add CloudWatch alerts construct with Auth0 monitoring and Slack integ…

[ms280690]

…ration

• new MonitoringAlerts CDK construct with 11 alarms (ALB, RDS, ECS, SQS, SageMaker, Auth0)
• structured log markers in auth_backends.py and auth0utils.py for CloudWatch metric filters
• AWS Chatbot Slack channel configuration wired to shared SNS topic
• explicit API log group created and passed to alerts construct
• CDK Nag suppressions for SNS topic

[coderabbitai]

Warning

Review limit reached

@ms280690, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 54 minutes and 39 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 60d8955d-2628-46d3-86c9-3be7f1a03cc3

📥 Commits

Reviewing files that changed from the base of the PR and between c4aaf50 and b62a9fa.

📒 Files selected for processing (8)

• iac/nag_suppressions.py
• iac/settings/dev.py
• iac/settings/prod.py
• iac/settings/settings.py
• iac/stacks/api.py
• iac/stacks/constructs/alerts.py
• src/api/auth_backends.py
• src/api/utils/auth0utils.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 1891-goal-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

cdk-nag report

✅ No unsuppressed errors.

---

See iac/nag_suppressions.py to add suppressions for accepted risks.

[github-actions]

cdk diff ✅ Success

Show Output

start: Building GithubAccess Template
success: Built GithubAccess Template
start: Publishing GithubAccess Template (554812291621-us-east-1-403885e2)
success: Published GithubAccess Template (554812291621-us-east-1-403885e2)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack GithubAccess
There were no differences

start: Building mermaid-api-infra-common Template
success: Built mermaid-api-infra-common Template
start: Publishing mermaid-api-infra-common Template (554812291621-us-east-1-37993ba8)
success: Published mermaid-api-infra-common Template (554812291621-us-east-1-37993ba8)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack mermaid-api-infra-common
There were no differences

start: Building dev-mermaid-static-site Template
success: Built dev-mermaid-static-site Template
start: Publishing dev-mermaid-static-site Template (554812291621-us-east-1-705b66ee)
success: Published dev-mermaid-static-site Template (554812291621-us-east-1-705b66ee)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack dev-mermaid-static-site
There were no differences

start: Building dev-mermaid-api-django Template
success: Built dev-mermaid-api-django Template
start: Publishing dev-mermaid-api-django Template (554812291621-us-east-1-0b7dde5c)
success: Published dev-mermaid-api-django Template (554812291621-us-east-1-0b7dde5c)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack dev-mermaid-api-django
IAM Statement Changes
┌───┬──────────────────────────────────────────────┬────────┬──────────────────────┬────────────────────────────────────────┬───────────┐
│   │ Resource                                     │ Effect │ Action               │ Principal                              │ Condition │
├───┼──────────────────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────┼───────────┤
│ + │ ${ApiLogGroup.Arn}                           │ Allow  │ logs:CreateLogStream │ AWS:${ApiTaskDefinition/ExecutionRole} │           │
│   │                                              │        │ logs:PutLogEvents    │                                        │           │
├───┼──────────────────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────┼───────────┤
│ - │ ${ApiTaskDefinition/MermaidAPI/LogGroup.Arn} │ Allow  │ logs:CreateLogStream │ AWS:${ApiTaskDefinition/ExecutionRole} │           │
│   │                                              │        │ logs:PutLogEvents    │                                        │           │
└───┴──────────────────────────────────────────────┴────────┴──────────────────────┴────────────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Resources
[-] AWS::Logs::LogGroup ApiTaskDefinition/MermaidAPI/LogGroup ApiTaskDefinitionMermaidAPILogGroup6992B9E7 orphan
[+] AWS::Logs::LogGroup ApiLogGroup ApiLogGroup1DEDFC07
[+] AWS::SNS::Topic Alerts/AlertsTopic AlertsAlertsTopic96BD0900
[+] AWS::CloudWatch::Alarm Alerts/Alb5xxAlarm AlertsAlb5xxAlarm5ADD1B08
[+] AWS::CloudWatch::Alarm Alerts/AlbLatencyAlarm AlertsAlbLatencyAlarm906560A0
[+] AWS::CloudWatch::Alarm Alerts/RdsCpuAlarm AlertsRdsCpuAlarmB0991AC1
[+] AWS::CloudWatch::Alarm Alerts/RdsConnectionsAlarm AlertsRdsConnectionsAlarm30297ED6
[+] AWS::CloudWatch::Alarm Alerts/ApiCpuAlarm AlertsApiCpuAlarm2B799584
[+] AWS::CloudWatch::Alarm Alerts/GeneralDlqAlarm AlertsGeneralDlqAlarmACAF5503
[+] AWS::CloudWatch::Alarm Alerts/ImageDlqAlarm AlertsImageDlqAlarm1B3B214A
[+] AWS::CloudWatch::Alarm Alerts/SageMakerRunningAppsAlarm AlertsSageMakerRunningAppsAlarm9ACED765
[+] AWS::Logs::MetricFilter Alerts/FailedAuthMetricFilter AlertsFailedAuthMetricFilter1F7483B5
[+] AWS::CloudWatch::Alarm Alerts/FailedAuthAlarm AlertsFailedAuthAlarm119A8540
[+] AWS::Logs::MetricFilter Alerts/Auth0UnavailableMetricFilter AlertsAuth0UnavailableMetricFilterC22368EC
[+] AWS::CloudWatch::Alarm Alerts/Auth0UnavailableAlarm AlertsAuth0UnavailableAlarmCD6B0846
[+] AWS::Logs::MetricFilter Alerts/Auth0RateLimitMetricFilter AlertsAuth0RateLimitMetricFilter2F7EA8BF
[+] AWS::CloudWatch::Alarm Alerts/Auth0RateLimitAlarm AlertsAuth0RateLimitAlarm177A7D0D
[~] AWS::ECS::TaskDefinition ScheduledBackupTaskDef ScheduledBackupTaskDef48789D5A replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -147,7 +147,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:d89f2553dce37326866a51cb2aa60c81ffe7008a9df01edef3f1654a2cd9534a"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
[~] AWS::ECS::TaskDefinition SummaryCacheTaskDef SummaryCacheTaskDefFAAC683D replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -151,7 +151,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:d89f2553dce37326866a51cb2aa60c81ffe7008a9df01edef3f1654a2cd9534a"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
[~] AWS::ECS::TaskDefinition ApiTaskDefinition ApiTaskDefinition51EA709E may be replaced
 └─ [~] ContainerDefinitions (may cause replacement)
     └─ @@ -145,13 +145,13 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:d89f2553dce37326866a51cb2aa60c81ffe7008a9df01edef3f1654a2cd9534a"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
        [ ]   "Options": {
        [ ]     "awslogs-group": {
        [-]       "Ref": "ApiTaskDefinitionMermaidAPILogGroup6992B9E7"
        [+]       "Ref": "ApiLogGroup1DEDFC07"
        [ ]     },
        [ ]     "awslogs-stream-prefix": "dev",
        [ ]     "awslogs-region": "us-east-1"
[~] AWS::IAM::Policy ApiTaskDefinition/ExecutionRole/DefaultPolicy ApiTaskDefinitionExecutionRoleDefaultPolicy5B03B3DE
 └─ [~] PolicyDocument
     └─ [~] .Statement:
         └─ @@ -32,7 +32,7 @@
            [ ] "Effect": "Allow",
            [ ] "Resource": {
            [ ]   "Fn::GetAtt": [
            [-]     "ApiTaskDefinitionMermaidAPILogGroup6992B9E7",
            [+]     "ApiLogGroup1DEDFC07",
            [ ]     "Arn"
            [ ]   ]
            [ ] }
[~] AWS::ECS::TaskDefinition General/Worker/QueueProcessingTaskDef GeneralWorkerQueueProcessingTaskDef1C2A1522 replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -158,7 +158,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:d89f2553dce37326866a51cb2aa60c81ffe7008a9df01edef3f1654a2cd9534a"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
[~] AWS::ECS::TaskDefinition ImageProcess/Worker/QueueProcessingTaskDef ImageProcessWorkerQueueProcessingTaskDefACA5B138 replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -158,7 +158,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:d89f2553dce37326866a51cb2aa60c81ffe7008a9df01edef3f1654a2cd9534a"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",


start: Building dev-mermaid-sagemaker Template
success: Built dev-mermaid-sagemaker Template
start: Publishing dev-mermaid-sagemaker Template (554812291621-us-east-1-22b36f85)
success: Published dev-mermaid-sagemaker Template (554812291621-us-east-1-22b36f85)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack dev-mermaid-sagemaker
There were no differences

start: Building prod-mermaid-static-site Template
success: Built prod-mermaid-static-site Template
start: Publishing prod-mermaid-static-site Template (554812291621-us-east-1-b2d960b0)
success: Published prod-mermaid-static-site Template (554812291621-us-east-1-b2d960b0)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack prod-mermaid-static-site
There were no differences

start: Building prod-mermaid-api-django Template
success: Built prod-mermaid-api-django Template
start: Publishing prod-mermaid-api-django Template (554812291621-us-east-1-e2b09a80)
success: Published prod-mermaid-api-django Template (554812291621-us-east-1-e2b09a80)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack prod-mermaid-api-django
IAM Statement Changes
┌───┬──────────────────────────────────────────────┬────────┬──────────────────────┬────────────────────────────────────────┬───────────┐
│   │ Resource                                     │ Effect │ Action               │ Principal                              │ Condition │
├───┼──────────────────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────┼───────────┤
│ + │ ${ApiLogGroup.Arn}                           │ Allow  │ logs:CreateLogStream │ AWS:${ApiTaskDefinition/ExecutionRole} │           │
│   │                                              │        │ logs:PutLogEvents    │                                        │           │
├───┼──────────────────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────┼───────────┤
│ - │ ${ApiTaskDefinition/MermaidAPI/LogGroup.Arn} │ Allow  │ logs:CreateLogStream │ AWS:${ApiTaskDefinition/ExecutionRole} │           │
│   │                                              │        │ logs:PutLogEvents    │                                        │           │
└───┴──────────────────────────────────────────────┴────────┴──────────────────────┴────────────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Resources
[-] AWS::Logs::LogGroup ApiTaskDefinition/MermaidAPI/LogGroup ApiTaskDefinitionMermaidAPILogGroup6992B9E7 orphan
[+] AWS::Logs::LogGroup ApiLogGroup ApiLogGroup1DEDFC07
[+] AWS::SNS::Topic Alerts/AlertsTopic AlertsAlertsTopic96BD0900
[+] AWS::CloudWatch::Alarm Alerts/Alb5xxAlarm AlertsAlb5xxAlarm5ADD1B08
[+] AWS::CloudWatch::Alarm Alerts/AlbLatencyAlarm AlertsAlbLatencyAlarm906560A0
[+] AWS::CloudWatch::Alarm Alerts/RdsCpuAlarm AlertsRdsCpuAlarmB0991AC1
[+] AWS::CloudWatch::Alarm Alerts/RdsConnectionsAlarm AlertsRdsConnectionsAlarm30297ED6
[+] AWS::CloudWatch::Alarm Alerts/ApiCpuAlarm AlertsApiCpuAlarm2B799584
[+] AWS::CloudWatch::Alarm Alerts/GeneralDlqAlarm AlertsGeneralDlqAlarmACAF5503
[+] AWS::CloudWatch::Alarm Alerts/ImageDlqAlarm AlertsImageDlqAlarm1B3B214A
[+] AWS::CloudWatch::Alarm Alerts/SageMakerRunningAppsAlarm AlertsSageMakerRunningAppsAlarm9ACED765
[+] AWS::Logs::MetricFilter Alerts/FailedAuthMetricFilter AlertsFailedAuthMetricFilter1F7483B5
[+] AWS::CloudWatch::Alarm Alerts/FailedAuthAlarm AlertsFailedAuthAlarm119A8540
[+] AWS::Logs::MetricFilter Alerts/Auth0UnavailableMetricFilter AlertsAuth0UnavailableMetricFilterC22368EC
[+] AWS::CloudWatch::Alarm Alerts/Auth0UnavailableAlarm AlertsAuth0UnavailableAlarmCD6B0846
[+] AWS::Logs::MetricFilter Alerts/Auth0RateLimitMetricFilter AlertsAuth0RateLimitMetricFilter2F7EA8BF
[+] AWS::CloudWatch::Alarm Alerts/Auth0RateLimitAlarm AlertsAuth0RateLimitAlarm177A7D0D
[~] AWS::ECS::TaskDefinition ScheduledBackupTaskDef ScheduledBackupTaskDef48789D5A replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -147,7 +147,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:38b11ecd7a34356ccac91b8c61f892e5a4b598bfeed13f480a5dfde2538bcce5"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
[~] AWS::ECS::TaskDefinition SummaryCacheTaskDef SummaryCacheTaskDefFAAC683D replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -151,7 +151,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:38b11ecd7a34356ccac91b8c61f892e5a4b598bfeed13f480a5dfde2538bcce5"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
[~] AWS::ECS::TaskDefinition ApiTaskDefinition ApiTaskDefinition51EA709E may be replaced
 └─ [~] ContainerDefinitions (may cause replacement)
     └─ @@ -145,13 +145,13 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:38b11ecd7a34356ccac91b8c61f892e5a4b598bfeed13f480a5dfde2538bcce5"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
        [ ]   "Options": {
        [ ]     "awslogs-group": {
        [-]       "Ref": "ApiTaskDefinitionMermaidAPILogGroup6992B9E7"
        [+]       "Ref": "ApiLogGroup1DEDFC07"
        [ ]     },
        [ ]     "awslogs-stream-prefix": "prod",
        [ ]     "awslogs-region": "us-east-1"
[~] AWS::IAM::Policy ApiTaskDefinition/ExecutionRole/DefaultPolicy ApiTaskDefinitionExecutionRoleDefaultPolicy5B03B3DE
 └─ [~] PolicyDocument
     └─ [~] .Statement:
         └─ @@ -32,7 +32,7 @@
            [ ] "Effect": "Allow",
            [ ] "Resource": {
            [ ]   "Fn::GetAtt": [
            [-]     "ApiTaskDefinitionMermaidAPILogGroup6992B9E7",
            [+]     "ApiLogGroup1DEDFC07",
            [ ]     "Arn"
            [ ]   ]
            [ ] }
[~] AWS::ECS::TaskDefinition General/Worker/QueueProcessingTaskDef GeneralWorkerQueueProcessingTaskDef1C2A1522 replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -158,7 +158,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:38b11ecd7a34356ccac91b8c61f892e5a4b598bfeed13f480a5dfde2538bcce5"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
[~] AWS::ECS::TaskDefinition ImageProcess/Worker/QueueProcessingTaskDef ImageProcessWorkerQueueProcessingTaskDefACA5B138 replace
 └─ [~] ContainerDefinitions (requires replacement)
     └─ @@ -158,7 +158,7 @@
        [ ] ],
        [ ] "Essential": true,
        [ ] "Image": {
        [-]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:38b11ecd7a34356ccac91b8c61f892e5a4b598bfeed13f480a5dfde2538bcce5"
        [+]   "Fn::Sub": "554812291621.dkr.ecr.us-east-1.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-554812291621-us-east-1:b1975228fde1dca0e522bddf333ec4b5260e38cfff444d2a276b7f14b4fb6cc0"
        [ ] },
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",



✨  Number of stacks with differences: 2

Workflow: pr