Cloudwatch Events Integrations [Feature Request]

[sreedharbukya]

Hey Team,

Can you guide me to build the cloud watch events something like SPOT Instance termination events to come in Slack channel?.

Currently, It just works as generic events, but I would like to get bare minimum tags like Instance Name or Instance type and AZ name.

Current notification to Slack.

aws.ec2 (ap-southeast-1 - XXXXXX)
EC2 Instance State-change Notification
version
0
id
e88ed778-8861-7f63-b63c-089cbb569a17
resources
["arn:aws:ec2:ap-southeast-1:XXXX:instance/i-047dd4e31a66a990b"]
detail
{"instance-id":"i-047dd4e31a66a990b","state":"terminated"}```

Desired Notification

aws.ec2 (ap-southeast-1 - XXXXXX)
EC2 Instance State-change Notification
SPOT Instance State change : Name: foo-bar in region az and reason for it ??
Instance ID: i-047dd4e31a66a990b
State Change
STATE → TERMINATED
Region
Asia Pacific (Singapore)

[homeyjd]

To create a parser, we need an example raw JSON event as received from CloudWatch.

In your requested format, it looks like a parser would need to:

• inspect the EC2 instance by ID (will require region-specific IAM privileges)
• determine if the instance is a spot instance (example just says "EC2 Instance" not "Spot Instance" so I'm not sure how you know that event is for a spot instance)
• you have "STATE → TERMINATED", does that mean you want to infer what the previous state was??
• identify a reason (I'm not sure AWS even provides this info??)
• hard-code a region-code to region-full lookup object (the raw event doesn't have "Asia Pacific", so you would have to infer this value from an internal lookup)

It might be a little easier to simplify this format a little.
Open to a PR if you'd like!