AWSサーバーレスのエラーキャッチ手法＆メトリクス運用監視方法まとめ_CTO監修

DynamoDBAccountReadCapAlarm:
  Type: 'AWS::CloudWatch::Alarm'
  Properties:
    AlarmName: 'DynamoDBAccountReadCapAlarm'
    AlarmDescription: 'Alarm when account approaches maximum read capacity limit'
    AlarmActions:
      - !Ref DynamoDBMonitoringSNSTopic
    Namespace: 'AWS/DynamoDB'
    MetricName: 'AccountProvisionedReadCapacityUtilization'
    Statistic: 'Maximum'
    Threshold: 80
    ComparisonOperator: 'GreaterThanThreshold'
    Period: 300
    EvaluationPeriods: 1

DynamoDBGSIReadThrottlingAlarm:
  Type: 'AWS::CloudWatch::Alarm'
  Properties:
    AlarmName: 'DynamoDBGSIReadThrottlingAlarm'
    AlarmDescription: 'Alarm when GSI read throttle requests exceed 2% of total number of read requests'
    AlarmActions:
      - !Ref DynamoDBMonitoringSNSTopic
    Metrics:
      - Id: 'e1'
        Expression: '(m1/m2) * 100'
        Label: GSIReadThrottlesOverTotalReads
      - Id: 'm1'
        MetricStat:
          Metric:
            Namespace: 'AWS/DynamoDB'
            MetricName: 'ReadThrottleEvents'
            Dimensions:
              - Name: 'TableName'
                Value: !Ref DynamoDBProvisionedTableName

DynamoDBTableASReadAlarm:
  Type: 'AWS::CloudWatch::Alarm'
  Properties:
    AlarmName: 'DynamoDBTableASReadAlarm'
    AlarmDescription: 'Alarm when table auto scaling read setting approaches table AS maximum'
    AlarmActions:
      - !Ref DynamoDBMonitoringSNSTopic
    Namespace: !Ref DynamoDBCustomNamespace
    MetricName: 'ProvisionedReadCapacityAutoScalingPct'
    Dimensions:
      - Name: 'TableName'
        Value: !Ref DynamoDBProvisionedTableName
    Statistic: 'Maximum'
    Unit: 'Percent'
    Threshold: 90
    ComparisonOperator: 'GreaterThanThreshold'
    Period: 60
    EvaluationPeriods: 2

DynamoDBOnDemandTableWriteLimitAlarm:
  Type: 'AWS::CloudWatch::Alarm'
  Properties:
    AlarmName: 'DynamoDBOnDemandTableWriteLimitAlarm'
    AlarmDescription: 'Alarm when consumed table reads approach the account limit'
    AlarmActions:
      - !Ref DynamoDBMonitoringSNSTopic
    Metrics:
      - Id: 'e1'
        Expression: '(((m1 / 300) / m2) * 100)'
        Label: TableWritesOverMaxWriteLimit
      - Id: 'm1'
        MetricStat:
          Metric:
            Namespace: 'AWS/DynamoDB'
            MetricName: 'ConsumedWriteCapacityUnits'
            Dimensions:
              - Name: 'TableName'
                Value: !Ref DynamoDBOnDemandTableName
          Period: 300
          Stat: 'SampleCount'
          Unit: 'Count'
        ReturnData: False
      - Id: 'm2'
        MetricStat:
          Metric:
            Namespace: 'AWS/DynamoDB'
            MetricName: 'AccountMaxTableLevelWrites'
          Period: 300
          Stat: 'Maximum'
        ReturnData: False
    EvaluationPeriods: 2
    Threshold: 90
    ComparisonOperator: 'GreaterThanThreshold'

DynamoDBGTReplLatencyAlarm:
  Type: 'AWS::CloudWatch::Alarm'
  Properties:
    AlarmName: 'DynamoDBGTReplLatencyAlarm'
    AlarmDescription: 'Alarm when global table replication latency exceeds 3 minutes (180k ms)'
    AlarmActions:
      - !Ref DynamoDBMonitoringSNSTopic
    Namespace: 'AWS/DynamoDB'
    MetricName: 'ReplicationLatency'
    Dimensions:
      - Name: 'TableName'
        Value: !Ref DynamoDBGlobalTableName
      - Name: 'ReceivingRegion'
        Value: !Ref DynamoDBGlobalTableReceivingRegion
    Statistic: 'Average'
    Threshold: 180000
    ComparisonOperator: 'GreaterThanThreshold'
    Period: 60
    EvaluationPeriods: 15

DynamoStreamLambdaIteratorAgeAlarm:
  Type: 'AWS::CloudWatch::Alarm'
  Properties:
    AlarmName: 'DynamoStreamLambdaIteratorAgeAlarm'
    AlarmDescription: 'Alarm when lambda iterator age exceeds 30 seconds (30k ms)'
    AlarmActions:
      - !Ref DynamoDBMonitoringSNSTopic
    Namespace: 'AWS/Lambda'
    MetricName: 'IteratorAge'
    Dimensions:
      - Name: 'Function'
        Value: !Ref DynamoDBStreamLambdaFunctionName
      - Name: 'Resource'
        Value: !Ref DynamoDBStreamLambdaFunctionName
    Statistic: 'Average'
    Threshold: 30000
    ComparisonOperator: 'GreaterThanThreshold'
    Period: 60
    EvaluationPeriods: 2

# functions.yml
CreateUser:
  handler: 'src/functions/events/appsync/createUser.handler'
  name: 'CreateUser'

CloudWatchLogsErrorNotify:
  handler: 'src/functions/events/cloudwatch/cloudWatchLogsErrorNotify.handler'
  name: '${self:custom.awsResourcePrefix}CloudWatchLogsErrorNotify'

# SubscriptionFilter
CreateUserErrorNotifySubscriptionFilter:
  Type: 'AWS::Logs::SubscriptionFilter'
  Properties:
    DestinationArn: !GetAtt CloudWatchLogsErrorNotifyLambdaFunction.Arn
    FilterPattern: '{$.level = "ERROR"}'
    LogGroupName: '/aws/lambda/CreateUser'
CreateUserLambdaPermission:
  Type: 'AWS::Lambda::Permission'
  Properties:
    FunctionName: !Ref CloudWatchLogsErrorNotifyLambdaFunction
    Action: lambda:InvokeFunction
    Principal: logs.amazonaws.com
    SourceArn: !Sub 'arn:aws:logs:${self:provider.region}:${AWS::AccountId}:log-group:/aws/lambda/CreateUser:*'

# cloudWatchLogsErrorNotify.handler (typescript)
import zlib from 'zlib';
import { CloudWatchLogsEvent, Context } from 'aws-lambda';
import middy from '@middy/core';
import { injectLambdaContext } from '@aws-lambda-powertools/logger';
import errorCatch from 'middlewares/middy/errorCatch';
import snsService from 'services/snsService'

const { 
  ERROR_NOTIFY_SNS_TOPIC_ARN,  // インシデント通知先のSNSをトピックを設定
  LOG_LEVEL, 
  SERVICE
} = process.env;

const logger = new Logger({
  logLevel: (LOG_LEVEL as LogLevel) || 'INFO',
  serviceName: SERVICE as string,
});

export const handler = middy().use(injectLambdaContext(logger)).use(errorCatch()).handler(async (event: CloudWatchLogsEvent, context: Context) => {
  const payload = Buffer.from(event.awslogs.data, 'base64');
  return new Promise((resolve, reject) => {
    zlib.gunzip(payload, (err: Error, result: Buffer) => {
      if (err) {
        // ログのテキスト情報のデコードに失敗
        return reject(context.fail(err));
      }
      // エラーログ出力
      const json = JSON.stringify(JSON.parse(result.toString('utf-8')), null, '\t');
      const params = {
        Message: json,
        TopicArn: ERROR_NOTIFY_SNS_TOPIC_ARN,
      };
      try {
        const data = new snsService().publish(params).promise();
        logger.info(`Message ${params.Message} sent to the topic ${params.TopicArn}`);
        logger.info('MessageID is ' + data.MessageId);
      } catch(e) {
        logger.error(err);
        reject(err);
      }
    });
  });
});