Skip to content

Support array index access in Alert Management Payload parser

Peter Leitzen requested to merge pl-alert-management-payload-array into pl-alert-management-payload-deep

What does this MR do?

Based on and follow up of !46089 (closed)

This MR adds support for array access for Alert Management Payload parser so payloads like AWS CloudWatch

          {
            "Records": [{
              "EventSource": "aws:sns",
              "EventVersion": "1.0",
              "EventSubscriptionArn": "arn:aws:sns:eu-west-1:000000000000:cloudwatch-alarms:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
              "Sns": {
                "Type": "Notification",
                "MessageId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                "TopicArn": "arn:aws:sns:eu-west-1:000000000000:cloudwatch-alarms",
                "Subject": "ALARM: \"Example alarm name\" in EU - Ireland",
                "Message": "{\"AlarmName\":\"Example alarm name\",\"AlarmDescription\":\"Example alarm description.\",\"AWSAccountId\":\"000000000000\",\"NewStateValue\":\"ALARM\",\"NewStateReason\":\"Threshold Crossed: 1 datapoint (10.0) was greater than or equal to the threshold (1.0).\",\"StateChangeTime\":\"2017-01-12T16:30:42.236+0000\",\"Region\":\"EU - Ireland\",\"OldStateValue\":\"OK\",\"Trigger\":{\"MetricName\":\"DeliveryErrors\",\"Namespace\":\"ExampleNamespace\",\"Statistic\":\"SUM\",\"Unit\":null,\"Dimensions\":[],\"Period\":300,\"EvaluationPeriods\":1,\"ComparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"Threshold\":1.0}}",
                "Timestamp": "2017-01-12T16:30:42.318Z",
                "SignatureVersion": "1",
                "Signature": "Cg==",
                "SigningCertUrl": "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.pem",
                "UnsubscribeUrl": "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:000000000000:cloudwatch-alarms:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                "MessageAttributes": {}
              }
            }]
          }

can be parsed via

        class AWSCloudWatch < Base
          attribute :record, paths: %w[Records 0 Sns]
          private :record
          attribute :message, paths: 'Message', type: :json, via: :record
          private :message

          attribute :starts_at, paths: 'Timestamp', type: :time, via: :record
          attribute :title, paths: 'AlarmName', via: :message
          attribute :description, paths: 'AlarmDescription', via: :message
        end

parsed = AWSCloudWatch.new(project: project, payload: payload)
parsed.starts_at # => 2017-01-12 16:30:42.318 UTC

Contributes to #262707 (closed).

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Peter Leitzen

Merge request reports