CloudWatchAutoAlarms.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Automatically Create Alarms for EC2 instances
Parameters:
  Memory:
    Description: Memory to allocate to Lambda function
    Type: Number
    Default:  128
    MinValue: 128
    MaxValue: 3008
  EventState:
    Description: Whether Cloudwatch event schedule is enabled or disabled
    Type: String
    Default: ENABLED
  S3DeploymentBucket:
    Description: Enter the Amazon S3 bucket name that contains the AWS Lambda deployment package
    Type: String
  S3DeploymentKey:
    Description: Enter the Amazon S3 key name for your AWS Lambda deployment package
    Type: String
    Default:  amazon-cloudwatch-auto-alarms.zip
  AlarmNotificationARN:
    Description: Enter the Amazon SNS Notification ARN for alarm notifications, leave blank to disable notifications.
    Type: String
    Default: ""

Conditions:
  ConfigureAlarmNotifications: !Not [!Equals ["", !Ref AlarmNotificationARN]]

Resources:
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: "CloudWatchAutoAlarms"
      Handler: cw_auto_alarms.lambda_handler
      Runtime: python3.8
      Role:  !GetAtt CloudWatchAutoAlarmLambdaRole.Arn
      MemorySize: !Ref Memory
      Timeout: 600
      Code:
        S3Bucket: !Ref S3DeploymentBucket
        S3Key: !Ref S3DeploymentKey
      Environment:
        Variables:
          ALARM_TAG: Create_Auto_Alarms
          CREATE_DEFAULT_ALARMS: true
          CLOUDWATCH_NAMESPACE: CWAgent
          ALARM_CPU_HIGH_THRESHOLD: 75
          ALARM_CPU_CREDIT_BALANCE_LOW_THRESHOLD: 100
          ALARM_MEMORY_HIGH_THRESHOLD: 75
          ALARM_DISK_PERCENT_LOW_THRESHOLD: 20
          CLOUDWATCH_APPEND_DIMENSIONS: 'InstanceId, ImageId, InstanceType'

          ALARM_LAMBDA_ERROR_THRESHOLD: 0
          ALARM_LAMBDA_THROTTLE_THRESHOLD: 0

          DEFAULT_ALARM_SNS_TOPIC_ARN: !If [ConfigureAlarmNotifications, !Ref AlarmNotificationARN, !Ref "AWS::NoValue"]

  CloudWatchAutoAlarmLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: "Lambda_Permissions"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cloudwatch:PutMetricData
                Resource: "*"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogGroups
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*"
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:log-stream:*"
              - Effect: Allow
                Action:
                  - ec2:DescribeInstances
                  - ec2:DescribeImages
                Resource: "*"
              - Effect: Allow
                Action:
                  - ec2:CreateTags
                Resource: !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
              - Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:DeleteAlarms
                  - cloudwatch:PutMetricAlarm
                Resource:  !Sub "arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:AutoAlarm-*"
              - Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                Resource: "*"

  LambdaInvokePermissionCloudwatchEventsEC2:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt
        - LambdaFunction
        - Arn
      Action: 'lambda:InvokeFunction'
      Principal: events.amazonaws.com
      SourceArn: !GetAtt
        - CloudWatchAutoAlarmCloudwatchEventEC2
        - Arn

  CloudWatchAutoAlarmCloudwatchEventEC2:
    Type: AWS::Events::Rule
    Properties:
      Name: Initiate-CloudWatchAutoAlarmsEC2
      Description: Creates CloudWatch alarms on instance start via Lambda CloudWatchAutoAlarms and deletes them on instance termination.
      EventPattern: '
        {
          "source": [
            "aws.ec2"
          ],
          "detail-type": [
            "EC2 Instance State-change Notification"
          ],
          "detail": {
            "state": [
              "running",
              "terminated"
            ]
          }
        }'
      State: !Ref EventState
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LATEST

  CloudWatchAutoAlarmCloudwatchEventLambda:
    Type: AWS::Events::Rule
    Properties:
      Name: Initiate-CloudWatchAutoAlarmsLambda
      Description: Creates CloudWatch alarms on for lambda functions with the CloudWatchAutoAlarms activation tag
      EventPattern: '
        {
          "source": [
            "aws.lambda"
          ],
          "detail-type": [
            "AWS API Call via CloudTrail"
          ],
          "detail": {
            "eventSource": [
              "lambda.amazonaws.com"
            ],
            "eventName": [
              "TagResource20170331v2",
              "DeleteFunction20150331"
            ]
          }
        }
        '
      State: !Ref EventState
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LATEST

  LambdaInvokePermissionCloudwatchEventsLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt
        - LambdaFunction
        - Arn
      Action: 'lambda:InvokeFunction'
      Principal: events.amazonaws.com
      SourceArn: !GetAtt
        - CloudWatchAutoAlarmCloudwatchEventLambda
        - Arn