AWS API Gateway 5XX Error Rate and Latency Degradation Sentinel

id: aws-api-gateway-latency-and-5xx-sentinel
namespace: company.cloud

inputs:
  - id: aws_region
    type: STRING
    defaults: "us-east-1"
    description: Target AWS region.
  - id: api_name
    type: STRING
    description: Amazon API Gateway name or ID.
  - id: max_5xx_errors
    type: INT
    defaults: 10
    description: Maximum acceptable count of HTTP 5XX server errors over the last 15
      minutes.

tasks:
  - id: query_api_gateway_telemetry
    type: io.kestra.plugin.aws.cli.AwsCLI
    region: "{{ inputs.aws_region }}"
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    commands:
      - |
        START_TIME=$(date -u -v-15M +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "15 minutes ago" +%Y-%m-%dT%H:%M:%SZ)
        END_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)

        aws cloudwatch get-metric-data           --metric-data-queries '[{"Id":"e5xx","MetricStat":{"Metric":{"Namespace":"AWS/ApiGateway","MetricName":"5XXError","Dimensions":[{"Name":"ApiName","Value":"{{ inputs.api_name }}"}]},"Period":900,"Stat":"Sum"}},{"Id":"lat","MetricStat":{"Metric":{"Namespace":"AWS/ApiGateway","MetricName":"Latency","Dimensions":[{"Name":"ApiName","Value":"{{ inputs.api_name }}"}]},"Period":900,"Stat":"Average"}}]'           --start-time "$START_TIME"           --end-time "$END_TIME"           --output json > /tmp/apigw_telemetry.json

        ERRORS_5XX=$(jq '.MetricDataResults[] | select(.Id == "e5xx") | .Values | add // 0' /tmp/apigw_telemetry.json)
        AVG_LATENCY=$(jq '.MetricDataResults[] | select(.Id == "lat") | .Values[0] // 0' /tmp/apigw_telemetry.json)

        echo "::set-output name=errors_5xx::$ERRORS_5XX::"
        echo "::set-output name=avg_latency::$AVG_LATENCY::"

  - id: evaluate_api_health
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.query_api_gateway_telemetry.vars.errors_5xx | int >
      inputs.max_5xx_errors }}"
    then:
      - id: notify_api_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#api-incident-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 AWS API Gateway 5XX Error Spike Alert",
                "text": "API Gateway `{{ inputs.api_name }}` recorded *{{ outputs.query_api_gateway_telemetry.vars.errors_5xx }}* 5XX errors in the last 15 minutes (avg latency: {{ outputs.query_api_gateway_telemetry.vars.avg_latency }}ms). Impact: Client applications are receiving gateway errors and dropped requests.",
                "footer": "Kestra Cloud Sentinel • AWS API Gateway"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#api-incident-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ API Gateway Sentinel Execution Failed",
            "text": "The API Gateway CloudWatch query workflow failed. Please verify AWS credentials and API name.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true