ECSの異常終了をお手軽検知

resource "aws_cloudwatch_event_rule" "ecs_event_handler" {
  name        = "capture-ecs-events"
  description = "Capture ECS events"

  event_pattern = <<PATTERN
{
  "source": [
    "aws.ecs"
  ],
  "detail-type": [
    "ECS Task State Change"
  ],
  "detail": {
    "clusterArn": [
      "${var.ecs_cluster_arn}"
    ],
    "lastStatus": [
      "STOPPED"
    ],
    "containers": {
      "exitCode": [{
        "exists": false
      }, {
        "anything-but": 0
      }]
    },
    "stoppedReason": [{
      "anything-but": {
        "prefix": "Scaling activity initiated by"
      }
    }]
  }
}
PATTERN
}

data "aws_iam_policy_document" "lambda_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"
      identifiers = [
        "lambda.amazonaws.com",
        "edgelambda.amazonaws.com"
      ]
    }
  }
}

resource "aws_iam_role" "lambda_ecs_event_notification" {
  name               = "lambda-ecs-event-notification"
  assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
}

resource "aws_iam_role_policy_attachment" "lambda_ecs_event_notification" {
  role       = aws_iam_role.lambda_ecs_event_notification.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

data "archive_file" "lambda_ecs_event_notification" {
  type        = "zip"
  source_file = "lambda-src/ecs_event_notification/index.js"
  output_path = "lambda-src/ecs_event_notification/index.zip"
}

resource "aws_lambda_function" "ecs_event_notification" {
  filename         = data.archive_file.lambda_ecs_event_notification.output_path
  function_name    = "ecs-event-notification"
  role             = aws_iam_role.lambda_ecs_event_notification.arn
  handler          = "index.handler"
  source_code_hash = data.archive_file.lambda_ecs_event_notification.output_base64sha256
  runtime          = "nodejs12.x"

  memory_size = 128
  timeout     = 3
  environment {
    variables = {
      DETAIL_URL_PREFIX = var.detail_ecs_url_prefix
      SLACK_PATH = var.slack_path
    }
  }
}

resource "aws_cloudwatch_log_group" "lambda_ecs_event_notification" {
  name              = "/aws/lambda/ecs-event-notification"
  retention_in_days = 1
}

resource "aws_iam_role_policy_attachment" "lambda_ecs_event_notification_logging" {
  role       = aws_iam_role.lambda_ecs_event_notification.name
  policy_arn = aws_iam_policy.lambda_ecs_event_notification_logging.arn
}

resource "aws_iam_policy" "lambda_ecs_event_notification_logging" {
  name   = "lambda-ecs-event-notification-logging"
  path   = "/"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": [
        "${aws_cloudwatch_log_group.lambda_ecs_event_notification.arn}"
      ],
      "Effect": "Allow"
    }
  ]
}
EOF
}

resource "aws_cloudwatch_event_target" "ecs_event_handler" {
  rule = aws_cloudwatch_event_rule.ecs_event_handler.name
  arn  = aws_lambda_function.ecs_event_notification.arn
}

resource "aws_lambda_permission" "lambda_ecs_event_notification" {
  statement_id  = "AllowExecutionFromEventBridge"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.ecs_event_notification.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.ecs_event_handler.arn
}

const https = require('https');

exports.handler = (event, context, callback) => {
    const id = event.resources[0].match(/[0-9a-zA-Z]*$/);
    const detail = process.env.DETAIL_URL_PREFIX +id+'/details'
    const reason = event.detail.stoppedReason
    const taskArn = event.detail.taskDefinitionArn
    const exitCode = event.detail.containers[0].exitCode
    const command = event.detail.overrides.containerOverrides[0].command

    const options = {
        hostname: 'hooks.slack.com',
        path: process.env.SLACK_PATH,
        port: 443,
        method: 'POST',
        headers: {
            'Content-Type' : 'application/json'
        }
    };

    const payload = {
        username:"ECS ALERT",
        icon_emoji: ":ecs:",
        blocks:[
        {
            type: "section",
            text: {
                type: "mrkdwn",
                text:
                    "*TASK ARN*\n" + taskArn + "\n\n" +
                    "*REASON*\n" + reason + "\n\n" +
                    "*COMMAND*\n`" + command + "`\n\n" +
                    "*EXIT CODE*\n" + exitCode + "\n\n" +
                    "*DETAIL*\n" + detail
                }
        }]
    };

    const data = JSON.stringify(payload);
    const req = https.request(options, (res) => {});
    req.write(data);
    req.end();
};