【Hugo×AWS】CloudWatch+SNSで監視・アラート通知

cd hugo-s3-demo-infra/prod
terraform output

cloudfront_distribution_id = "E2XXXXXXXXXX"

# CloudFront metrics are only available in us-east-1
provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}

hugo-s3-demo-infra/
└── prod/
    ├── versions.tf
    ├── backend.tf
    ├── variables.tf
    ├── main.tf          ← us-east-1 provider追記
    ├── iam.tf
    ├── outputs.tf
    ├── sns.tf           ← 新規作成
    └── terraform.tfvars ← 新規作成

# ===========================================
# SNS Topic（通知の送信先）
# us-east-1に作成（CloudFrontメトリクスと同じリージョン）
# ===========================================
resource "aws_sns_topic" "alerts" {
  provider = aws.us_east_1
  name     = "${var.project_name}-alerts"

  tags = {
    Name = "${var.project_name}-alerts"
  }
}

# ===========================================
# メールアドレス変数
# ===========================================
variable "alert_email" {
  description = "Email address for alerts"
  type        = string
  sensitive   = true
}

# ===========================================
# SNS Subscription（メール通知設定）
# ===========================================
resource "aws_sns_topic_subscription" "email" {
  provider  = aws.us_east_1
  topic_arn = aws_sns_topic.alerts.arn
  protocol  = "email"
  endpoint  = var.alert_email
}

# ===========================================
# Output
# ===========================================
output "sns_topic_arn" {
  description = "SNS Topic ARN for CloudWatch Alarms"
  value       = aws_sns_topic.alerts.arn
}

resource "aws_sns_topic" "alerts" {
  provider = aws.us_east_1
  name     = "${var.project_name}-alerts"
}

variable "alert_email" {
  description = "Email address for alerts"
  type        = string
  sensitive   = true
}

resource "aws_sns_topic_subscription" "email" {
  provider  = aws.us_east_1
  topic_arn = aws_sns_topic.alerts.arn
  protocol  = "email"
  endpoint  = var.alert_email
}

alert_email = "your-email@example.com"

terraform plan
terraform apply

aws sns publish \
  --region us-east-1 \
  --topic-arn "arn:aws:sns:us-east-1:123456789012:hugo-s3-demo-alerts" \
  --subject "テスト通知" \
  --message "SNS動作確認テストです。このメールが届けば成功です。"

# ===========================================
# CloudWatch Dashboard
# CloudFrontの主要メトリクスを可視化
# ===========================================

resource "aws_cloudwatch_dashboard" "main" {
  dashboard_name = "${var.project_name}-dashboard"

  dashboard_body = jsonencode({
    widgets = [
      # リクエスト数（時系列グラフ）
      {
        type   = "metric"
        x      = 0
        y      = 0
        width  = 12
        height = 6
        properties = {
          title  = "CloudFront リクエスト数"
          region = "us-east-1"
          metrics = [
            ["AWS/CloudFront", "Requests", "DistributionId", aws_cloudfront_distribution.main.id, "Region", "Global"]
          ]
          period = 300
          stat   = "Sum"
        }
      },
      # エラー率（時系列グラフ）
      {
        type   = "metric"
        x      = 12
        y      = 0
        width  = 12
        height = 6
        properties = {
          title  = "CloudFront エラー率 (%)"
          region = "us-east-1"
          metrics = [
            ["AWS/CloudFront", "4xxErrorRate", "DistributionId", aws_cloudfront_distribution.main.id, "Region", "Global"],
            [".", "5xxErrorRate", ".", ".", ".", "."]
          ]
          period = 300
          stat   = "Average"
        }
      },
      # バイト転送量（時系列グラフ）
      {
        type   = "metric"
        x      = 0
        y      = 6
        width  = 12
        height = 6
        properties = {
          title  = "CloudFront データ転送量 (Bytes)"
          region = "us-east-1"
          metrics = [
            ["AWS/CloudFront", "BytesDownloaded", "DistributionId", aws_cloudfront_distribution.main.id, "Region", "Global"],
            [".", "BytesUploaded", ".", ".", ".", "."]
          ]
          period = 300
          stat   = "Sum"
        }
      },
      # キャッシュヒット率（時系列グラフ）
      {
        type   = "metric"
        x      = 12
        y      = 6
        width  = 12
        height = 6
        properties = {
          title  = "CloudFront キャッシュヒット率 (%)"
          region = "us-east-1"
          metrics = [
            ["AWS/CloudFront", "CacheHitRate", "DistributionId", aws_cloudfront_distribution.main.id, "Region", "Global"]
          ]
          period = 300
          stat   = "Average"
        }
      }
    ]
  })
}

output "cloudwatch_dashboard_url" {
  description = "CloudWatch Dashboard URL"
  value       = "https://ap-northeast-1.console.aws.amazon.com/cloudwatch/home?region=ap-northeast-1#dashboards:name=${aws_cloudwatch_dashboard.main.dashboard_name}"
}

dashboard_body = jsonencode({
  widgets = [
    {
      type   = "metric"
      x      = 0      # 左端からの位置
      y      = 0      # 上端からの位置
      width  = 12     # 幅（最大24）
      height = 6      # 高さ
      properties = {
        # ウィジェットの設定
      }
    }
  ]
})

properties = {
  region = "us-east-1"
  # ...
}

terraform apply

# ===========================================
# CloudWatch Alarms
# エラー率が閾値を超えたらSNS通知
# us-east-1に作成（CloudFrontメトリクスと同じリージョン）
# ===========================================

# 5xxエラー率アラーム（サーバーエラー）
resource "aws_cloudwatch_metric_alarm" "error_5xx" {
  provider            = aws.us_east_1
  alarm_name          = "${var.project_name}-5xx-error-rate"
  alarm_description   = "CloudFront 5xxエラー率が1%を超えた場合にアラート"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 2
  metric_name         = "5xxErrorRate"
  namespace           = "AWS/CloudFront"
  period              = 300
  statistic           = "Average"
  threshold           = 1
  treat_missing_data  = "notBreaching"

  dimensions = {
    DistributionId = aws_cloudfront_distribution.main.id
    Region         = "Global"
  }

  alarm_actions = [aws_sns_topic.alerts.arn]
  ok_actions    = [aws_sns_topic.alerts.arn]

  tags = {
    Name = "${var.project_name}-5xx-error-rate"
  }
}

# 4xxエラー率アラーム（クライアントエラー）
resource "aws_cloudwatch_metric_alarm" "error_4xx" {
  provider            = aws.us_east_1
  alarm_name          = "${var.project_name}-4xx-error-rate"
  alarm_description   = "CloudFront 4xxエラー率が5%を超えた場合にアラート"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 2
  metric_name         = "4xxErrorRate"
  namespace           = "AWS/CloudFront"
  period              = 300
  statistic           = "Average"
  threshold           = 5
  treat_missing_data  = "notBreaching"

  dimensions = {
    DistributionId = aws_cloudfront_distribution.main.id
    Region         = "Global"
  }

  alarm_actions = [aws_sns_topic.alerts.arn]
  ok_actions    = [aws_sns_topic.alerts.arn]

  tags = {
    Name = "${var.project_name}-4xx-error-rate"
  }
}

resource "aws_cloudwatch_metric_alarm" "error_5xx" {
  provider            = aws.us_east_1               # us-east-1に作成
  comparison_operator = "GreaterThanThreshold"      # 閾値を超えたらアラート
  evaluation_periods  = 2                           # 2回連続で閾値超過したらアラート
  period              = 300                         # 5分間隔で評価
  threshold           = 1                           # 1%を閾値とする
  treat_missing_data  = "notBreaching"              # データなしは正常扱い
}

alarm_actions = [aws_sns_topic.alerts.arn]  # アラート発火時
ok_actions    = [aws_sns_topic.alerts.arn]  # アラート解消時

terraform apply

# ===========================================
# AWS Budgets
# 月額コストが閾値を超えたらメール通知
# ===========================================

resource "aws_budgets_budget" "monthly" {
  name         = "${var.project_name}-monthly-budget"
  budget_type  = "COST"
  limit_amount = "5"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  # 80%到達で通知
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.alert_email]
  }

  # 100%到達で通知
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.alert_email]
  }

  # 予測で100%超過しそうな場合に通知
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = [var.alert_email]
  }
}

limit_amount = "5"      # $5/月
limit_unit   = "USD"
time_unit    = "MONTHLY"

terraform apply

terraform output

sns_topic_arn = "arn:aws:sns:us-east-1:123456789012:hugo-s3-demo-alerts"
cloudwatch_dashboard_url = "https://ap-northeast-1.console.aws.amazon.com/cloudwatch/home?region=ap-northeast-1#dashboards:name=hugo-s3-demo-dashboard"

terraform destroy -target=aws_sns_topic_subscription.email
terraform apply

# アラームのリージョンを確認
aws cloudwatch describe-alarms \
  --alarm-names "hugo-s3-demo-5xx-error-rate" \
  --region us-east-1 \
  --query 'MetricAlarms[0].StateValue'

terraform force-unlock {LOCK_ID}