62 lines
2.3 KiB
HCL
62 lines
2.3 KiB
HCL
resource "aws_cloudwatch_metric_alarm" "lambda_errors" {
|
|
alarm_name = "${var.project}-lambda-errors-${var.environment}"
|
|
comparison_operator = "GreaterThanThreshold"
|
|
evaluation_periods = 1
|
|
metric_name = "Errors"
|
|
namespace = "AWS/Lambda"
|
|
period = 300
|
|
statistic = "Sum"
|
|
threshold = 5
|
|
alarm_description = "Lambda error rate exceeded - possible security incident"
|
|
alarm_actions = [aws_sns_topic.security_alerts.arn]
|
|
dimensions = { FunctionName = aws_lambda_function.processor.function_name }
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "s3_storage" {
|
|
alarm_name = "${var.project}-s3-storage-${var.environment}"
|
|
comparison_operator = "GreaterThanThreshold"
|
|
evaluation_periods = 1
|
|
metric_name = "BucketSizeBytes"
|
|
namespace = "AWS/S3"
|
|
period = 86400
|
|
statistic = "Average"
|
|
threshold = 4294967296
|
|
alarm_description = "S3 storage approaching 4GB free tier limit"
|
|
dimensions = {
|
|
BucketName = aws_s3_bucket.images.bucket
|
|
StorageType = "StandardStorage"
|
|
}
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "lambda_throttles" {
|
|
alarm_name = "${var.project}-lambda-throttles-${var.environment}"
|
|
comparison_operator = "GreaterThanThreshold"
|
|
evaluation_periods = 1
|
|
metric_name = "Throttles"
|
|
namespace = "AWS/Lambda"
|
|
period = 300
|
|
statistic = "Sum"
|
|
threshold = 0
|
|
alarm_description = "Lambda throttling detected - possible DoS"
|
|
alarm_actions = [aws_sns_topic.security_alerts.arn]
|
|
dimensions = { FunctionName = aws_lambda_function.processor.function_name }
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_cloudwatch_metric_alarm" "kms_key_state" {
|
|
alarm_name = "${var.project}-kms-key-state-${var.environment}"
|
|
comparison_operator = "GreaterThanThreshold"
|
|
evaluation_periods = 1
|
|
metric_name = "KeyState"
|
|
namespace = "AWS/KMS"
|
|
period = 300
|
|
statistic = "Average"
|
|
threshold = 0
|
|
alarm_description = "KMS key disabled or pending deletion"
|
|
alarm_actions = [aws_sns_topic.security_alerts.arn]
|
|
dimensions = { KeyId = aws_kms_key.main.key_id }
|
|
tags = local.tags
|
|
}
|