Terraform で CloudWatch Synthetics の外形監視を構築し挙動を確認してみた

resource "aws_s3_bucket" "canary_artifacts" {
  bucket        = "${var.project_name}-artifacts-${data.aws_caller_identity.current.account_id}"
  force_destroy = true

  tags = {
    Name = "${var.project_name}-canary-artifacts"
  }
}

resource "aws_iam_role" "canary" {
  name = "${var.project_name}-canary-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "lambda.amazonaws.com" }
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy" "canary" {
  name = "${var.project_name}-canary-policy"
  role = aws_iam_role.canary.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["s3:PutObject", "s3:GetObject"]
        Resource = ["${aws_s3_bucket.canary_artifacts.arn}/*"]
      },
      {
        Effect   = "Allow"
        Action   = ["s3:GetBucketLocation"]
        Resource = [aws_s3_bucket.canary_artifacts.arn]
      },
      {
        Effect   = "Allow"
        Action   = ["s3:ListAllMyBuckets"]
        Resource = ["*"]
      },
      {
        Effect   = "Allow"
        Action   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = ["arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/cwsyn-*"]
      },
      {
        Effect   = "Allow"
        Action   = ["xray:PutTraceSegments"]
        Resource = ["*"]
      },
      {
        Effect   = "Allow"
        Action   = ["cloudwatch:PutMetricData"]
        Resource = ["*"]
        Condition = {
          StringEquals = {
            "cloudwatch:namespace" = "CloudWatchSynthetics"
          }
        }
      }
    ]
  })
}

resource "local_file" "canary_script" {
  content = templatefile("${path.module}/templates/canary.js.tpl", {
    target_url = "https://${aws_cloudfront_distribution.web.domain_name}"
  })
  filename = "${path.module}/build/nodejs/node_modules/canary.js"
}

data "archive_file" "canary" {
  type        = "zip"
  source_dir  = "${path.module}/build"
  output_path = "${path.module}/build/canary.zip"

  depends_on = [local_file.canary_script]
}

resource "aws_synthetics_canary" "web" {
  name                 = "invest-heartbeat"
  artifact_s3_location = "s3://${aws_s3_bucket.canary_artifacts.bucket}/canary/"
  execution_role_arn   = aws_iam_role.canary.arn
  handler              = "canary.handler"
  zip_file             = data.archive_file.canary.output_path
  runtime_version      = "syn-nodejs-puppeteer-10.0"
  start_canary         = true

  success_retention_period = 2
  failure_retention_period = 14

  schedule {
    expression = var.canary_schedule_expression
  }

  depends_on = [aws_iam_role_policy.canary]
}

const synthetics = require('Synthetics');
const log = require('SyntheticsLogger');

const heartbeatCheck = async function () {
    const url = "https://xxxxxxx.cloudfront.net";
    let page = await synthetics.getPage();
    const response = await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 });

    if (!response) {
        throw new Error(`No response returned for url: ${url}`);
    }

    const statusCode = response.status();
    if (statusCode < 200 || statusCode > 299) {
        throw new Error(`Failed to load url: ${url} . Status code: ${statusCode}`);
    }

    log.info(`Loaded ${url} with status ${statusCode}`);
    await synthetics.takeScreenshot('loaded', 'loaded');
};

exports.handler = async () => {
    return await heartbeatCheck();
};