Lab 15: 모니터링 as Code

terraform {
  required_version = ">= 1.0.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-2" # 서울 리전
}

variable "alert_email" {
  description = "알람을 수신할 이메일 주소"
  type        = string
}

variable "cpu_threshold" {
  description = "CPU 사용률 알람 임계값 (%)"
  type        = number
  default     = 70
}

# 최신 Amazon Linux 2023 AMI 조회 (data source)
data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023*-x86_64"]
  }
}

# 감시 대상 — 프리 티어 EC2
resource "aws_instance" "target" {
  ami           = data.aws_ami.al2023.id
  instance_type = "t2.micro"

  tags = {
    Name = "lab15-monitoring-target"
  }
}

# 알림 채널 — 알람 상태 전환을 전달할 SNS 토픽
resource "aws_sns_topic" "alerts" {
  name = "lab15-infra-alerts"
}

# 이메일 구독 — apply 후 수신함에서 "Confirm subscription" 클릭 필요
resource "aws_sns_topic_subscription" "email" {
  topic_arn = aws_sns_topic.alerts.arn
  protocol  = "email"
  endpoint  = var.alert_email
}

# 알람 1: CPU 고부하 → 이메일 알림
resource "aws_cloudwatch_metric_alarm" "cpu_high" {
  alarm_name          = "lab15-cpu-high"
  alarm_description   = "EC2 CPU가 ${var.cpu_threshold}% 이상 2분간 지속"
  namespace           = "AWS/EC2"
  metric_name         = "CPUUtilization"
  statistic           = "Average"
  period              = 60
  evaluation_periods  = 2
  threshold           = var.cpu_threshold
  comparison_operator = "GreaterThanOrEqualToThreshold"

  dimensions = {
    InstanceId = aws_instance.target.id
  }

  alarm_actions = [aws_sns_topic.alerts.arn]
  ok_actions    = [aws_sns_topic.alerts.arn] # 정상 복귀도 알림
}

# 알람 2: self-healing — 시스템 상태 검사 실패 시 EC2 자동 복구
resource "aws_cloudwatch_metric_alarm" "auto_recover" {
  alarm_name          = "lab15-ec2-auto-recover"
  alarm_description   = "하드웨어 장애 감지 시 EC2 자동 복구"
  namespace           = "AWS/EC2"
  metric_name         = "StatusCheckFailed_System"
  statistic           = "Maximum"
  period              = 60
  evaluation_periods  = 2
  threshold           = 1
  comparison_operator = "GreaterThanOrEqualToThreshold"

  dimensions = {
    InstanceId = aws_instance.target.id
  }

  alarm_actions = [
    "arn:aws:automate:ap-northeast-2:ec2:recover", # self-healing 액션
    aws_sns_topic.alerts.arn,                      # 복구 사실도 사람에게 알림
  ]
}

# 대시보드 레이아웃도 코드 — jsonencode로 HCL을 JSON으로 변환
resource "aws_cloudwatch_dashboard" "main" {
  dashboard_name = "lab15-infra-overview"

  dashboard_body = jsonencode({
    widgets = [
      {
        type   = "text"
        x      = 0
        y      = 0
        width  = 24
        height = 1
        properties = {
          markdown = "# Lab 15 — Monitoring as Code (Terraform 관리 대시보드)"
        }
      },
      {
        type   = "metric"
        x      = 0
        y      = 1
        width  = 12
        height = 6
        properties = {
          title  = "EC2 CPU 사용률"
          region = "ap-northeast-2"
          stat   = "Average"
          period = 60
          metrics = [
            ["AWS/EC2", "CPUUtilization", "InstanceId", aws_instance.target.id]
          ]
          annotations = {
            horizontal = [
              { label = "알람 임계값", value = var.cpu_threshold }
            ]
          }
        }
      },
      {
        type   = "metric"
        x      = 12
        y      = 1
        width  = 12
        height = 6
        properties = {
          title  = "시스템 상태 검사 실패 (self-healing 트리거)"
          region = "ap-northeast-2"
          stat   = "Maximum"
          period = 60
          metrics = [
            ["AWS/EC2", "StatusCheckFailed_System", "InstanceId", aws_instance.target.id]
          ]
        }
      }
    ]
  })
}

output "instance_id" {
  description = "감시 대상 EC2 인스턴스 ID"
  value       = aws_instance.target.id
}

output "sns_topic_arn" {
  description = "알림 SNS 토픽 ARN"
  value       = aws_sns_topic.alerts.arn
}

output "dashboard_url" {
  description = "CloudWatch 대시보드 콘솔 URL"
  value       = "https://ap-northeast-2.console.aws.amazon.com/cloudwatch/home?region=ap-northeast-2#dashboards/dashboard/${aws_cloudwatch_dashboard.main.dashboard_name}"
}

terraform destroy -var="alert_email=you@example.com" -auto-approve