#87 - Alarming construct to streamline alarming setup by dario-fazio · Pull Request #88 · shiftcode/sc-commons-public

dario-fazio · 2026-09-18T13:33:39Z

No description provided.

- @shiftcode/cdk-utilities@1.1.0-pr87.0

…hook retrieval

- @shiftcode/cdk-utilities@1.1.0-pr87.1

…gement in alarming construct

- @shiftcode/cdk-utilities@1.1.0-pr87.2

Copilot

Copilot review overview

🟡 Changes recommended

Invocation permissions, filtering, pagination, Slack error handling, and batch delivery contain reliability defects that can silently prevent notifications.

Review effort: Balanced
Findings: 1 · 4

Open (5)

Use region-aware CloudWatch Logs service principal · New
Default pattern fails to parse plaintext Lambda logs · New
Escape all occurrences of Slack markup characters · New
Throw on non-2xx Slack responses · New
Rate-limit Slack delivery for large log batches · New

What changed in this PR

Introduces a reusable CDK alarming construct with bundled Lambda functions that forward CloudWatch alarms and error logs to Slack.

Changes:

Adds alarm, log-subscription, fallback-email, and Slack notification infrastructure.
Adds bundled Slack-forwarding handlers with tests and supporting utilities.
Updates build, dependency, lint, and TypeScript configuration.

File	Description
`tsconfig.spec.json`	Adds workspace import aliases.
`tsconfig.lint.json`	Adds lint-time import aliases.
`packages/cdk-utilities/src/scripts/esbuild.script.ts`	Bundles notification Lambdas.
`packages/cdk-utilities/src/lib/utils/slack-messages.utils.ts`	Adds Slack text helpers.
`packages/cdk-utilities/src/lib/utils/cloudwatch.utils.ts`	Adds log parsing and URL helpers.
`packages/cdk-utilities/src/lib/models/slack-notification.model.ts`	Defines Slack attachment payloads.
`packages/cdk-utilities/src/lib/models/custom-cloudwatch-alarm-message.model.ts`	Defines parsed alarm messages.
`packages/cdk-utilities/src/lib/lambda-function-name.enum.ts`	Registers bundled handlers.
`packages/cdk-utilities/src/lib/functions/publish-error-logs-to-slack-fn.ts`	Forwards error logs to Slack.
`packages/cdk-utilities/src/lib/functions/publish-error-logs-to-slack-fn.spec.ts`	Tests error-log forwarding.
`packages/cdk-utilities/src/lib/functions/publish-alarm-to-slack-fn.ts`	Forwards alarms to Slack.
`packages/cdk-utilities/src/lib/functions/publish-alarm-to-slack-fn.spec.ts`	Tests alarm forwarding.
`packages/cdk-utilities/src/lib/alarming.construct.ts`	Implements the alarming construct.
`packages/cdk-utilities/src/index.ts`	Exports the construct.
`packages/cdk-utilities/package.json`	Updates build and dependencies.
`packages/cdk-utilities/eslint.config.js`	Allows console use in scripts.
`package-lock.json`	Locks added dependencies.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+        addPermissions: props.addPermissions ?? !this.grantCloudWatchLogsInvokeBroadly,
+      }),
+      filterPattern: {
+        logPatternString: props.filterPattern ?? '{ $.level = "ERROR" }',


+  await Promise.all(
+    messages.map((message) => postSlackMessage(message.blocks, message.attachments, slackWebhookEndpoint)),
+  )


- @shiftcode/cdk-utilities@1.1.0-pr87.3

Copilot

Copilot review overview

🟡 Changes recommended

Webhook failures, raw log parsing, unbounded delivery, and cross-stack references can cause lost notifications or deployment failures.

Review effort: Balanced
Findings: 4 · 4

Open (8)

Avoid cross-stack token ownership in imported topic ARN · New
Bound explicit Lambda names to 64 characters · New
Handle non-success Slack responses as failures · New
Use region-aware CloudWatch Logs service principal
Rate-limit Slack delivery for large log batches
Throw on non-2xx Slack responses
Escape all occurrences of Slack markup characters
Default pattern fails to parse plaintext Lambda logs

Previously missed (4)

In code that hasn't changed since last review

Format timestamps instead of displaying epoch values

packages/cdk-utilities/src/lib/functions/publish-alarm-to-slack-fn.ts:162

Date#setTime returns the numeric epoch in milliseconds, so each Slack log entry displays a value such as 1700000000001 instead of a readable event time. Format the date value before embedding it.

Preserve raw messages when JSON parsing fails

packages/cdk-utilities/src/lib/functions/publish-error-logs-to-slack-fn.ts:122

Both branches call JSON.parse without the fallback promised above. Any non-JSON message matched by a custom subscription filter aborts the entire CloudWatch Logs batch, so the documented “any other format still works” behavior does not work; preserve the raw text when parsing fails.

Classify standard Lambda module-load failures correctly

packages/cdk-utilities/src/lib/utils/cloudwatch.utils.ts:22

The standard Lambda module-load failures contain Runtime.ImportModuleError and/or Cannot find module; they do not contain “missing on module”. As a result, these failures fall through to the general classifier and are mislabeled instead of being reported as configuration errors.

Use the noun “implementation” in the comment

packages/cdk-utilities/src/scripts/esbuild.script.ts:27

Use “implementation” here; “implement” is a verb and makes the explanatory comment ungrammatical.

michaellieberherr · 2026-10-01T14:34:21Z

@dario-fazio : I reviewed the esbuild setup and added a small optimisation to reduce the Lambda bundle size. I haven’t checked if the potential issues flagged by Copilot are valid. Otherwise it looks good to me.

Copilot

Copilot review overview

🔵 Needs a closer look

Notification delivery, default filtering, batching, and cross-stack behavior contain unresolved correctness and reliability problems.

Review effort: Balanced
Findings: 4 · 4

Open (8)

Handle non-success Slack responses as failures
Bound explicit Lambda names to 64 characters
Avoid cross-stack token ownership in imported topic ARN
Use region-aware CloudWatch Logs service principal
Rate-limit Slack delivery for large log batches
Throw on non-2xx Slack responses
Escape all occurrences of Slack markup characters
Default pattern fails to parse plaintext Lambda logs

Previously missed (3)

In code that hasn't changed since last review

Date#setTime return value produces an unreadable timestamp

packages/cdk-utilities/src/lib/functions/publish-alarm-to-slack-fn.ts:162

Date#setTime returns the epoch value as a number, so Slack displays values such as 1700000000001 instead of a readable event time. Format the constructed date rather than interpolating the setter's return value.

This issue also appears on line 188 of the same file.

Malformed event JSON aborts the entire log batch

packages/cdk-utilities/src/lib/functions/publish-error-logs-to-slack-fn.ts:122

A non-JSON event makes JSON.parse throw and fails the entire CloudWatch Logs batch, despite this handler and its documentation supporting plaintext/custom filter patterns. Fall back to the raw log message when parsing fails so one event cannot block every notification in the batch.

Missing-dependency errors are not classified as configuration errors

packages/cdk-utilities/src/lib/utils/cloudwatch.utils.ts:22

This phrase does not match Lambda's missing-dependency errors (Runtime.ImportModuleError: Cannot find module/package ...), so those events are classified only as generic errors rather than configuration errors. Match the actual runtime messages.

- escaping for slack (alarm message) - handle non-successful fetch responses

- @shiftcode/cdk-utilities@1.1.0-pr87.4

Copilot

Copilot review overview

🟡 Changes recommended

Several event-handling and infrastructure defects can lose alerts or break deployments.

Review effort: Balanced
Findings: 4 · 3

Open (7)

Raise aws-cdk-lib peer dependency to match used APIs · New
Handle non-success Slack responses as failures
Bound explicit Lambda names to 64 characters
Avoid cross-stack token ownership in imported topic ARN
Rate-limit Slack delivery for large log batches
Escape all occurrences of Slack markup characters
Default pattern fails to parse plaintext Lambda logs

Resolved since last review (2)

Use region-aware CloudWatch Logs service principal
Throw on non-2xx Slack responses

Previously missed (3)

In code that hasn't changed since last review

Avoid token-based Lambda ARN cross-stack coupling

packages/cdk-utilities/src/lib/alarming.construct.ts:213

this.publishErrorLogsToSlackFunction.functionArn remains a token owned by the construct stack; importing that token into scope still creates the export/import coupling this code says it avoids. Use an ARN built from a retained stable function name and environment, or keep the direct reference and document the dependency.

Format event timestamps instead of returning epoch numbers

packages/cdk-utilities/src/lib/functions/publish-alarm-to-slack-fn.ts:163

Date#setTime returns the epoch millisecond number, so Slack receives values such as 1700000000000 rather than a readable event time. Format the constructed date instead.

This issue also appears in the following locations of the same file:

line 189
line 194

Handle CloudWatch control messages and empty logEvents

packages/cdk-utilities/src/lib/functions/publish-error-logs-to-slack-fn.ts:115

CloudWatch Logs can send CONTROL_MESSAGE payloads without data events to verify the destination. Calling .map unconditionally makes that invocation fail and retry; return successfully for control messages or an absent/empty logEvents array.

This issue also appears in the following locations of the same file:

line 131
line 141

# Conflicts: # package-lock.json # packages/cdk-utilities/package.json

…mbda ARNs

Copilot · 2026-10-29T13:59:23Z

One or more custom setup steps configured for this repository failed during this Copilot code review run:

GitHub registry Auth & Install Dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

Copilot

🟡 Changes recommended

Unbounded log enrichment can exhaust the notification Lambda’s 30-second timeout before the alarm reaches Slack, allowing optional context gathering to prevent alarm delivery.

9 open issues

1 resolved since last review

Avoid cross-stack token ownership in imported topic ARN

_{Review effort: Balanced}

+        ...(parsedLambdaLog ? [`| filter @requestId = '${parsedLambdaLog.requestId}'`] : []),
+        // alternative filters than can be uncommented if needed
+        `#| filter level = 'ERROR'`,
+        `#| filter logger = '${parsedMessage.logger}'`,


+    slackErrorTypeMessage: ':hammer_and_wrench: Configuration error',
+  },
+  general: {
+    isTypeRegex: /\b(error:\s)\b|\b(\serror\s)\b|\b(errorMessage)/i,


Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

Copilot · 2026-10-29T15:19:40Z

One or more custom setup steps configured for this repository failed during this Copilot code review run:

GitHub registry Auth & Install Dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

Copilot · 2026-10-29T15:46:50Z

One or more custom setup steps configured for this repository failed during this Copilot code review run:

GitHub registry Auth & Install Dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

Copilot

🟡 Changes recommended

A missing Lambda permission dependency can break initial deployments, while unresolved log filtering and delivery issues can omit error context or prevent Slack notifications.

10 open issues

_{Review effort: Balanced}

+    const destination = LambdaFunction.fromFunctionAttributes(scope, `${props.id}Destination`, {
+      functionArn: this.publishErrorLogsToSlackFunctionArn,
+      sameEnvironment: true,
+    })


Copilot

🟡 Changes recommended

Unresolved lint violations and an undefined logger filter that fails a new test remain, alongside error-detection and delivery flaws that can omit or duplicate Slack notifications.

11 open issues

_{Review effort: Balanced}

@@ -10,4 +10,10 @@ export default defineScTsConfig(
      'import/no-internal-modules': ['error', { allow: ['aws-cdk-lib/*'] }],


- @shiftcode/cdk-utilities@1.1.0-pr87.8

Copilot

🔵 Needs a closer look

Unresolved issues discard structured error details, risk failed or duplicate Slack alerts under rate limits, and can break configuration or deployment through construct-ID collisions and missing Lambda dependencies.

11 open issues

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Per-log-group permissions lack a dependency on the actual notification Lambda, allowing CloudFormation to create them too early and fail fresh deployments with function-not-found errors.

11 open issues

_{Review effort: Balanced}

feat(cdk-utilities): add alarming construct to streamline alarming setup

6f60c40

dario-fazio linked an issue Sep 18, 2026 that may be closed by this pull request

CDK Construct for Alarming #87

Open

dario-fazio and others added 9 commits September 18, 2026 16:03

fix(cdk-utilities): update dependencies

0746925

feat(cdk-utilities): added default descriptions to metric alarm props

d6c50ce

feat(cdk-utilities): add iac-utilities path mapping to tsconfig

6b2b5ba

feat(cdk-utilities): add path mappings for linter

56cb50c

build(release): next version [skip_build]

2d4bc1b

- @shiftcode/cdk-utilities@1.1.0-pr87.0

feat(cdk-utilities): integrate params-and-secrets layer for Slack web…

86cc917

…hook retrieval

build(release): next version [skip_build]

440b902

- @shiftcode/cdk-utilities@1.1.0-pr87.1

feat(cdk-utilities): add options for CloudWatch Logs permissions mana…

2d76e96

…gement in alarming construct

build(release): next version [skip_build]

2a9b042

- @shiftcode/cdk-utilities@1.1.0-pr87.2

dario-fazio marked this pull request as ready for review September 29, 2026 14:22

Copilot AI balanced review requested due to automatic review settings September 29, 2026 14:22

Copilot started reviewing on behalf of dario-fazio September 29, 2026 14:23

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

perf(cdk-utilities): prefer ESM dependencies in lambda bundles

280a880

Copilot AI balanced review requested due to automatic review settings October 1, 2026 14:27

Copilot started reviewing on behalf of dario-fazio October 1, 2026 14:28

View session

build(release): next version [skip_build]

cecad40

- @shiftcode/cdk-utilities@1.1.0-pr87.3

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread packages/cdk-utilities/src/lib/alarming.construct.ts Resolved

Comment thread packages/cdk-utilities/src/lib/alarming.construct.ts Resolved

Comment thread packages/cdk-utilities/src/lib/functions/publish-alarm-to-slack-fn.ts Resolved

Copilot AI balanced review requested due to automatic review settings October 1, 2026 14:32

Copilot started reviewing on behalf of dario-fazio October 1, 2026 14:33

View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

feat(cdk-utilities): region aware service principal

1500080

- escaping for slack (alarm message) - handle non-successful fetch responses

Copilot AI balanced review requested due to automatic review settings October 5, 2026 08:24

Copilot started reviewing on behalf of dario-fazio October 5, 2026 08:25

View session

build(release): next version [skip_build]

eeda8d3

- @shiftcode/cdk-utilities@1.1.0-pr87.4

Copilot AI reviewed Oct 5, 2026

View reviewed changes

Comment thread packages/cdk-utilities/package.json Resolved

Copilot AI balanced review requested due to automatic review settings October 5, 2026 08:33

patricksuter added 4 commits October 29, 2026 12:02

Merge branch 'main' into #87-cdk-alarming

1fb4163

# Conflicts: # package-lock.json # packages/cdk-utilities/package.json

fix(cdk-utilities): rebuilt package-lock.json after merge

fb720ee

fix(cdk-utilities): improved log insights query

9f105fc

fix(cdk-utilities): try to avoid stack outputs/imports for topic & la…

f2dff05

…mbda ARNs

Copilot AI balanced review requested due to automatic review settings October 29, 2026 13:50

Copilot started reviewing on behalf of dario-fazio October 29, 2026 13:50

View session

Copilot AI reviewed Oct 29, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 29, 2026 15:18

Copilot started reviewing on behalf of dario-fazio October 29, 2026 15:18

View session

Copilot AI reviewed Oct 29, 2026

Copilot stopped reviewing on behalf of dario-fazio due to an error October 29, 2026 15:19
The "GitHub registry Auth & Install Dependencies" custom setup step from your .github/workflows/copilot-setup-steps.yml file failed.

Copilot AI balanced review requested due to automatic review settings October 29, 2026 15:36

Copilot started reviewing on behalf of dario-fazio October 29, 2026 15:36

View session

Copilot AI reviewed Oct 29, 2026

View reviewed changes

Comment thread packages/cdk-utilities/src/lib/alarming.construct.ts

Comment on lines +223 to +226

const destination = LambdaFunction.fromFunctionAttributes(scope, `${props.id}Destination`, {

functionArn: this.publishErrorLogsToSlackFunctionArn,

sameEnvironment: true,

})

Copilot AI balanced review requested due to automatic review settings October 29, 2026 16:01

Copilot started reviewing on behalf of dario-fazio October 29, 2026 16:02

View session

fix(cdk-utilities): rebuild package-lock.json

c4f738c

Copilot AI reviewed Oct 29, 2026

View reviewed changes

Comment thread packages/cdk-utilities/eslint.config.js

@@ -10,4 +10,10 @@ export default defineScTsConfig(

'import/no-internal-modules': ['error', { allow: ['aws-cdk-lib/*'] }],

fix(cdk-utilities): fix publish-error-logs-to-slack-fn.spec.ts

ca93c48

patricksuter force-pushed the #87-cdk-alarming branch from e1748d4 to ca93c48 Compare October 29, 2026 16:17

Copilot AI balanced review requested due to automatic review settings October 29, 2026 16:17

Copilot started reviewing on behalf of dario-fazio October 29, 2026 16:17

View session

build(release): next version [skip_build]

704250f

- @shiftcode/cdk-utilities@1.1.0-pr87.8

Copilot AI reviewed Oct 29, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 29, 2026 16:23

Copilot started reviewing on behalf of dario-fazio October 29, 2026 16:23

View session

Copilot AI reviewed Oct 29, 2026

View reviewed changes

		@@ -10,4 +10,10 @@ export default defineScTsConfig(
		'import/no-internal-modules': ['error', { allow: ['aws-cdk-lib/*'] }],

Conversation

dario-fazio commented Sep 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

michaellieberherr commented Oct 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI commented Oct 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Oct 29, 2026

Uh oh!

Copilot AI commented Oct 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants