guardian / cf-notify Goto Github PK

View Code? Open in Web Editor NEW

59.0 28.0 35.0 83 KB

Get notified in Slack when changes to your Cloud Formation stack are made.

Shell 27.73% Python 72.27%

cf-notify's Introduction

CF Notify

What?

An AWS Lambda function that will post Cloud Formation status updates to a Slack channel via a Slack Web Hook.

Why?

To give visibility of Cloud Formation changes to the whole team in a quick and simple manner. For example:

How?

CF Notify has a stack of AWS resources consisting of:

An SNS Topic
A Lambda function, which uses the SNS Topic as an event source
An IAM Role to execute the Lambda function

We add the SNS Topic of CF Notify to the notification ARNs of the Stack we want to monitor. Search for NotificationARNs.member.N here for more information on notification ARNs.

Setup

To setup CF Notify, we need to do the following.

Prerequisites

Slack incoming webhook

You can create an incoming webhook here.

Deploy Lambda

This is done using the script deploy.sh.

./deploy.sh $CHANNEL $WEBHOOK $AWS_PROFILE

Where:

CHANNEL is the Slack channel or user to send messages to. It will be used in the naming of the Lambda artifact file stored in S3.
WEBHOOK is the Web Hook URL of an Incoming Web Hook (see https://api.slack.com/incoming-webhooks).
AWS_PROFILE is the aws cli profile you want to use for deploy. Default profile is "default"

deploy.sh will create a zip file and upload it to S3 and also create a cloud formation stack using the template.

Usage

Once setup is complete, all you need to do now is set the notification ARN when you update any Cloud Formation stack:

SNS_ARN=`aws cloudformation describe-stacks --stack-name cf-notify-$CHANNEL | jq ".Stacks[].Outputs[].OutputValue"  | tr -d '"'`

aws cloudformation [create-stack|update-stack|delete-stack] --notification-arns $SNS_ARN

You should now see messages in Slack!

cf-notify's People

Contributors

Stargazers

Watchers

cf-notify's Issues

IAM Roles are not always readily available

I had a little issue, it seems IAM roles can take a little time before they actually become available throughout AWS.

The role defined for the function cannot be assumed by Lambda

To get around it, I removed all resources from the cloudformation template, created the stack with just the IAM role, then continually tried updating the stack with the other resources until it worked, which seemed like 5-6 minutes.

issue

Hello thank you for this cft-notification the template was uploaded fine but i am having an issue after the template is uploaded making the sns subscription ....

SNS_ARN=awscloudformation describe-stacks --stack-name cf-notify-$CHANNEL | jq ".Stacks[].Outputs[].OutputValue" | tr -d '"'

ERROR
A client error (ValidationError) occurred when calling the DescribeStacks operation: 1 validation error detected: Value 'cf-notify-@test1' at 'stackName' failed to satisfy constraint: Member must satisfy regular expression pattern: [a-zA-Z][-a-zA-Z0-9]|arn:[-a-zA-Z0-9:/._+]

ERROR
A client error (ValidationError) occurred when calling the DescribeStacks operation: 1 validation error detected: Value 'cf-notify-#test1' at 'stackName' failed to satisfy constraint: Member must satisfy regular expression pattern: [a-zA-Z][-a-zA-Z0-9]|arn:[-a-zA-Z0-9:/._+]

and if i set the SNS_ARN=arn:aws:sns:us-east-1:1xxxxxxxxxx:cf-notify-CFNotifyTopic-AETHPBFWK2ZO
and run the below cli command it throws the error

aws cloudformation [create-stack|update-stack|delete-stack] --notification-arns $SNS_ARN

ERROR
Invalid choice: '[create-stack', maybe you meant:

create-stack

deploy.sh generating cf-notify stack with wrong name

deploy.sh is generating a stack with the name cf-notify.

The Usage section of the documentation says to use a --stack-name of cf-notify-$CHANNEL. This causes the following error:

An error occurred (ValidationError) when calling the DescribeStacks operation: Stack with id cf-notify-builds does not exist

In my case, I only need to notify to a single channel so I can simple change the command, but it was still confusing. Others might need the ability to target different channels, in which case deploy.sh should be changed.