Feature request: check correct metric_name and Dimensions for aws_cloudwatch_metric_alarm based on referenced resource

[RichardBradley]

I had a bug recently on my project where I was using the wrong Dimension for an alarm.

AWS have a lot of confusing Dimensions in CloudWatch, for example, error counts get emitted as one of the following metric_name:

• "5XXError" for V1 APIG
• "5xx" for V2 APIG
• "5xxErrors" for S3
• "5xxErrorRate" for Cloudfront

It is very easy as a developer to get these mixed up, and (assuming treat_missing_data = "notBreaching" is set), there is no warning from AWS or Terraform if you do; the alarm simply does not work.

I came here to see if tflint would detect this issue for me, but it seems that it does not yet. I think this might be useful for me and for other users of tflint.

The rule would have to detect the resource type of the target of the aws_cloudwatch_metric_alarm, then check the metric_name and dimensions against a known list of valid metrics.

Thanks

[aristosvo]

Hi @RichardBradley! Do you have a source for this information we could use, either docs or (preferably) enums in the SDK or similar?

[RichardBradley]

There are AWS docs on this, but they are fairly poor and very scattered.

That's why linting would be so useful on this point, but also means that writing the linting would be fairly hard.

I have made an integration test that covers the alarms I have in my current projects, but there are hundreds of other alarm types not covered. It's at https://github.com/RichardBradley/aws-integration-tests . It has already caught many errors in my current (large) projects, including alarms that had been live but not functional for years in a very high traffic system.

As one fairly telling example, I have pointed out to AWS support that the example here in their own example code is wrong, as the DynamoDB "SystemError" metric is emitted only at [TableName, Operation] and not at [TableName]. The docs here do say that, but some AWS docs use [a,b] to mean ([a], [a,b]) when talking about Cloudwatch metric dimensions, so it's all a big mess.