartPrevent',
+    tagValues: ['YES'],
+  },
+  secrets: {},
+  failureDetection: {
+    enabled: true,
+    alarmTopic,
+  },
+});
+```
+
+Alarms created when enabled (threshold 1 in a 5-minute period):
+
+| Alarm | Metric | Fires when |
+|-------|--------|------------|
+| Lambda errors | `AWS/Lambda` `Errors` | An invocation fails at the platform level (for example a crash or invocation timeout). |
+| Lambda throttles | `AWS/Lambda` `Throttles` | An invocation is throttled. |
+| Failed execution | `RDSDatabaseAutoStartPreventer` `AutoStartPreventFailed` | The handler logs `AutoStartPreventFailed` because the durable execution failed (invalid input or Slack secret, unexpected RDS status, stop not reaching `stopped`, or Slack post failure after retries). |
+
 ### Slack secret (AWS Secrets Manager)
 
 Create the secret **before** deploy when you want Slack notifications. Omit `slackSecretName` to skip Slack entirely (no secret and no Secrets Manager IAM are required in that case).
@@ -164,6 +196,9 @@ When `slackSecretName` is set, the construct grants the Lambda role read access
 | `enableRule` | `boolean` | No | Whether the EventBridge rules are enabled. Defaults to `true` if omitted. |
 | `secrets` | `Secrets` | Yes | External secrets for notifications. |
 | `secrets.slackSecretName` | `string` | No | Name of the Secrets Manager secret containing Slack `token` and `channel`. Omit it to skip Slack notifications. |
+| `failureDetection` | `AutoStartPreventFailureDetectionProps` | No | CloudWatch failure detection for the Lambda. No alarms when omitted. |
+| `failureDetection.enabled` | `boolean` | No | Creates the failure alarms only when `true`. |
+| `failureDetection.alarmTopic` | `ITopic` | No | Existing SNS topic notified by every alarm. Alarms have no actions when omitted. |
 
 Empty `tagKey`, an empty `tagValues` array (or blank entries), and a blank `slackSecretName` fail at synthesis. Omitting `slackSecretName` is allowed. Unresolved CDK tokens are not checked.
 
@@ -176,18 +211,21 @@ See [API.md](./API.md).
 - **Node.js** >= 20.0.0 (for your CDK app)
 - **AWS CDK** ^2.232.0
 - **constructs** ^10.5.1
+- **lambda-failure-detector** ^0.2.3 (peer dependency, used for `failureDetection`)
 - **AWS Lambda** runtime Node.js 24.x with Durable Execution (deployed by the construct)
 
 ## Notes
 
 - **Aurora / dual events:** An Aurora auto-start can emit both a DB cluster event (`RDS-EVENT-0153`) and DB instance event(s) (`RDS-EVENT-0154`). This package listens for both and may run separate Durable executions. Tag mismatch remains a no-op; if the resource is already `stopped`, the handler does not call StopDB* and does not post to Slack.
 - **IAM:** RDS Describe is limited to account/region `db` / `cluster` ARNs. Stop requires a matching `aws:ResourceTag` for your `tagKey` / `tagValues`. Slack secret read is granted only when `slackSecretName` is set.
+- **Failure alarms:** A failed durable execution ends the invocation normally, so it does not raise the Lambda `Errors` metric. The `AutoStartPreventFailed` log alarm covers those failures. The log line contains the DB identifier and error message, never the Slack token or channel.
 
 ## Troubleshooting
 
 - **CloudWatch Logs:** The construct creates a dedicated Log Group for the Durable Lambda (JSON logs, 3-month retention). After a successful create, the log group uses `RetainExceptOnCreate` so it remains available for incident review after stack delete or replace.
 - **Nothing stopped / no Slack:** Confirm the resource tag matches `tagKey` / `tagValues`. Mismatch is intentional no-op with no Slack message.
 - **Stop attempted but Slack missing:** Slack runs only when this invocation called StopDB* and the resource reached `stopped`, and only when `slackSecretName` is set. Already-stopped resources skip Slack.
+- **`AutoStartPreventFailed` alarm:** Search the Lambda log group for `AutoStartPreventFailed` to find the DB identifier and error message of the failed execution.
 - **Secret errors:** Ensure the secret exists before deploy, JSON has non-empty `token` and `channel`, and the name passed as `slackSecretName` matches Secrets Manager.
 
 ## License