fix(aws-backup): avoid duplicated and ill-routed alerts

modules/integration_aws-backup/README.md

@@ -23,8 +23,9 @@ existing [stack](https://github.com/claranet/terraform-signalfx-detectors/wiki/G
 module "signalfx-detectors-integration-aws-backup" {
   source = "github.com/claranet/terraform-signalfx-detectors.git//modules/integration_aws-backup?ref={revision}"
 
-  environment   = var.environment
-  notifications = local.notifications
+  environment    = var.environment
+  notifications  = local.notifications
+  aws_account_id = "fillme"
 }
 ```
 
@@ -57,7 +58,7 @@ Note the following parameters:
 
 These 3 parameters along with all variables defined in [common-variables.tf](common-variables.tf) are common to all
 [modules](../) in this repository. Other variables, specific to this module, are available in
-[variables-gen.tf](variables-gen.tf).
+[variables.tf](variables.tf) and [variables-gen.tf](variables-gen.tf).
 In general, the default configuration "works" but all of these Terraform
 [variables](https://www.terraform.io/language/values/variables) make it possible to
 customize the detectors behavior to better fit your needs.

modules/integration_aws-backup/common-filters.tf

@@ -1,3 +1,11 @@
+# Common filters at ../../common/module/filters-integration-aws.tf are not used
+# with AWS Backup because recovery points (snapshots) and jobs are unlikely to
+# be tagged with `env` and `sfx_monitored`.
+#
+# We are also assuming that we want to be notified for every backup vault and
+# resource types. `match_missing=False` is required to avoid duplicated signal
+# and alerts, since CloudWatch returns aggregated metric, and per vault and
+# resource type.
 locals {
-  filters = "filter('ResourceType', '*')"
-}
+  filters = format("filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False) and filter('aws_account_id', '%s')", var.aws_account_id)
+}

modules/integration_aws-backup/conf/00-aws-backup-failed.yaml

@@ -4,7 +4,7 @@ id: backup_failed
 
 transformation: ".max(over='1d').fill(0)"
 aggregation: true
-filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum')"
+filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)"
 
 signals:
   signal:

modules/integration_aws-backup/conf/01-aws-backup-job-expired.yaml

@@ -4,7 +4,7 @@ id: backup_job_expired
 
 transformation: ".max(over='1d').fill(0)"
 aggregation: true
-filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum')"
+filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)"
 
 signals:
   signal:

modules/integration_aws-backup/conf/03-aws-backup-check.yaml

@@ -4,7 +4,7 @@ id: backup_successful
 
 transformation: ".min(over='23h')"
 aggregation: true
-filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum')"
+filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)"
 
 signals:
   created:

modules/integration_aws-backup/conf/04-aws-backup-rp-partial.yaml

@@ -4,7 +4,7 @@ id: backup_rp_partial
 
 transformation: ".max(over='1d').fill(0)"
 aggregation: true
-filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum')"
+filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)"
 
 signals:
   signal:

modules/integration_aws-backup/conf/05-aws-backup-rp-expired.yaml

@@ -4,7 +4,7 @@ id: backup_rp_expired
 
 transformation: ".max(over='1d').fill(0)"
 aggregation: true
-filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum')"
+filtering: "filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)"
 
 signals:
   signal:

modules/integration_aws-backup/detectors-gen.tf

@@ -6,7 +6,7 @@ resource "signalfx_detector" "backup_failed" {
   tags                    = compact(concat(local.common_tags, local.tags, var.extra_tags))
 
   program_text = <<-EOF
-    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum')
+    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)
     signal = data('NumberOfBackupJobsFailed', filter=base_filtering and ${module.filtering.signalflow})${var.backup_failed_aggregation_function}${var.backup_failed_transformation_function}.publish('signal')
     detect(when(signal > ${var.backup_failed_threshold_critical}, lasting=%{if var.backup_failed_lasting_duration_critical == null}None%{else}'${var.backup_failed_lasting_duration_critical}'%{endif}, at_least=${var.backup_failed_at_least_percentage_critical})).publish('CRIT')
 EOF
@@ -34,7 +34,7 @@ resource "signalfx_detector" "backup_job_expired" {
   tags                    = compact(concat(local.common_tags, local.tags, var.extra_tags))
 
   program_text = <<-EOF
-    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum')
+    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)
     signal = data('NumberOfBackupJobsExpired', filter=base_filtering and ${module.filtering.signalflow}, extrapolation='zero')${var.backup_job_expired_aggregation_function}${var.backup_job_expired_transformation_function}.publish('signal')
     detect(when(signal > ${var.backup_job_expired_threshold_critical}, lasting=%{if var.backup_job_expired_lasting_duration_critical == null}None%{else}'${var.backup_job_expired_lasting_duration_critical}'%{endif}, at_least=${var.backup_job_expired_at_least_percentage_critical})).publish('CRIT')
 EOF
@@ -90,7 +90,7 @@ resource "signalfx_detector" "backup_successful" {
   tags                    = compact(concat(local.common_tags, local.tags, var.extra_tags))
 
   program_text = <<-EOF
-    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum')
+    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)
     created = data('NumberOfBackupJobsCreated', filter=base_filtering and ${module.filtering.signalflow}, extrapolation='zero')${var.backup_successful_aggregation_function}${var.backup_successful_transformation_function}
     completed = data('NumberOfBackupJobsCompleted', filter=base_filtering and ${module.filtering.signalflow}, extrapolation='zero')${var.backup_successful_aggregation_function}${var.backup_successful_transformation_function}
     signal = (created-completed).publish('signal')
@@ -120,7 +120,7 @@ resource "signalfx_detector" "backup_rp_partial" {
   tags                    = compact(concat(local.common_tags, local.tags, var.extra_tags))
 
   program_text = <<-EOF
-    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum')
+    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)
     signal = data('NumberOfRecoveryPointsPartial', filter=base_filtering and ${module.filtering.signalflow})${var.backup_rp_partial_aggregation_function}${var.backup_rp_partial_transformation_function}.publish('signal')
     detect(when(signal > ${var.backup_rp_partial_threshold_minor}, lasting=%{if var.backup_rp_partial_lasting_duration_minor == null}None%{else}'${var.backup_rp_partial_lasting_duration_minor}'%{endif}, at_least=${var.backup_rp_partial_at_least_percentage_minor})).publish('MINOR')
 EOF
@@ -148,7 +148,7 @@ resource "signalfx_detector" "backup_rp_expired" {
   tags                    = compact(concat(local.common_tags, local.tags, var.extra_tags))
 
   program_text = <<-EOF
-    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum')
+    base_filtering = filter('namespace', 'AWS/Backup') and filter('stat', 'sum') and filter('BackupVaultName', '*', match_missing=False) and filter('ResourceType', '*', match_missing=False)
     signal = data('NumberOfRecoveryPointsExpired', filter=base_filtering and ${module.filtering.signalflow})${var.backup_rp_expired_aggregation_function}${var.backup_rp_expired_transformation_function}.publish('signal')
     detect(when(signal > ${var.backup_rp_expired_threshold_major}, lasting=%{if var.backup_rp_expired_lasting_duration_major == null}None%{else}'${var.backup_rp_expired_lasting_duration_major}'%{endif}, at_least=${var.backup_rp_expired_at_least_percentage_major})).publish('MAJOR')
 EOF

modules/integration_aws-backup/variables.tf

@@ -0,0 +1,3 @@
+variable "aws_account_id" {
+  type = string
+}