BM-1950: Update log lambda to query alarm tags for debugging via chatbot

infra/bootstrap/index.ts

@@ -4,6 +4,7 @@ import * as vpc from './lib/vpc';
 import { getEnvVar } from '../util';
 
 const OPS_ACCOUNT_PIPELINE_ROLE_ARN = "arn:aws:iam::968153779208:role/pipeline-role-3b97f1a";
+const OPS_ACCOUNT_LOG_LAMBDA_ROLE_ARN = "arn:aws:iam::968153779208:role/chatbot-log-fetcher-role-4d93cb1"
 
 const stackName = pulumi.getStack();
 const isDev = stackName.includes("dev");
@@ -54,6 +55,38 @@ export = async () => {
     }],
   });
 
+  // Create a role that the log fetcher Lambda can assume to list tags on Cloudwatch alarms in the current account
+  const alarmTagsRole = new aws.iam.Role(`${prefix}alarmListTagsRole`, {
+    name: `${prefix}alarmListTagsRole`,
+    assumeRolePolicy: pulumi.jsonStringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Action: "sts:AssumeRole",
+          Principal: {
+            AWS: OPS_ACCOUNT_LOG_LAMBDA_ROLE_ARN
+          },
+          Effect: "Allow",
+          Sid: ""
+        }
+      ]
+    }),
+    inlinePolicies: [
+      {
+        name: 'cloudwatchAlarmListTagsPolicy',
+        policy: pulumi.jsonStringify({
+          Version: "2012-10-17",
+          Statement: [{
+            Sid: "AllowListTagsAnyAlarm",
+            Effect: "Allow",
+            Action: "cloudwatch:ListTagsForResource",
+            Resource: pulumi.interpolate`arn:aws:cloudwatch:us-west-2:${aws.getCallerIdentityOutput().accountId}:alarm:*`
+          }],
+        }),
+      }
+    ]
+  });
+
   return {
     DEPLOYMENT_ROLE_ARN: deploymentRole.arn,
     VPC_ID: services_vpc.vpcx.vpcId,

infra/pipelines/components/notifications.ts

@@ -1,5 +1,6 @@
 import * as aws from '@pulumi/aws';
 import * as pulumi from '@pulumi/pulumi';
+import { BOUNDLESS_PROD_ACCOUNT_ID, BOUNDLESS_STAGING_ACCOUNT_ID } from "../accountConstants";
 
 export class Notifications extends pulumi.ComponentResource {
   // Mainnet Beta
@@ -383,6 +384,23 @@ export class Notifications extends pulumi.ComponentResource {
       managedPolicyArns: [
         'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
       ],
+      inlinePolicies: [
+        {
+          name: 'cloudwatchAlarmListTagsRolePolicy',
+          policy: pulumi.jsonStringify({
+            Version: "2012-10-17",
+            Statement: [{
+              Sid: "AllowAlarmListTagsAssumeRole",
+              Effect: 'Allow',
+              Action: 'sts:AssumeRole',
+              Resource: [
+                `arn:aws:iam::${BOUNDLESS_STAGING_ACCOUNT_ID}:role/alarmListTagsRole`,
+                `arn:aws:iam::${BOUNDLESS_PROD_ACCOUNT_ID}:role/alarmListTagsRole`
+              ]
+            }]
+          })
+        }
+      ]
     });
 
     const chatbotLogFetcher = new aws.lambda.Function("chatbot-debugger", {