Route SNS notifications through a Lambda function (#5246) #5445
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
achave11-ucsc
added
the
upgrade
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/5246-sns-to-lambda
branch
2 times, most recently
from
6409ae5
to
3635f85
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #5445 +/- ##
===========================================
- Coverage 85.38% 85.32% -0.06%
===========================================
Files 156 158 +2
Lines 20767 20809 +42
===========================================
+ Hits 17731 17755 +24
- Misses 3036 3054 +18 ☔ View full report in Codecov by Sentry. |
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/5246-sns-to-lambda
branch
from
aee5bb4
to
497b492
Compare
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/5246-sns-to-lambda
branch
9 times, most recently
from
1e169e1
to
0d7e408
Compare
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/5246-sns-to-lambda
branch
2 times, most recently
from
4edb434
to
6fcd6e6
Compare
hannes-ucsc
added
2 reviews
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/5246-sns-to-lambda
branch
3 times, most recently
from
ca9c9cd
to
7ca4527
Compare
hannes-ucsc
requested changes
Nov 29, 2023
There was a problem hiding this comment.
I renamed some classes and the containing modules should be renamed as well, but to keep the diff smaller I didn't rename the modules.
Index: src/azul/indexer/notify_service.py
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/azul/indexer/notify_service.py b/src/azul/indexer/notify_service.py
--- a/src/azul/indexer/notify_service.py (revision 52b723982f7fd8dc4da157bbe9c6b2dc99807e1b)
+++ b/src/azul/indexer/notify_service.py (date 1701232402831)
@@ -2,7 +2,6 @@
import logging
from azul import (
- JSON,
config,
)
from azul.deployment import (
@@ -15,34 +14,31 @@
log = logging.getLogger(__name__)
-class AzulEmailNotificationService:
+class EmailService:
- def notify_group(self, subject: str, message: str) -> None:
- log.info('Notifying group of event %r', trunc_ellipses(message, 256))
- # Try to improve readability by adding indent
- try:
- body = json.loads(message)
- except json.decoder.JSONDecodeError:
- log.warning('Not a JSON serializable event, sending as received.')
- body = message
- else:
- body = json.dumps(body, indent=4)
- response = aws.ses.send_email(
- FromEmailAddress=' '.join([
- 'Azul',
- config.deployment_stage,
- 'Monitoring',
- '<monitoring@' + config.api_lambda_domain('indexer') + '>'
- ]),
- Destination={
- 'ToAddresses': [config.monitoring_email]
- },
- Content=self._content(subject, body)
- )
- log.info('Sent notification %r', response['MessageId'])
+ @property
+ def to_email(self):
+ return config.monitoring_email
+
+ @property
+ def from_email(self):
+ return ' '.join([
+ 'Azul',
+ config.deployment_stage,
+ 'Monitoring',
+ '<monitoring@' + config.api_lambda_domain('indexer') + '>'
+ ])
- def _content(self, subject: str, body: str) -> JSON:
- return {
+ def send_message(self, subject: str, body: str) -> None:
+ log.info('Sending message %r with body %r',
+ subject, trunc_ellipses(body, 256))
+ try:
+ body = json.loads(body)
+ except json.decoder.JSONDecodeError:
+ log.warning('Not a JSON serializable event, sending as is')
+ else:
+ body = json.dumps(body, indent=4)
+ content = {
'Simple': {
'Subject': {
'Data': subject
@@ -54,3 +50,8 @@
}
}
}
+ response = aws.ses.send_email(FromEmailAddress=self.from_email,
+ Destination=dict(ToAddresses=[self.to_email]),
+ Content=content)
+ log.info('Successfully sent message %r, message ID is %r',
+ subject, response['MessageId'])
Index: lambdas/indexer/app.py
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/lambdas/indexer/app.py b/lambdas/indexer/app.py
--- a/lambdas/indexer/app.py (revision 52b723982f7fd8dc4da157bbe9c6b2dc99807e1b)
+++ b/lambdas/indexer/app.py (date 1701233651213)
@@ -35,7 +35,7 @@
LogForwardingController,
)
from azul.indexer.notification_controller import (
- NotificationController,
+ MonitoringController,
)
from azul.logging import (
configure_app_logging,
@@ -78,8 +78,8 @@
return self._controller(HealthController, lambda_name='indexer')
@cached_property
- def notification_controller(self):
- return self._controller(NotificationController)
+ def monitoring_controller(self):
+ return self._controller(MonitoringController)
@cached_property
def index_controller(self) -> IndexController:
@@ -105,9 +105,9 @@
return lambda func: func
@property
- def monitoring(self):
+ def monitoring_sns_handler(self):
if config.enable_monitoring:
- return self.on_sns_message(topic=config.qualified_resource_name('monitoring'))
+ return self.on_sns_message(topic=aws.monitoring_topic_name)
else:
return lambda func: func
@@ -365,6 +365,6 @@
app.log_controller.forward_s3_access_logs(event)
-@app.monitoring
+@app.monitoring_sns_handler
def notify(event: chalice.app.SNSEvent):
- app.notification_controller.notify_group(event)
+ app.monitoring_controller.notify_group(event)
Index: src/azul/indexer/notification_controller.py
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/azul/indexer/notification_controller.py b/src/azul/indexer/notification_controller.py
--- a/src/azul/indexer/notification_controller.py (revision 52b723982f7fd8dc4da157bbe9c6b2dc99807e1b)
+++ b/src/azul/indexer/notification_controller.py (date 1701233621115)
@@ -7,15 +7,15 @@
AppController,
)
from azul.indexer.notify_service import (
- AzulEmailNotificationService,
+ EmailService,
)
-class NotificationController(AppController):
+class MonitoringController(AppController):
@cached_property
- def service(self):
- return AzulEmailNotificationService()
+ def email_service(self):
+ return EmailService()
def notify_group(self, event: chalice.app.SNSEvent) -> None:
- self.service.notify_group(event.subject, event.message)
+ self.email_service.send_message(event.subject, event.message)
Index: terraform/api_gateway.tf.json.template.py
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/terraform/api_gateway.tf.json.template.py b/terraform/api_gateway.tf.json.template.py
--- a/terraform/api_gateway.tf.json.template.py (revision 52b723982f7fd8dc4da157bbe9c6b2dc99807e1b)
+++ b/terraform/api_gateway.tf.json.template.py (date 1701234741526)
@@ -351,6 +351,7 @@
'function_name': '${aws_lambda_function.indexer_%s.function_name}' % function_name,
'maximum_retry_attempts': 0
}
+ # REVIEW: see my comments on your other PR that modifies this section
for function_name in [
*(
('forward_alb_logs', 'forward_s3_logs')
@@ -502,14 +503,15 @@
},
**(
{
- 'notify_ses': {
+ 'notify': {
'zone_id': '${data.aws_route53_zone.%s.id}' % zones_by_domain[app.domains[0]].slug,
- 'name': '_amazonses.' + config.api_lambda_domain(app.name),
+ 'name': '_amazonses.' + app.domains[0],
'type': 'TXT',
'ttl': '600',
'records': ['${aws_ses_domain_identity.notify.verification_token}']
}
- } if app.name == 'indexer' and config.enable_monitoring else
+ }
+ if app.name == 'indexer' and config.enable_monitoring else
{}
)
},
@@ -637,7 +639,7 @@
{
'aws_ses_domain_identity': {
'notify': {
- 'domain': config.api_lambda_domain(app.name)
+ 'domain': app.domains[0]
}
},
'aws_ses_identity_policy': {
@@ -650,6 +652,8 @@
{
'Effect': 'Allow',
'Principal': {
+ # REVIEW: Who or what creates the role this ARN is referring to? And
+ # what does the part after the last slash in the ARN signify?
'AWS': 'arn:aws:sts::'
+ aws.account
+ ':assumed-role/'
README.md
Outdated
| ### 3.2.3 Transition Amazon SES resource out of sandbox | ||
|
|
||
| Perform these steps once the cloud insfrastructure has been provisioned for the | ||
| shared deployment, section #3.3. Before continuing, make sure that the SES |
There was a problem hiding this comment.
Yes, but one should not have to jump around in the document. The sections are meant in to be performed in the order they appear in the document. Skipping a section is OK, but going backwards is not. Why does this have to be executed after the infrastructure was deployed?
README.md
Outdated
| --contact-language EN \ | ||
| --mail-type TRANSACTIONAL \ | ||
| --production-access-enabled \ | ||
| --website-url $(python -c 'from azul import config; print(api_lambda_domain("notify"))') \ |
There was a problem hiding this comment.
Suggested change
| --website-url $(python -c 'from azul import config; print(api_lambda_domain("notify"))') \ | |
| --website-url $(python -c 'from azul import config; print(config.api_lambda_domain("notify"))') \ |
but I added a convenience recently
Suggested change
| --website-url $(python -c 'from azul import config; print(api_lambda_domain("notify"))') \ | |
| --website-url $(python -m azul 'config.api_lambda_domain("notify")') \ |
hannes-ucsc
added
3 reviews
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/5246-sns-to-lambda
branch
5 times, most recently
from
0b894ab
to
a8b9137
Compare
achave11-ucsc
commented
Dec 1, 2023
| # The following is the role-session-name of the principal | ||
| # assuming the role via an AWS STS AssumeRole operation. | ||
| + '${aws_lambda_function.' + '_'.join([app.name, 'notify']) | ||
| + '.function_name}' |
There was a problem hiding this comment.
There was a problem hiding this comment.
This diverges from convention, add policy statement to appropriate Lambda role policy.
achave11-ucsc
force-pushed
the
develop
branch
from
ed4b5e1
to
858f6fb
Compare
hannes-ucsc
force-pushed
the
develop
branch
3 times, most recently
from
0762297
to
3f7f6ce
Compare
achave11-ucsc
added
the
deploy:shared
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/5246-sns-to-lambda
branch
from
b151f7c
to
17e8100
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Connected issues: #5246
Checklist
Author
developissues/<GitHub handle of author>/<issue#>-<slug>1 when the issue title describes a problem, the corresponding PR
title is
Fix:followed by the issue titleAuthor (partiality)
ptag to titles of partial commitspartialor completely resolves all connected issuespartiallabelAuthor (chains)
baseor this PR is not chained to another PRchainedor is not chained to another PRAuthor (reindex, API changes)
rtag to commit title or the changes introduced by this PR will not require reindexing of any deploymentreindex:devor the changes introduced by it will not require reindexing ofdevreindex:anvildevor the changes introduced by it will not require reindexing ofanvildevreindex:anvilprodor the changes introduced by it will not require reindexing ofanvilprodreindex:prodor the changes introduced by it will not require reindexing ofprodreindex:partialand its description documents the specific reindexing procedure fordev,anvildev,anvilprodandprodor requires a full reindex or carries none of the labelsreindex:dev,reindex:anvildev,reindex:anvilprodandreindex:prodAPIor this PR does not modify a REST APIa(A) tag to commit title for backwards (in)compatible changes or this PR does not modify a REST APIapp.pyor this PR does not modify a REST APIAuthor (upgrading deployments)
make image_manifests.jsonand committed the resulting changes or this PR does not modifyazul_docker_images, or any other variables referenced in the definition of that variableutag to commit title or this PR does not require upgrading deploymentsupgradeor does not require upgrading deploymentsdeploy:sharedor does not modifyimage_manifests.json, and does not require deploying thesharedcomponent for any other reasondeploy:gitlabor does not require deploying thegitlabcomponentdeploy:runneror does not require deploying therunnerimageAuthor (hotfixes)
Ftag to main commit title or this PR does not include permanent fix for a temporary hotfixanvilprodandprod) have temporary hotfixes for any of the issues connected to this PRAuthor (before every review)
develop, squashed old fixupsmake requirements_updateor this PR does not modifyrequirements*.txt,common.mk,MakefileandDockerfileRtag to commit title or this PR does not modifyrequirements*.txtreqsor does not modifyrequirements*.txtmake integration_testpasses in personal deployment or this PR does not modify functionality that could affect the IT outcomePeer reviewer (after approval)
System administrator (after approval)
demoorno demono demono sandboxN reviewslabel is accurateOperator (before pushing merge the commit)
reindex:…labels andrcommit title tagno demodevelop_select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unusedor this PR is not labeleddeploy:shared_select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab applyor this PR is not labeleddeploy:gitlab_select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unusedor this PR is not labeleddeploy:shared_select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab applyor this PR is not labeleddeploy:gitlabdeploy:gitlabdeploy:gitlabSystem administrator
dev.gitlabare complete or this PR is not labeleddeploy:gitlabanvildev.gitlabare complete or this PR is not labeleddeploy:gitlabOperator (before pushing merge the commit)
_select dev.gitlab && make -C terraform/gitlab/runneror this PR is not labeleddeploy:runner_select anvildev.gitlab && make -C terraform/gitlab/runneror this PR is not labeleddeploy:runnersandboxlabel or PR is labeledno sandboxdevor PR is labeledno sandboxanvildevor PR is labeledno sandboxsandboxdeployment or PR is labeledno sandboxanvilboxdeployment or PR is labeledno sandboxsandboxdeployment or PR is labeledno sandboxanvilboxdeployment or PR is labeledno sandboxsandboxor this PR does not remove catalogs or otherwise causes unreferenced indices indevanvilboxor this PR does not remove catalogs or otherwise causes unreferenced indices inanvildevsandboxor this PR is not labeledreindex:devanvilboxor this PR is not labeledreindex:anvildevsandboxor this PR is not labeledreindex:devanvilboxor this PR is not labeledreindex:anvildevpif the PR is also labeledpartialOperator (chain shortening)
developor this PR is not labeledbasechainedlabel from the blocked PR or this PR is not labeledbasebasebaselabel from this PR or this PR is not labeledbaseOperator (after pushing the merge commit)
devanvildevdevdevanvildevanvildev_select dev.shared && make -C terraform/shared applyor this PR is not labeleddeploy:shared_select anvildev.shared && make -C terraform/shared applyor this PR is not labeleddeploy:shareddevanvildevOperator (reindex)
devor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevOperator
deploy:shared,deploy:gitlab,deploy:runner,API,reindex:partial,reindex:anvilprodandreindex:prodlabels to the next promotion PRs or this PR carries none of these labelsdeploy:shared,deploy:gitlab,deploy:runner,API,reindex:partial,reindex:anvilprodandreindex:prodlabels, from the description of this PR to that of the next promotion PRs or this PR carries none of these labelsShorthand for review comments
Lline is too longWline wrapping is wrongQbad quotesFother formatting problem