AWS AppSync GraphQL API 5XX Server Error Rate Sentinel

id: aws-appsync-5xx-error-rate-sentinel
namespace: company.cloudops

inputs:
  - id: aws_region
    type: STRING
    defaults: us-east-1
    description: AWS region where the AppSync API is deployed.
  - id: api_id
    type: STRING
    defaults: a1b2c3d4e5f6g7h8i9j0
    description: The 26-character AWS AppSync GraphQL API ID to monitor.
  - id: max_5xx_errors_threshold
    type: INT
    defaults: 5
    description: Maximum permissible 5XX server errors in a 15-minute window before
      alerting.

tasks:
  - id: query_appsync_5xx_errors
    type: io.kestra.plugin.aws.cli.AwsCLI
    region: "{{ inputs.aws_region }}"
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    commands:
      - |
        aws cloudwatch get-metric-statistics           --namespace AWS/AppSync           --metric-name 5XXError           --dimensions Name=GraphQLAPIId,Value="{{ inputs.api_id }}"           --start-time $(date -u -v-15m +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "15 minutes ago" +%Y-%m-%dT%H:%M:%SZ)           --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ)           --period 900           --statistics Sum           --output json > appsync_errors.json
        python3 -c "
        import json
        with open('appsync_errors.json') as f:
            dps = json.load(f).get('Datapoints', [])
        total_errors = int(sum(dp.get('Sum', 0) for dp in dps))
        result = {
            'api_id': '{{ inputs.api_id }}',
            'server_errors_5xx': total_errors,
            'alert_triggered': total_errors > {{ inputs.max_5xx_errors_threshold }}
        }
        with open('appsync_summary.json', 'w') as out:
            json.dump(result, out)
        print('AppSync audit:', result)
        "
    outputFiles:
      - appsync_summary.json

  - id: evaluate_server_errors
    type: io.kestra.plugin.core.flow.If
    condition: "{{
      fromJson(read(outputs.query_appsync_5xx_errors.outputFiles['appsync_summa\
      ry.json'])).alert_triggered }}"
    then:
      - id: alert_graphql_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "text": ":warning: *AWS AppSync 5XX Alert*: GraphQL API `{{ inputs.api_id }}` recorded {{ fromJson(read(outputs.query_appsync_5xx_errors.outputFiles['appsync_summary.json'])).server_errors_5xx }} server errors (5XX) in the last 15 minutes. Investigate Lambda resolver errors or DynamoDB data source timeouts."
          }

errors:
  - id: notify_sentinel_error
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": ":warning: *AppSync Sentinel Failure*: Failed to query CloudWatch metrics for API `{{ inputs.api_id }}`."
      }

triggers:
  - id: scheduled_appsync_check
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true