Merge pull request #14 from BCDevOps/iam-alarms

Add cloudwatch alarm to monitor key rotation lambda for failures

modules/iam-users/main.tf

@@ -142,7 +142,23 @@ resource "aws_lambda_function" "key_rotation" {
     }
   }
 }
-
+# Create a cloudwatch alarm that monitors IAM users lambda failures
+resource "aws_cloudwatch_metric_alarm" "key_rotation_lambda_function" {
+  alarm_name          = var.alarm_name
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "Errors"
+  namespace           = "AWS/Lambda"
+  period              = "60"
+  statistic           = "Sum"
+  threshold           = "1"
+  datapoints_to_alarm = "1"
+  alarm_description   = "Monitor IAM users lambda for errors"
+  alarm_actions       = [var.sns_arn]
+  dimensions = {
+    FunctionName = var.function_name
+  }
+}
 # Create a Cloud watch event rule for every 5 minutes
 resource "aws_cloudwatch_event_rule" "every_hour" {
   name                = "every-hour"

modules/iam-users/variables.tf

@@ -13,3 +13,10 @@ variable "role_name" {
 variable "policy_name" {
   description = "Name of the policy created for the lambda function"
 }
+variable "alarm_name" {
+  description = "name of the cloudwatch alarm"
+}
+
+variable "sns_arn" {
+  description = "name of the sns topic arn for cloudwatch arn"
+}