Show summary
| CHANGE | NAME |
|--------|-----------------------------------------------------------------------|
| add | `aws_cloudwatch_log_metric_filter.url_shortener_api_magic_link_sent` |
| | `aws_cloudwatch_metric_alarm.url_shoretener_api_high_magic_link_sent` |
Show plan
```terraform
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# aws_cloudwatch_log_metric_filter.url_shortener_api_magic_link_sent will be created
+ resource "aws_cloudwatch_log_metric_filter" "url_shortener_api_magic_link_sent" {
+ id = (known after apply)
+ log_group_name = "/aws/lambda/url-shortener-api"
+ name = "MagicLinkSent"
+ pattern = "success_magic_link_sent_email"
+ metric_transformation {
+ name = "MagicLinkSent"
+ namespace = "UrlShortener"
+ unit = "None"
+ value = "1"
}
}
# aws_cloudwatch_metric_alarm.url_shoretener_api_high_magic_link_sent will be created
+ resource "aws_cloudwatch_metric_alarm" "url_shoretener_api_high_magic_link_sent" {
+ actions_enabled = true
+ alarm_actions = [
+ "arn:aws:sns:ca-central-1:843973686572:cloudwatch-alarms-warning",
]
+ alarm_description = "A high number of magic link emails sent over 5 minutes"
+ alarm_name = "URL Shortener API high magic link sent"
+ arn = (known after apply)
+ comparison_operator = "GreaterThanOrEqualToThreshold"
+ evaluate_low_sample_count_percentiles = (known after apply)
+ evaluation_periods = 1
+ id = (known after apply)
+ metric_name = "MagicLinkSent"
+ namespace = "UrlShortener"
+ ok_actions = [
+ "arn:aws:sns:ca-central-1:843973686572:cloudwatch-alarms-warning",
]
+ period = 300
+ statistic = "Sum"
+ tags_all = (known after apply)
+ threshold = 10
+ treat_missing_data = "notBreaching"
}
Plan: 2 to add, 0 to change, 0 to destroy.
Warning: Argument is deprecated
with module.athena_bucket.aws_s3_bucket.this,
on .terraform/modules/athena_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
8: resource "aws_s3_bucket" "this" {
Use the aws_s3_bucket_lifecycle_configuration resource instead
(and 3 more similar warnings elsewhere)
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...
```
Show Conftest results
```sh
WARN - plan.json - main - Cloudwatch log metric pattern is invalid: ["aws_cloudwatch_log_metric_filter.url_shortener_api_error"]
WARN - plan.json - main - Cloudwatch log metric pattern is invalid: ["aws_cloudwatch_log_metric_filter.url_shortener_api_warning"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.cloudfront_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.route53_ddos"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.url_shoretener_api_high_magic_link_sent"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.url_shoretener_api_suspicious"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.url_shoretener_api_warning"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_metric_alarm.url_shortener_api_error"]
WARN - plan.json - main - Missing Common Tags: ["module.cloudwatch_alarms_slack.aws_cloudwatch_log_group.notify_slack_lambda"]
WARN - plan.json - main - Missing Common Tags: ["module.cloudwatch_alarms_slack.aws_iam_policy.notify_slack_lambda"]
WARN - plan.json - main - Missing Common Tags: ["module.cloudwatch_alarms_slack.aws_iam_role.notify_slack_lambda"]
WARN - plan.json - main - Missing Common Tags: ["module.cloudwatch_alarms_slack.aws_lambda_function.notify_slack"]
28 tests, 16 passed, 12 warnings, 0 failures, 0 exceptions
```
Summary
Add a CloudWatch alarm that triggers when a high number of magic link emails have been sent in a 5 minute period.
This is being done to watch for abuse of the Notify API key.