EC2のシステムアラート作成・削除をEventBridge＋Lambdaで自動化してみた

# 必要なライブラリのインポート
import boto3
import json
import os
import logging

# ログレベルの設定
logger = logging.getLogger()
logger.setLevel(logging.INFO)

def lambda_handler(event, context):
    cloudwatch = boto3.client('cloudwatch')
    logger.info(f"Received event: {json.dumps(event)}")

    # EC2インスタンスの起動イベント
    if event['detail']['state'] == 'running':
        instance_id = event['detail']['instance-id']
        logger.info(f"Processing running state for instance: {instance_id}")

        try:
            # アラームが既に存在するかチェック
            response = cloudwatch.describe_alarms(
                AlarmNames=[f'{instance_id}-StatusCheckFailed']
            )

            if response['MetricAlarms']:
                logger.info(f"Alarm already exists for instance: {instance_id}")
                return {
                    'statusCode': 200,
                    'body': json.dumps(f'Alarm already exists for {instance_id}')
                }

            # アラームを作成
            cloudwatch.put_metric_alarm(
                AlarmName=f'{instance_id}-StatusCheckFailed',
                ComparisonOperator='GreaterThanThreshold',
                EvaluationPeriods=2,
                MetricName='StatusCheckFailed',
                Namespace='AWS/EC2',
                Period=60,
                Statistic='Maximum',
                Threshold=0.0,
                ActionsEnabled=True,
                AlarmActions=[
                    os.environ['SNS_TOPIC_ARN']
                ],
                AlarmDescription='EC2 Status Check Failed',
                Dimensions=[
                    {
                        'Name': 'InstanceId',
                        'Value': instance_id
                    }
                ]
            )
            logger.info(f"Successfully created alarm for instance: {instance_id}")

        except Exception as e:
            logger.error(f"Failed to create alarm for {instance_id}: {str(e)}")
            raise

    # インスタンス終了時のみAlarmを削除（停止時は削除しない）
    elif event['detail']['state'] == 'terminated':
        instance_id = event['detail']['instance-id']
        logger.info(f"Processing terminated state for instance: {instance_id}")

        try:
            response = cloudwatch.describe_alarms(
                AlarmNames=[f'{instance_id}-StatusCheckFailed']
            )

            if response['MetricAlarms']:
                cloudwatch.delete_alarms(
                    AlarmNames=[f'{instance_id}-StatusCheckFailed']
                )
                logger.info(f"Successfully deleted alarm for instance: {instance_id}")
            else:
                logger.warning(f"No alarm found for instance: {instance_id}")

        except cloudwatch.exceptions.ResourceNotFound:
            logger.warning(f"Alarm not found for instance: {instance_id}")
        except Exception as e:
            logger.error(f"Failed to delete alarm for {instance_id}: {str(e)}")

    # 停止時は何もしない（アラームを保持）
    elif event['detail']['state'] == 'stopped':
        instance_id = event['detail']['instance-id']
        logger.info(f"Instance {instance_id} stopped - keeping alarm intact")

    # 想定外の状態
    else:
        instance_id = event['detail'].get('instance-id', 'unknown')
        state = event['detail'].get('state', 'unknown')
        logger.warning(f"Unhandled state '{state}' for instance: {instance_id}")

    return {
        'statusCode': 200,
        'body': json.dumps('Successfully processed EC2 state change')
    }