Merge branch 'feature/PI-670-billing_alarms' into release/2025-01-02

jameslinnell · jameslinnell · commit 7f25ddff03f4 · 2025-01-03T09:22:08.000Z
diff --git a/infrastructure/terraform/per_account/dev/main.tf b/infrastructure/terraform/per_account/dev/main.tf
@@ -27,6 +27,13 @@ JSON
   }
 }
 
+module "billing_alarms" {
+  source      = "../modules/billing_alarms"
+  project     = local.project
+  limit       = var.budget_limit
+  environment = terraform.workspace
+}
+
 module "iam__api-gateway-to-cloudwatch" {
   source  = "../modules/iam__api-gateway-to-cloudwatch"
   project = local.project
diff --git a/infrastructure/terraform/per_account/dev/terraform.tf b/infrastructure/terraform/per_account/dev/terraform.tf
@@ -13,5 +13,17 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 5.20.0"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.0"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "~> 2.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.0"
+    }
   }
 }
diff --git a/infrastructure/terraform/per_account/dev/vars.tf b/infrastructure/terraform/per_account/dev/vars.tf
@@ -21,3 +21,8 @@ variable "updated_date" {
 variable "workspace_type" {
   default = "PERSISTENT"
 }
+
+variable "budget_limit" {
+  default = "1050"
+  type    = string
+}
diff --git a/infrastructure/terraform/per_account/int/main.tf b/infrastructure/terraform/per_account/int/main.tf
@@ -27,6 +27,13 @@ JSON
   }
 }
 
+module "billing_alarms" {
+  source      = "../modules/billing_alarms"
+  project     = local.project
+  limit       = var.budget_limit
+  environment = terraform.workspace
+}
+
 module "iam__api-gateway-to-cloudwatch" {
   source  = "../modules/iam__api-gateway-to-cloudwatch"
   project = local.project
diff --git a/infrastructure/terraform/per_account/int/vars.tf b/infrastructure/terraform/per_account/int/vars.tf
@@ -21,3 +21,8 @@ variable "updated_date" {
 variable "workspace_type" {
   default = "PERSISTENT"
 }
+
+variable "budget_limit" {
+  default = "385"
+  type    = string
+}
diff --git a/infrastructure/terraform/per_account/mgmt/main.tf b/infrastructure/terraform/per_account/mgmt/main.tf
@@ -27,6 +27,13 @@ JSON
   }
 }
 
+module "billing_alarms" {
+  source      = "../modules/billing_alarms"
+  project     = local.project
+  limit       = var.budget_limit
+  environment = terraform.workspace
+}
+
 module "route53" {
   source    = "./modules/route53"
   workspace = terraform.workspace
diff --git a/infrastructure/terraform/per_account/mgmt/vars.tf b/infrastructure/terraform/per_account/mgmt/vars.tf
@@ -21,3 +21,8 @@ variable "updated_date" {
 variable "workspace_type" {
   default = "PERSISTENT"
 }
+
+variable "budget_limit" {
+  default = "450"
+  type    = string
+}
diff --git a/infrastructure/terraform/per_account/modules/billing_alarms/main.tf b/infrastructure/terraform/per_account/modules/billing_alarms/main.tf
@@ -0,0 +1,49 @@
+resource "aws_ssm_parameter" "billing_alert_subscribers" {
+  name  = "${var.project}-billing-subscribers"
+  type  = "StringList"
+  value = "rowan.gill1@nhs.net,warran.mavrodaris2@nhs.net"
+}
+
+data "aws_ssm_parameter" "billing_alert_subscribers" {
+  name = aws_ssm_parameter.billing_alert_subscribers.name
+}
+
+resource "aws_budgets_budget" "cpm_budget" {
+  name         = "${var.project}-monthly-budget-${var.environment}"
+  budget_type  = "COST"
+  limit_amount = var.limit
+  limit_unit   = "USD"
+  time_unit    = "MONTHLY"
+
+  notification {
+    comparison_operator        = "GREATER_THAN"
+    threshold                  = 50
+    threshold_type             = "PERCENTAGE"
+    notification_type          = "ACTUAL"
+    subscriber_email_addresses = split(",", data.aws_ssm_parameter.billing_alert_subscribers.value)
+  }
+
+  notification {
+    comparison_operator        = "GREATER_THAN"
+    threshold                  = 75
+    threshold_type             = "PERCENTAGE"
+    notification_type          = "ACTUAL"
+    subscriber_email_addresses = split(",", data.aws_ssm_parameter.billing_alert_subscribers.value)
+  }
+
+  notification {
+    comparison_operator        = "GREATER_THAN"
+    threshold                  = 90
+    threshold_type             = "PERCENTAGE"
+    notification_type          = "ACTUAL"
+    subscriber_email_addresses = split(",", data.aws_ssm_parameter.billing_alert_subscribers.value)
+  }
+
+  notification {
+    comparison_operator        = "GREATER_THAN"
+    threshold                  = 100
+    threshold_type             = "PERCENTAGE"
+    notification_type          = "ACTUAL"
+    subscriber_email_addresses = split(",", data.aws_ssm_parameter.billing_alert_subscribers.value)
+  }
+}
diff --git a/infrastructure/terraform/per_account/modules/billing_alarms/vars.tf b/infrastructure/terraform/per_account/modules/billing_alarms/vars.tf
@@ -0,0 +1,13 @@
+variable "limit" {
+  type    = string
+  default = "1000"
+}
+
+variable "project" {
+  type = string
+}
+
+variable "environment" {
+  type    = string
+  default = "prod"
+}
diff --git a/infrastructure/terraform/per_account/prod/main.tf b/infrastructure/terraform/per_account/prod/main.tf
@@ -27,6 +27,13 @@ JSON
   }
 }
 
+module "billing_alarms" {
+  source      = "../modules/billing_alarms"
+  project     = local.project
+  limit       = var.budget_limit
+  environment = terraform.workspace
+}
+
 module "iam__api-gateway-to-cloudwatch" {
   source  = "../modules/iam__api-gateway-to-cloudwatch"
   project = local.project
diff --git a/infrastructure/terraform/per_account/prod/vars.tf b/infrastructure/terraform/per_account/prod/vars.tf
@@ -21,3 +21,8 @@ variable "updated_date" {
 variable "workspace_type" {
   default = "PERSISTENT"
 }
+
+variable "budget_limit" {
+  default = "1300"
+  type    = string
+}
diff --git a/infrastructure/terraform/per_account/qa/main.tf b/infrastructure/terraform/per_account/qa/main.tf
@@ -27,6 +27,13 @@ JSON
   }
 }
 
+module "billing_alarms" {
+  source      = "../modules/billing_alarms"
+  project     = local.project
+  limit       = var.budget_limit
+  environment = terraform.workspace
+}
+
 module "iam__api-gateway-to-cloudwatch" {
   source  = "../modules/iam__api-gateway-to-cloudwatch"
   project = local.project
diff --git a/infrastructure/terraform/per_account/qa/vars.tf b/infrastructure/terraform/per_account/qa/vars.tf
@@ -21,3 +21,8 @@ variable "updated_date" {
 variable "workspace_type" {
   default = "PERSISTENT"
 }
+
+variable "budget_limit" {
+  default = "475"
+  type    = string
+}
diff --git a/infrastructure/terraform/per_account/ref/main.tf b/infrastructure/terraform/per_account/ref/main.tf
@@ -27,6 +27,13 @@ JSON
   }
 }
 
+module "billing_alarms" {
+  source      = "../modules/billing_alarms"
+  project     = local.project
+  limit       = var.budget_limit
+  environment = terraform.workspace
+}
+
 module "iam__api-gateway-to-cloudwatch" {
   source  = "../modules/iam__api-gateway-to-cloudwatch"
   project = local.project
diff --git a/infrastructure/terraform/per_account/ref/vars.tf b/infrastructure/terraform/per_account/ref/vars.tf
@@ -21,3 +21,8 @@ variable "updated_date" {
 variable "workspace_type" {
   default = "PERSISTENT"
 }
+
+variable "budget_limit" {
+  default = "600"
+  type    = string
+}
diff --git a/scripts/infrastructure/policies/deployment2-policy.json b/scripts/infrastructure/policies/deployment2-policy.json
@@ -256,7 +256,27 @@
         "acm:ListCertificates",
         "resource-groups:ListGroups",
         "lambda:ListEventSourceMappings",
-        "iam:ListRoles"
+        "iam:ListRoles",
+        "SNS:GetTopicAttributes",
+        "cloudwatch:DescribeAlarms",
+        "cloudwatch:DeleteAlarms",
+        "cloudwatch:ListTagsForResource",
+        "SNS:ListTagsForResource",
+        "budgets:ModifyBudget",
+        "budgets:ViewBudget",
+        "SNS:DeleteTopic",
+        "SNS:CreateTopic",
+        "SNS:TagResource",
+        "SNS:SetTopicAttributes",
+        "SNS:Subscribe",
+        "SNS:GetSubscriptionAttributes",
+        "SNS:Unsubscribe",
+        "ssm:GetParameter",
+        "ssm:PutParameter",
+        "ssm:AddTagsToResource",
+        "ssm:ListTagsForResource",
+        "ssm:GetParameters",
+        "ssm:DeleteParameter"
       ],
       "Resource": ["*"]
     }
diff --git a/scripts/infrastructure/terraform/terraform-commands.sh b/scripts/infrastructure/terraform/terraform-commands.sh

Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,13 @@ JSON`
`27`	`27`	`}`
`28`	`28`	`}`
`29`	`29`
	`30`	`+module "billing_alarms" {`
	`31`	`+ source = "../modules/billing_alarms"`
	`32`	`+ project = local.project`
	`33`	`+ limit = var.budget_limit`
	`34`	`+ environment = terraform.workspace`
	`35`	`+}`
	`36`	`+`
`30`	`37`	`module "iam__api-gateway-to-cloudwatch" {`
`31`	`38`	`source = "../modules/iam__api-gateway-to-cloudwatch"`
`32`	`39`	`project = local.project`
Original file line number	Diff line number	Diff line change
`@@ -13,5 +13,17 @@ terraform {`
`13`	`13`	`source = "hashicorp/aws"`
`14`	`14`	`version = "~> 5.20.0"`
`15`	`15`	`}`
	`16`	`+ null = {`
	`17`	`+ source = "hashicorp/null"`
	`18`	`+ version = "~> 3.0"`
	`19`	`+ }`
	`20`	`+ external = {`
	`21`	`+ source = "hashicorp/external"`
	`22`	`+ version = "~> 2.0"`
	`23`	`+ }`
	`24`	`+ local = {`
	`25`	`+ source = "hashicorp/local"`
	`26`	`+ version = "~> 2.0"`
	`27`	`+ }`
`16`	`28`	`}`
`17`	`29`	`}`
Original file line number	Diff line number	Diff line change
`@@ -21,3 +21,8 @@ variable "updated_date" {`
`21`	`21`	`variable "workspace_type" {`
`22`	`22`	`default = "PERSISTENT"`
`23`	`23`	`}`
	`24`	`+`
	`25`	`+variable "budget_limit" {`
	`26`	`+ default = "1050"`
	`27`	`+ type = string`
	`28`	`+}`