fintechner CloudWatch health alarms

30-alarms.sh

#!/bin/bash
# fintechner — readiness gate #6: CloudWatch health alarms + email SNS.
# Catches "EC2 unreachable / instance dead" cases that in-process alerts
# can't surface. ~$0/mo (SNS first 1k notifications free, alarms first 10 free).
set -euo pipefail
export AWS_PAGER=""

REGION=ap-northeast-1
INSTANCE_ID=i-089ad4a6b76132ba2
EMAIL=koliadych@gmail.com
TOPIC_NAME=fintechner-alarms

echo "=== 1. SNS topic ==="
TOPIC_ARN=$(aws --region "$REGION" sns create-topic --name "$TOPIC_NAME" --query TopicArn --output text)
echo "  $TOPIC_ARN"

echo "=== 2. Email subscription (idempotent) ==="
EXISTING=$(aws --region "$REGION" sns list-subscriptions-by-topic --topic-arn "$TOPIC_ARN" \
  --query "Subscriptions[?Endpoint=='$EMAIL'].SubscriptionArn" --output text)
if [ -z "$EXISTING" ] || [ "$EXISTING" = "PendingConfirmation" ]; then
  aws --region "$REGION" sns subscribe --topic-arn "$TOPIC_ARN" --protocol email \
    --notification-endpoint "$EMAIL" >/dev/null
  echo "  subscription requested — check $EMAIL and click 'Confirm subscription'"
else
  echo "  already confirmed: $EXISTING"
fi

echo "=== 3. Instance health alarm (StatusCheckFailed_Instance) ==="
aws --region "$REGION" cloudwatch put-metric-alarm \
  --alarm-name "fintechner-instance-failed" \
  --alarm-description "EC2 instance health check failing (OS/networking issue)" \
  --metric-name StatusCheckFailed_Instance \
  --namespace AWS/EC2 \
  --statistic Maximum \
  --period 60 \
  --evaluation-periods 2 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --dimensions "Name=InstanceId,Value=$INSTANCE_ID" \
  --alarm-actions "$TOPIC_ARN" \
  --ok-actions "$TOPIC_ARN" \
  --treat-missing-data breaching
echo "  done"

echo "=== 4. System health alarm (StatusCheckFailed_System) ==="
aws --region "$REGION" cloudwatch put-metric-alarm \
  --alarm-name "fintechner-system-failed" \
  --alarm-description "EC2 system health check failing (AWS-side hardware issue)" \
  --metric-name StatusCheckFailed_System \
  --namespace AWS/EC2 \
  --statistic Maximum \
  --period 60 \
  --evaluation-periods 2 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --dimensions "Name=InstanceId,Value=$INSTANCE_ID" \
  --alarm-actions "$TOPIC_ARN" \
  --treat-missing-data breaching
echo "  done"

echo "=== 5. High CPU alarm (catches runaway strategy) ==="
aws --region "$REGION" cloudwatch put-metric-alarm \
  --alarm-name "fintechner-cpu-pinned" \
  --alarm-description "CPU >85% sustained — t4g burst credits at risk" \
  --metric-name CPUUtilization \
  --namespace AWS/EC2 \
  --statistic Average \
  --period 300 \
  --evaluation-periods 3 \
  --threshold 85 \
  --comparison-operator GreaterThanThreshold \
  --dimensions "Name=InstanceId,Value=$INSTANCE_ID" \
  --alarm-actions "$TOPIC_ARN"
echo "  done"

echo
echo "============================================================"
echo "  ALARMS CONFIGURED"
echo "============================================================"
echo
echo "Three alarms will email $EMAIL when:"
echo "  - Instance health check fails for 2 min   (OS/network)"
echo "  - System health check fails for 2 min     (AWS hardware)"
echo "  - CPU pinned >85% for 15 min              (runaway process)"
echo
echo "ACTION REQUIRED: open $EMAIL and click 'Confirm subscription' on the"
echo "  email from AWS. Without that the alarms fire but won't deliver."