AWS DevOps Agent で CloudWatch アラームをトリガーに自動インシデント調査を行えるか試してみた #AWSreInvent

// index.mjs
import { createHmac } from "node:crypto";
import https from "node:https";
import { URL } from "node:url";

const EVENT_AI_WEBHOOK_URL = process.env.EVENT_AI_WEBHOOK_URL;
const EVENT_AI_SECRET = process.env.EVENT_AI_SECRET;

export const handler = async (event) => {
  try {
    console.log("Raw CloudWatch Alarm event:", JSON.stringify(event, null, 2));

    if (event.source !== "aws.cloudwatch" || !event.alarmData) {
      console.log("Unsupported event, skipping:", event.source);
      return { statusCode: 200, body: "Ignored" };
    }

    const alarmData = event.alarmData;
    const alarmName = alarmData.alarmName || "UnknownAlarm";
    const state = alarmData.state || {};
    const stateValue = state.value || "UNKNOWN"; // ALARM | OK | INSUFFICIENT_DATA
    const reason = state.reason || "";
    const reasonData = state.reasonData || "";
    const alarmArn =
      event.alarmArn ||
      `arn:aws:cloudwatch:${event.region}:${event.accountId}:alarm:${alarmName}`;

    // InstanceId 抽出（取得できなければスキップ）
    let instanceId = "";
    try {
      const metrics = alarmData.configuration?.metrics || [];
      const metric = metrics[0];
      const dims = metric?.metricStat?.metric?.dimensions;
      if (dims && typeof dims.InstanceId === "string") {
        instanceId = dims.InstanceId;
      }
    } catch {
       // noop
    }

    // description を組み立て:
    // 既存の reason に加え region, InstanceId, reasonData を連結
    const descriptionLines = [];

    if (reason) {
      descriptionLines.push(`Reason: ${reason}`);
    }

    if (event.region) {
      descriptionLines.push(`Region: ${event.region}`);
    }

    if (instanceId) {
      descriptionLines.push(`InstanceId: ${instanceId}`);
    }

    if (reasonData) {
      descriptionLines.push(`ReasonData: ${reasonData}`);
    }

    const description = descriptionLines.join("\n");

    // action マッピング
    let action = "updated";
    if (stateValue === "ALARM") action = "created";
    else if (stateValue === "OK") action = "resolved";

    const priority = "HIGH";

    let timestamp;
    try {
      timestamp = new Date(event.time).toISOString();
    } catch {
      timestamp = new Date().toISOString();
    }

    const payload = {
      eventType: "incident",
      incidentId: alarmArn,
      action,
      priority,
      title: `CloudWatch Alarm: ${alarmName} is ${stateValue}`,
      description,
      timestamp,
      service: "cloudwatch",
      data: alarmData
    };

    const payloadString = JSON.stringify(payload);
    const tsHeader = new Date().toISOString();

    // HMAC-SHA256(`${timestamp}:${payload}`) → base64
    const hmac = createHmac("sha256", EVENT_AI_SECRET);
    hmac.update(`${tsHeader}:${payloadString}`, "utf8");
    const signature = hmac.digest("base64");

    const url = new URL(EVENT_AI_WEBHOOK_URL);

    const options = {
      hostname: url.hostname,
      path: url.pathname + url.search,
      method: "POST",
      port: url.port || 443,
      headers: {
        "Content-Type": "application/json",
        "x-amzn-event-timestamp": tsHeader,
        "x-amzn-event-signature": signature,
        "Content-Length": Buffer.byteLength(payloadString)
      }
    };

    console.log("Sending payload to event-ai:", payload);

    const response = await new Promise((resolve, reject) => {
      const req = https.request(options, (res) => {
        let data = "";
        res.on("data", (chunk) => {
          data += chunk;
        });
        res.on("end", () => {
          resolve({
            statusCode: res.statusCode || 200,
            body: data
          });
        });
      });

      req.on("error", (err) => reject(err));
      req.write(payloadString);
      req.end();
    });

    console.log("event-ai response:", response.statusCode, response.body);
    return response;
  } catch (err) {
    console.error("Error in CloudWatch Alarm → event-ai handler:", err);
    return {
      statusCode: 500,
      body: "Internal server error"
    };
  }
};

stress -c 4