feat: add EKS/RDS Extended Support Eventbridge rules (#65)

* feat: add EKS/RDS Extended Support Eventbridge rules

* feat: enable optionally disabling the eks/rds alerts

* docs: update terraform module docs

Author: georgepstaylor

README.md

@@ -50,6 +50,7 @@ module "account_baseline_alarms" {
 | <a name="input_create_sns_topic"></a> [create\_sns\_topic](#input\_create\_sns\_topic) | The boolean flag whether to create the SNS topic for alarms. | `bool` | `true` | no |
 | <a name="input_enable_administrator_sso_activity"></a> [enable\_administrator\_sso\_activity](#input\_enable\_administrator\_sso\_activity) | The boolean flag whether the administrator\_sso\_activity alarm is enabled or not. | `bool` | `true` | no |
 | <a name="input_enable_aws_config_changes"></a> [enable\_aws\_config\_changes](#input\_enable\_aws\_config\_changes) | The boolean flag whether the aws\_config\_changes alarm is enabled or not. | `bool` | `true` | no |
+| <a name="input_enable_aws_extended_support_alerts"></a> [enable\_aws\_extended\_support\_alerts](#input\_enable\_aws\_extended\_support\_alerts) | The boolean flag whether the eventbridge rules for extended support (EKS/RDS) billing alerts are enabled or not. | `bool` | `true` | no |
 | <a name="input_enable_breakglass_activity"></a> [enable\_breakglass\_activity](#input\_enable\_breakglass\_activity) | The boolean flag whether the breakglass\_logins alarm is enabled or not. | `bool` | `true` | no |
 | <a name="input_enable_cloudtrail_cfg_changes"></a> [enable\_cloudtrail\_cfg\_changes](#input\_enable\_cloudtrail\_cfg\_changes) | The boolean flag whether the cloudtrail\_cfg\_changes alarm is enabled or not. | `bool` | `true` | no |
 | <a name="input_enable_console_signin_failures"></a> [enable\_console\_signin\_failures](#input\_enable\_console\_signin\_failures) | The boolean flag whether the console\_signin\_failures alarm is enabled or not. | `bool` | `true` | no |

eventbridge.tf

@@ -0,0 +1,47 @@
+# EventBridge Rule (RDS Extended Support Billing)
+resource "aws_cloudwatch_event_rule" "rds_extended_support_billing" {
+  count       = var.enable_aws_extended_support_alerts ? 1 : 0
+  name        = "rds-extended-support-billing-notification"
+  description = "Captures AWS Billing notifications for RDS Extended Support"
+
+  event_pattern = jsonencode({
+    "source" : ["aws.health"],
+    "detail-type" : ["AWS Health Event"],
+    "detail" : {
+      "eventTypeCode" : ["AWS_BILLING_NOTIFICATION"],
+      "eventDescription" : [{
+        "wildcard" : "*RDS Extended Support*"
+      }]
+    }
+  })
+}
+
+resource "aws_cloudwatch_event_target" "rds_extended_support_billing" {
+  count = var.enable_aws_extended_support_alerts ? 1 : 0
+  rule  = aws_cloudwatch_event_rule.rds_extended_support_billing[0].name
+  arn   = local.sns_topic_arn
+}
+
+# EventBridge Rule (EKS Extended Support Billing)
+resource "aws_cloudwatch_event_rule" "eks_extended_support_billing" {
+  count       = var.enable_aws_extended_support_alerts ? 1 : 0
+  name        = "eks-extended-support-billing-notification"
+  description = "Captures AWS Billing notifications for EKS Extended Support"
+
+  event_pattern = jsonencode({
+    "source" : ["aws.health"],
+    "detail-type" : ["AWS Health Event"],
+    "detail" : {
+      "eventTypeCode" : ["AWS_BILLING_NOTIFICATION"],
+      "eventDescription" : [{
+        "wildcard" : "*EKS Extended Support*"
+      }]
+    }
+  })
+}
+
+resource "aws_cloudwatch_event_target" "eks_extended_support_billing" {
+  count = var.enable_aws_extended_support_alerts ? 1 : 0
+  rule  = aws_cloudwatch_event_rule.eks_extended_support_billing[0].name
+  arn   = local.sns_topic_arn
+}

variables.tf

@@ -86,6 +86,12 @@ variable "enable_aws_config_changes" {
   default     = true
 }
 
+variable "enable_aws_extended_support_alerts" {
+  description = "The boolean flag whether the eventbridge rules for extended support (EKS/RDS) billing alerts are enabled or not."
+  type        = bool
+  default     = true
+}
+
 variable "enable_security_group_changes" {
   description = "The boolean flag whether the security_group_changes alarm is enabled or not."
   type        = bool