CloudWatchAutoAlarms.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Automatically Create Alarms for EC2, RDS, and AWS Lambda
Parameters:
  Memory:
    Description: Memory to allocate to Lambda function
    Type: Number
    Default:  128
    MinValue: 128
    MaxValue: 3008
  EventState:
    Description: Create Cloudwatch event to trigger execution on instance start / terminate.
    Type: String
    Default: ENABLED
  S3DeploymentBucket:
    Description: Enter the Amazon S3 bucket name that contains the AWS Lambda deployment package
    Type: String
  S3DeploymentKey:
    Description: Enter the Amazon S3 key name for your AWS Lambda deployment package
    Type: String
    Default:  amazon-cloudwatch-auto-alarms.zip
  AlarmNotificationARN:
    Description: Enter the Amazon SNS Notification ARN for alarm notifications, leave blank to disable notifications.
    Type: String
    Default: ""
  AlarmIdentifierPrefix:
    Description: Enter the prefix that should be added to the beginning of each alarm created by the solution, (e.g. AutoAlarm-i-00e4f327736cb077f-CPUUtilization-GreaterThanThreshold-80-5m)
    Type: String
    Default: AutoAlarm


Resources:
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: "CloudWatchAutoAlarms"
      Handler: cw_auto_alarms.lambda_handler
      Runtime: python3.8
      Role:  !GetAtt CloudWatchAutoAlarmLambdaRole.Arn
      MemorySize: !Ref Memory
      Timeout: 600
      Code:
        S3Bucket: !Ref S3DeploymentBucket
        S3Key: !Ref S3DeploymentKey
      Environment:
        Variables:
          ALARM_TAG: Create_Auto_Alarms
          CREATE_DEFAULT_ALARMS: true
          CLOUDWATCH_NAMESPACE: CWAgent
          ALARM_CPU_HIGH_THRESHOLD: 75
          ALARM_DEFAULT_ANOMALY_THRESHOLD: 2
          ALARM_CPU_CREDIT_BALANCE_LOW_THRESHOLD: 100
          ALARM_MEMORY_HIGH_THRESHOLD: 75
          ALARM_DISK_PERCENT_LOW_THRESHOLD: 20
          ALARM_IDENTIFIER_PREFIX: !Ref AlarmIdentifierPrefix
          CLOUDWATCH_APPEND_DIMENSIONS: 'InstanceId, ImageId, InstanceType'

          ALARM_LAMBDA_ERROR_THRESHOLD: 0
          ALARM_LAMBDA_THROTTLE_THRESHOLD: 0

          DEFAULT_ALARM_SNS_TOPIC_ARN: !Ref AlarmNotificationARN

  CloudWatchAutoAlarmLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: "Lambda_Permissions"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cloudwatch:PutMetricData
                  - cloudwatch:ListMetrics
                Resource: "*"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogGroups
                Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*"
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:log-stream:*"
              - Effect: Allow
                Action:
                  - rds:ListTagsForResource
                Resource: "*"
              - Effect: Allow
                Action:
                  - ec2:DescribeInstances
                  - ec2:DescribeImages
                Resource: "*"
              - Effect: Allow
                Action:
                  - ec2:CreateTags
                Resource: !Sub "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
              - Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:DeleteAlarms
                  - cloudwatch:PutMetricAlarm
                Resource:  !Sub "arn:${AWS::Partition}:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:${AlarmIdentifierPrefix}-*"
              - Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                Resource: "*"

  LambdaInvokePermissionCloudwatchEventsEC2:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt
        - LambdaFunction
        - Arn
      Action: 'lambda:InvokeFunction'
      Principal: events.amazonaws.com
      SourceArn: !GetAtt
        - CloudWatchAutoAlarmCloudwatchEventEC2
        - Arn

  CloudWatchAutoAlarmCloudwatchEventEC2:
    Type: AWS::Events::Rule
    Properties:
      Name: Initiate-CloudWatchAutoAlarmsEC2
      Description: Creates CloudWatch alarms on instance start via Lambda CloudWatchAutoAlarms and deletes them on instance termination.
      EventPattern: '
        {
          "source": [
            "aws.ec2"
          ],
          "detail-type": [
            "EC2 Instance State-change Notification"
          ],
          "detail": {
            "state": [
              "running",
              "terminated"
            ]
          }
        }'
      State: !Ref EventState
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LATEST

  CloudWatchAutoAlarmScheduledRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "Execute CloudWatchAutoAlarms on schedule"
      ScheduleExpression: "rate(1 day)"
      State: "ENABLED"
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LATEST
          Input: '
          {
          "action": "scan"
          }
          '

  CloudWatchAutoAlarmPermissionForEventsToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref "LambdaFunction"
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn:
        Fn::GetAtt:
          - "CloudWatchAutoAlarmScheduledRule"
          - "Arn"

  CloudWatchAutoAlarmCloudwatchEventLambda:
    Type: AWS::Events::Rule
    Properties:
      Name: Initiate-CloudWatchAutoAlarmsLambda
      Description: Creates and deletes CloudWatch alarms for lambda functions with the CloudWatchAutoAlarms activation tag
      EventPattern: '
        {
          "source": [
            "aws.lambda"
          ],
          "detail-type": [
            "AWS API Call via CloudTrail"
          ],
          "detail": {
            "eventSource": [
              "lambda.amazonaws.com"
            ],
            "eventName": [
              "TagResource20170331v2",
              "DeleteFunction20150331"
            ]
          }
        }
        '
      State: !Ref EventState
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LATEST

  CloudWatchAutoAlarmCloudwatchEventRDSCreate:
    Type: AWS::Events::Rule
    Properties:
      Name: Initiate-CloudWatchAutoAlarmsRDSCreate
      Description: Creates CloudWatch alarms for RDS instances with CloudWatchAutoAlarms activation tag
      EventPattern: '
        {
          "detail-type": ["AWS API Call via CloudTrail"],
          "detail": {
            "eventSource": ["rds.amazonaws.com"],
            "eventName": ["AddTagsToResource"]
          }
        }
        '
      State: !Ref EventState
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LATEST

  CloudWatchAutoAlarmCloudwatchEventRDSDelete:
    Type: AWS::Events::Rule
    Properties:
      Name: Initiate-CloudWatchAutoAlarmsRDSDelete
      Description: Deletes CloudWatch alarms for corresponding RDS instance is deleted
      EventPattern: '
        {
          "source": ["aws.rds"],
          "detail": {
            "EventCategories": ["creation", "deletion"]
          }
        }
        '
      State: !Ref EventState
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LATEST


  LambdaInvokePermissionCloudwatchEventsLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt
        - LambdaFunction
        - Arn
      Action: 'lambda:InvokeFunction'
      Principal: events.amazonaws.com
      SourceArn: !GetAtt
        - CloudWatchAutoAlarmCloudwatchEventLambda
        - Arn

  LambdaInvokePermissionCloudwatchEventsRDSCreate:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt
        - LambdaFunction
        - Arn
      Action: 'lambda:InvokeFunction'
      Principal: events.amazonaws.com
      SourceArn: !GetAtt
        - CloudWatchAutoAlarmCloudwatchEventRDSCreate
        - Arn

  LambdaInvokePermissionCloudwatchEventsRDSDelete:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt
        - LambdaFunction
        - Arn
      Action: 'lambda:InvokeFunction'
      Principal: events.amazonaws.com
      SourceArn: !GetAtt
        - CloudWatchAutoAlarmCloudwatchEventRDSDelete
        - Arn