Best way to create PagerDuty alarm based on Cloudwatch Rule

Question

PagerDuty (PD) has an integration with Cloudwatch (CW), and I use it to get paged whenever a CW alarm is triggered: https://support.pagerduty.com/docs/aws-cloudwatch-integration-guide

I'd like to be paged if a CW rule is triggered. It looks like I can use PD Global Event Routing and then configure the CW input to send the response that the PD Global Event endpoint expects. But I like how the CW alarms publish to a SNS topic and all I have to do is forward the SNS topic message to PD, so it'd be nice if there were something similar for CW rules.

Answer 1

Turns out I can create a CW alarm from a rule using the TriggeredRules metric. Then I can use the existing PagerDuty CW integration. Here's the terraform code I wrote:

data "template_file" "ecs_task_stopped" {
  template = <<EOF
{
  "source": ["aws.ecs"],
  "detail-type": ["ECS Task State Change"],
  "detail": {
    "clusterArn": ["arn:aws:ecs:$${aws_region}:$${account_id}:cluster/$${cluster}"],
    "desiredStatus": ["Running"],
    "lastStatus": ["STOPPED"]
  }
}
EOF

  vars {
    account_id = "${data.aws_caller_identity.current.account_id}"
    cluster    = "${var.ecs_cluster_name}"
    aws_region = "${data.aws_region.current.name}"
  }
}

resource "aws_cloudwatch_event_rule" "ecs_task_stopped" {
  count         = "${var.should_create == "true" ? 1 : 0}"
  name          = "${var.env}_${var.ecs_cluster_name}_task_stopped"
  description   = "${var.env}_${var.ecs_cluster_name} Essential container in task exited"
  event_pattern = "${data.template_file.ecs_task_stopped.rendered}"
}

resource "aws_cloudwatch_metric_alarm" "alarm_task_stopped_rule_triggered" {
  count               = "${var.should_create == "true" ? 1 : 0}"
  alarm_name          = "${var.ecs_cluster_name}-task-stopped"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = "1"
  datapoints_to_alarm = "1"
  metric_name         = "TriggeredRules"
  namespace           = "AWS/Events"
  period              = "60"
  statistic           = "Maximum"
  threshold           = "1"
  alarm_description   = "Essential container in ${var.ecs_cluster_name} task exited"
  alarm_actions       = ["${var.cw_sns_topic_id}"]
  ok_actions          = ["${var.cw_sns_topic_id}"]

  dimensions {
    RuleName = "${aws_cloudwatch_event_rule.ecs_task_stopped.name}"
  }
}