-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(applicationsignals-alpha): introduce Application Signals L2 constructs #32931
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request
. Additionally, if clarification is needed add Clarification Request
to a comment.
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #32931 +/- ##
=======================================
Coverage 82.38% 82.38%
=======================================
Files 120 120
Lines 6937 6937
Branches 1170 1170
=======================================
Hits 5715 5715
Misses 1119 1119
Partials 103 103
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
921a486
to
43766a8
Compare
@Mergifyio refresh |
✅ Pull request refreshed |
652b1da
to
021dcf9
Compare
throw new Error('Fargate tasks must deploy CloudWatch Agent as a sidecar container'); | ||
} | ||
if (cloudWatchAgentConfig.enableSidecar) { | ||
props.taskDefinition.taskRole.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy')); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
using this Managed policy violates the Apply least-privilege permissions rule of the security best practices, since as defined here, this managed policy enable multiple actions for *
resources. It will be petter to add a new Policy, and add the specific resources that you need these actions to be allowed on them.
packages/@aws-cdk/aws-applicationsignals-alpha/lib/enablement/ecs.ts
Outdated
Show resolved
Hide resolved
packages/@aws-cdk/aws-applicationsignals-alpha/lib/enablement/ecs.ts
Outdated
Show resolved
Hide resolved
021dcf9
to
6a0863c
Compare
Pull request has been modified.
5a2f537
to
f8b8fa2
Compare
This PR has been in the BUILD FAILING state for 3 weeks, and looks abandoned. Note that PRs with failing linting check or builds are not reviewed, please ensure your build is passing To prevent automatic closure:
This PR will automatically close in 7 days if no action is taken. |
This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error. |
Comments on closed issues and PRs are hard for our team to see. |
@bjrara .. are you planning to finalize this PR ? |
Yes. |
bb1e7ce
to
612770e
Compare
53bb7d4
to
54b6c75
Compare
All the major comments are addressed. Only two comments to add additional document link for used environment variables are left open. |
54b6c75
to
d261b3e
Compare
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks @bjrara for addressing my previous comments. Code looks very good, I just left some comments related to testing.
#### Enable Application Signals on ECS with sidecar mode | ||
|
||
1. Configure `instrumentation` to instrument the application with the ADOT Java Agent. | ||
2. Setting `enableSidecar` to true to add the CloudWatch Agent as a sidecar container. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i think this step is not valid any more, at least I could not find it in the below example.
1. Run CloudWatch Agent as a daemon service with service connect. | ||
1. Configure `instrumentation` to instrument the application with the ADOT Python Agent. | ||
1. Set `enableSidecar` to false to disable running CloudWatch agent as a sidecar. | ||
1. Override environment variables by configuring `overrideEnvironments` to use service connect endpoints to communicate to the CloudWatch agent server |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe these steps do not match the below example. Could you please update them.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you refactor the unit test cases to split them in files that match your new files
props.instrumentation.sdkVersion, | ||
overrideEnvironments, | ||
); | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you add else here to throw error that this is not supported instrumentation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you cover all the supported instrumentation, since we do different configuration for each language. Also, can you add assertion logic, to verify 1\The ECS tasks are still running successfully after we applied the application signals changes 2\ If it is possible, to check if we can find monitoring data got pushed to Application signals in Cloud watch.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
similar to the previous test case, increase the coverage of instrumentations.
Also, I think Sidecar, can also be applied to EC2 Ecs tasks, so can you add another integration test case that cover that.
value: 'http://cwagent-4316-http:4316/v1/metrics', | ||
}, { | ||
name: appsignals.TraceExporting.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, | ||
value: 'hhttp://cwagent-4316-http:4316/v1/traces', |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
typo in hhttp
Issue # (if applicable)
N/A
Description of changes
This PR adds L2 constructs to simplify the Application Signals enablement process. See aws/aws-cdk-rfcs#672 for more details.
Describe any new or updated permissions being added
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license