当我的 Cloudwatch 警报进入“ALARM”状态时尝试触发 SSM:Run Command 操作答案

【问题标题】：Trying to trigger a SSM:Run Command action when my Cloudwatch alarm enters "ALARM" state当我的 Cloudwatch 警报进入“ALARM”状态时尝试触发 SSM:Run Command 操作
【发布时间】：2019-11-07 14:03:20
【问题描述】：

当我的 cloudwatch 警报进入“ALARM”状态时，尝试触发 SSM:Run Command 操作。我正在尝试使用 Cloudwatch 规则 - 事件模式并通过获取 AWS Cloud Trail API 日志来实现这一点。

尝试将监控和事件名称设为“DescribeAlarms”，将 stateValue 设为“ALARM”。刚刚尝试添加我的 SNS 主题（而不是 SSM:RunCommand）以验证它在进入 ALARM 状态时会触发给我的电子邮件，但没有运气。

```{
  "source": [
    "aws.monitoring"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "monitoring.amazonaws.com"
    ],
    "eventName": [
      "DescribeAlarms"
    ],
    "requestParameters": {
      "stateValue": [
        "ALARM"
      ]
    }
  }
}```

我期待何时满足此条件 - 任何进入 ALARM 状态的警报都应该击中目标 - 这是我的 SNS 主题。

更新：

感谢@John 的澄清。正如您所建议的，我正在尝试使用 SNS-> Lambda-> SSM 运行命令。但我无法从 SNS 事件中获取实例 ID。它显示 [记录 - 密钥错误]。阅读您的一些帖子并尝试了所有。但无法通过。你能帮忙吗？

Received event: {
"Records": [
{
"EventSource": "aws:sns",
"EventVersion": "1.0",
"EventSubscriptionArn": "arn:aws:sns:eu-west-1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"Sns": {
"Type": "Notification",
"MessageId": "********************c",
"TopicArn": "arn:aws:sns:eu-west-1:*******************************",
"Subject": "ALARM: \"!!! Critical Alert !!! Disk Space is going to be full in Automation Testing\" in EU (Ireland)",
"Message": "{\"AlarmName\":\"!!! Critical Alert !!! Disk Space is going to be full in Automation Testing\",\"AlarmDescription\":\"Disk Space is going to be full in Automation Testing\",\"AWSAccountId\":\"***********\",\"NewStateValue\":\"ALARM\",\"NewStateReason\":\"Threshold Crossed: 1 out of the last 1 datapoints [**********] was less than or equal to the threshold (70.0) (minimum 1 datapoint for OK -> ALARM transition).\",\"StateChangeTime\":\"******************\",\"Region\":\"EU (Ireland)\",\"OldStateValue\":\"OK\",\"Trigger\":{\"MetricName\":\"disk_used_percent\",\"Namespace\":\"CWAgent\",\"StatisticType\":\"Statistic\",\"Statistic\":\"AVERAGE\",\"Unit\":null,\"Dimensions\":[{\"value\":\"/\",\"name\":\"path\"},{\"value\":\"i-****************\",\"name\":\"InstanceId\"},{\"value\":\"ami-****************\",\"name\":\"ImageId\"},{\"value\":\"t2.micro\",\"name\":\"InstanceType\"},{\"value\":\"xvda1\",\"name\":\"device\"},{\"value\":\"xfs\",\"name\":\"fstype\"}],\"Period\":300,\"EvaluationPeriods\":1,\"ComparisonOperator\":\"LessThanOrEqualToThreshold\",\"Threshold\":70.0,\"TreatMissingData\":\"- TreatMissingData: missing\",\"EvaluateLowSampleCountPercentile\":\"\"}}",
"Timestamp": "2019-06-29T19:23:43.829Z",
"SignatureVersion": "1",
"Signature": "XXXXXXXXXXXX",
"SigningCertUrl": "https://sns.eu-west-1.amazonaws.com/XXXXXXXX.pem",
"UnsubscribeUrl": "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1XXXXXXXXXXXXXXXXXXXXX",
"MessageAttributes":
{}

}
}
]
}

下面是我的 Lambda 函数：

from __future__ import print_function
import boto3
import json
ssm = boto3.client('ssm')
ec2 = boto3.resource('ec2')

print('Loading function')

def lambda_handler(event, context):
    # Dump the event to the log, for debugging purposes
    print("Received event: " + json.dumps(event, indent=2))

    message = event['Records']['Sns']['Message']
    msg = json.loads(message)
    InstanceId = msg['InstanceId']['value']
    print ("Instance: %s" % InstanceId)

【问题讨论】：

标签： json python-3.x amazon-web-services aws-lambda amazon-cloudwatch

【解决方案1】：

这可能行不通，因为 AWS CloudTrail 仅捕获对 AWS 的 API 调用，而 CloudWatch 警报进入 ALARM 状态是一种内部变化，即不是由 API 调用引起的。

我会推荐：

Amazon CloudWatch 警报触发 AWS Lambda 函数
Lambda 函数调用 SSM 运行命令（例如 send_command()）

【讨论】：

刚刚对此感到困惑 - docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/…。似乎 - 我们可以通过 API 调用检索警报。我是否以错误的方式理解它？谢谢！
您的配置将查找对 DescribeAlarms API 的调用，该 API 专门查找处于 ALARM 状态的警报（例如，如果您使用管理控制台并转到列出警报），但当警报本身进入 ALARM 状态时，它不会做任何事情。
谢谢@John。但是 alarmActions.member 会做什么。基本上下面代码的结果是什么-
``` { "source": [ "aws.monitoring" ], "detail-type": [ "AWS API Call via CloudTrail" ], "detail": { "eventSource": [ “monitoring.amazonaws.com”]，“eventName”：[“DescribeAlarms”]，“requestParameters”：{“alarmNames.member.1”：[“awsec2-i-************ ********-CPU-Utilization" ], "stateValue": [ "ALARM" ] }, "responseElements": { "metricAlarms.member.1": { "alarmActions.member.1": [" arn:aws:sns:us-west-2:******:****"``` ] } } }
这里 - docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/… - AlarmActions 表示它一旦注意到警报就会执行的操作

【解决方案2】：

可以通过以下更改实现：

from __future__ import print_function
import boto3
import json
ssm = boto3.client('ssm')
ec2 = boto3.resource('ec2')

print('Loading function')

def lambda_handler(event, context):
    # Dump the event to the log, for debugging purposes
    print("Received event: " + json.dumps(event, indent=2))
    message = json.loads(event['Records'][0]['Sns']['Message'])
    instance_id = message['Trigger']['Dimensions'][1]['value']
    print ("Instance: %s" % instance_id)

【讨论】：