Add additional alarms and associated variables

cloud/aws/templates/aws_oidc/alarms.tf

@@ -119,3 +119,51 @@ resource "aws_cloudwatch_metric_alarm" "memory_swap_usage_too_high" {
  DBInstanceIdentifier = data.aws_db_instance.civiform.id
  }
 }
+
+// Connection Count
+resource "aws_cloudwatch_metric_alarm" "connection_count_anomalous" {
+ count = var.rds_create_anomaly_alarm ? 1 : 0
+ alarm_name = "rds-${data.aws_db_instance.civiform.id}-anomalousConnectionCount"
+ comparison_operator = "GreaterThanUpperThreshold"
+ evaluation_periods = var.rds_alarm_evaluation_period
+ threshold_metric_id = "e1"
+ alarm_description = "Anomalous database connection count detected. Something unusual is happening."
+
+ metric_query {
+ id = "e1"
+ expression = "ANOMALY_DETECTION_BAND(m1, ${var.rds_anomaly_bandwidth})"
+ label = "DatabaseConnections (Expected)"
+ return_data = "true"
+ }
+
+ metric_query {
+ id = "m1"
+ return_data = "true"
+ metric {
+ metric_name = "DatabaseConnections"
+ namespace = "AWS/RDS"
+ period = var.rds_anomaly_period
+ stat = "Average"
+ unit = "Count"
+
+ dimensions = {
+ DBInstanceIdentifier = data.aws_db_instance.civiform.id
+ }
+ }
+ }
+}
+
+// Early Warning System for Transaction ID Wraparound for postgres
+resource "aws_cloudwatch_metric_alarm" "maximum_used_transaction_ids_too_high" {
+ count = var.rds_create_transaction_id_wraparound_alarm ? 1 : 0
+ alarm_name = "rds-${data.aws_db_instance.civiform.id}-maximumUsedTransactionIDs"
+ comparison_operator = "GreaterThanThreshold"
+ evaluation_periods = var.rds_alarm_evaluation_period
+ metric_name = "MaximumUsedTransactionIDs"
+ namespace = "AWS/RDS"
+ period = var.rds_alarm_statistic_period
+ statistic = "Average"
+ threshold = var.rds_max_used_transaction_ids_high_threshold
+ alarm_description = "Nearing a possible critical transaction ID wraparound. More info [here](https://aws.amazon.com/blogs/database/implement-an-early-warning-system-for-transaction-id-wraparound-in-amazon-rds-for-postgresql/)"
+}
+

cloud/aws/templates/aws_oidc/variable_definitions.json

@@ -305,6 +305,24 @@
  "tfvar": true,
  "type": "bool"
  },
+ "RDS_ANOMALY_BANDWIDTH": {
+ "required": false,
+ "secret": false,
+ "tfvar": true,
+ "type": "string"
+ },
+ "RDS_ANOMALY_PERIOD": {
+ "required": false,
+ "secret": false,
+ "tfvar": true,
+ "type": "string"
+ },
+ "RDS_CREATE_TRANSACTION_ID_WRAPAROUND_ALARM": {
+ "required": false,
+ "secret": false,
+ "tfvar": true,
+ "type": "bool"
+ },
  "AWS_DB_STORAGE_TYPE": {
  "required": false,
  "secret": false,

cloud/aws/templates/aws_oidc/variables.tf

@@ -238,6 +238,24 @@ variable "rds_create_anomaly_alarm" {
  default = false
 }
 
+variable "rds_anomaly_bandwidth" {
+ type = string
+ description = "The width of the anomaly band, default 2. Higher numbers means less sensitive."
+ default = "2"
+}
+
+variable "rds_anomaly_period" {
+ type = string
+ default = "600"
+ description = "The number of seconds that make each evaluation period for anomaly detection."
+}
+
+variable "rds_create_transaction_id_wraparound_alarm" {
+ type = bool
+ description = "Whether or not to create a transaction ID wraparound alarm for postgres. More information can be found [here](https://aws.amazon.com/blogs/database/implement-an-early-warning-system-for-transaction-id-wraparound-in-amazon-rds-for-postgresql/)."
+ default = false
+}
+
 variable "rds_max_used_transaction_ids_high_threshold" {
  type = string
  description = "The threshold for the maximum transaction IDS before the alarm gets triggered. This is to prevent [transaciton ID wraparound](https://aws.amazon.com/blogs/database/implement-an-early-warning-system-for-transaction-id-wraparound-in-amazon-rds-for-postgresql/)"