AWS Lambda

AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute resources, with no servers to provision or scale.

Available solutions

Zabbix version 7.4 7.2 7.0 6.0
Source: templates/cloud/AWS/aws_http

AWS Lambda by HTTP

Overview

This template uses the GetMetricData CloudWatch API calls to list and retrieve metrics. For more information, please refer to the CloudWatch pricing page.

Additional information about metrics and API methods used in the template:

Requirements

Zabbix version: 7.4 and higher.

Tested versions

This template has been tested on:

  • AWS Lambda by HTTP

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

The template gets AWS Lambda metrics and uses the script item to make HTTP requests to the CloudWatch API.

Before using the template, you need to create an IAM policy with the necessary permissions for the Zabbix role in your AWS account. For more information, visit the Lambda permissions page on the AWS website.

Required Permissions

Add the following required permissions to your Zabbix IAM policy in order to collect AWS Lambda metrics.

{
    "Version":"2012-10-17",
    "Statement":[
        {
          "Action":[
              "cloudwatch:DescribeAlarms",
              "cloudwatch:GetMetricData"
          ],
          "Effect":"Allow",
          "Resource":"*"
        }
    ]
  }

Access Key Authorization

If you are using access key authorization, you need to generate an access key and secret key for an IAM user with the necessary permissions:

  1. Create an IAM user with programmatic access.
  2. Attach the required policy to the IAM user.
  3. Generate an access key and secret key.
  4. Use the generated credentials in the macros {$AWS.ACCESS.KEY.ID} and {$AWS.SECRET.ACCESS.KEY}.

Assume role authorization

For using assume role authorization, add the appropriate permissions to the role you are using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::{Account}:user/{UserName}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData"
            ],
            "Resource": "*"
        }
    ]
}

Trust Relationships for Assume Role Authorization

Next, add a principal to the trust relationships of the role you are using:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{Account}:user/{UserName}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Set the following macros: {$AWS.ACCESS.KEY.ID}, {$AWS.SECRET.ACCESS.KEY}, {$AWS.STS.REGION}, {$AWS.ASSUME.ROLE.ARN}.

Note: If you set the {$AWS.ASSUME.ROLE.AUTH.METADATA} macro to true and set the macros {$AWS.STS.REGION} and {$AWS.ASSUME.ROLE.ARN}, the Zabbix server or proxy will attempt to retrieve the role credentials from the instance metadata service. This means that the Zabbix server or proxy must be running on an AWS EC2 instance with an IAM role assigned that has the necessary permissions. This approach is recommended when running Zabbix inside an AWS EC2 instance with an IAM role assigned, as it simplifies credential management.

Role-Based Authorization

If you are using role-based authorization, set the appropriate permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::<<--account-id-->>:role/<<--role_name-->>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData",
                "ec2:AssociateIamInstanceProfile",
                "ec2:ReplaceIamInstanceProfileAssociation"
            ],
            "Resource": "*"
        }
    ]
}

Trust Relationships for Role-Based Authorization

Next, add a principal to the trust relationships of the role you are using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "ec2.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}

Note: Using role-based authorization is only possible when you use a Zabbix server or proxy inside AWS.

Set the macros: {$AWS.AUTH_TYPE}, {$AWS.REGION}, and {$AWS.LAMBDA.ARN}.

For more information about managing access keys, see the official AWS documentation.

See the section below for a list of macros used for LLD filters.

Macros used

Name Description Default
{$AWS.AUTH_TYPE}

Authorization method. Possible values: access_key, assume_role, role_base.

 access_key
{$AWS.ASSUME.ROLE.AUTH.METADATA}

Add when using the assume_role through instance metadata or environment authorization method. Possible values: false, true.

 false
{$AWS.ACCESS.KEY.ID}

Access key ID.
{$AWS.SECRET.ACCESS.KEY}

Secret access key.
{$AWS.ASSUME.ROLE.ARN}

ARN assume role; add when using the assume_role authorization method.
{$AWS.REGION}

AWS Lambda function region code.

 us-west-1
{$AWS.PROXY}

Sets the HTTP proxy value. If this macro is empty, no proxy is used.
{$HTTP.TLS.VERIFY}

TLS certificate verification for script items: "none" - disabled, "peer" - verify the certificate chain and expiration, "full" - full verification. Any other value enables full verification. To override the setting for this template only, define the macro with the context "AWS Lambda", e.g. {$HTTP.TLS.VERIFY:"AWS Lambda"}.

 full
{$AWS.STS.REGION}

Region used in assume role request.

 us-east-1
{$AWS.DATA.TIMEOUT}

API response timeout.

 60s
{$AWS.LAMBDA.ARN}

The Amazon Resource Names (ARN) of the Lambda function.
{$AWS.LAMBDA.LLD.FILTER.ALARM_SERVICE_NAMESPACE.MATCHES}

Filter of discoverable alarms by namespace.

 .*
{$AWS.LAMBDA.LLD.FILTER.ALARM_SERVICE_NAMESPACE.NOT_MATCHES}

Filter to exclude discovered alarms by namespace.

 CHANGE_IF_NEEDED
{$AWS.LAMBDA.LLD.FILTER.ALARM_NAME.MATCHES}

Filter of discoverable alarms by name.

 .*
{$AWS.LAMBDA.LLD.FILTER.ALARM_NAME.NOT_MATCHES}

Filter to exclude discovered alarms by name.

 CHANGE_IF_NEEDED

Items

Name Description Type Key and additional info
Get metrics data

Get Lambda function metrics.

Full metrics list related to the Lambda function: https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics.html

 Script aws.lambda.get_metrics

Preprocessing

  • Check for not supported value: any error

    ⛔️Custom on fail: Discard value
Get Lambda alarms data

DescribeAlarms API method: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarms.html

 Script aws.lambda.get_alarms

Preprocessing

  • Check for not supported value: any error

    ⛔️Custom on fail: Discard value
Lambda metrics check

Checks whether Lambda metric data was retrieved correctly.

 Dependent item aws.lambda.metrics.check

Preprocessing

  • JSON Path: $.error

    ⛔️Custom on fail: Set value to

  • Discard unchanged with heartbeat: 3h
Get alarms check

Checks whether the alarm data was retrieved correctly.

 Dependent item aws.lambda.alarms.check

Preprocessing

  • JSON Path: $.error

    ⛔️Custom on fail: Set value to

  • Discard unchanged with heartbeat: 3h
Async events received sum

The number of events that Lambda successfully queues for processing. This metric provides insight into the number of events that a Lambda function receives.

 Dependent item aws.lambda.async_events_received.sum

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value
Async event age average

The time between when Lambda successfully queues the event and when the function is invoked. The value of this metric increases when events are being retried due to invocation failures or throttling.

 Dependent item aws.lambda.async_event_age.avg

Preprocessing

  • JSON Path: $.[?(@.Label == "AsyncEventAge")].Values.first().first()

    ⛔️Custom on fail: Discard value

  • Custom multiplier: 0.001
Async events dropped sum

The number of events that are dropped without successfully executing the function. If you configure a dead-letter queue (DLQ) or an OnFailure destination, events are sent there before they're dropped.

 Dependent item aws.lambda.async_events_dropped.sum

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value
Total concurrent executions

The number of function instances that are processing events. If this number reaches your concurrent executions quota for the Region or the reserved concurrency limit on the function, then Lambda will throttle additional invocation requests.

 Dependent item aws.lambda.concurrent_executions.max

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value
Unreserved concurrent executions maximum

For a Region, the number of events that function without reserved concurrency are processing.

 Dependent item aws.lambda.unreserved_concurrent_executions.max

Preprocessing

  • JSON Path: The text is too long. Please see the template.

    ⛔️Custom on fail: Discard value
Invocations sum

The number of times that your function code is invoked, including successful invocations and invocations that result in a function error. Invocations aren't recorded if the invocation request is throttled or otherwise results in an invocation error. The value of Invocations equals the number of requests billed.

 Dependent item aws.lambda.invocations.sum

Preprocessing

  • JSON Path: $.[?(@.Label == "Invocations")].Values.first().first()

    ⛔️Custom on fail: Discard value
Errors sum

The number of invocations that result in a function error. Function errors include exceptions that your code throws and exceptions that the Lambda runtime throws. The runtime returns errors for issues such as timeouts and configuration errors.

 Dependent item aws.lambda.errors.sum

Preprocessing

  • JSON Path: $.[?(@.Label == "Errors")].Values.first().first()

    ⛔️Custom on fail: Discard value
Dead letter errors sum

For asynchronous invocation, the number of times that Lambda attempts to send an event to a dead-letter queue (DLQ) but fails. Dead-letter errors can occur due to misconfigured resources or size limits.

 Dependent item aws.lambda.dead_letter_errors.sum

Preprocessing

  • JSON Path: $.[?(@.Label == "DeadLetterErrors")].Values.first().first()

    ⛔️Custom on fail: Discard value
Throttles sum

The number of invocation requests that are throttled. When all function instances are processing requests and no concurrency is available to scale up, Lambda rejects additional requests with a TooManyRequestsException error.

 Dependent item aws.lambda.throttles.sum

Preprocessing

  • JSON Path: $.[?(@.Label == "Throttles")].Values.first().first()

    ⛔️Custom on fail: Discard value
Duration average

The amount of time that your function code spends processing an event. The billed duration for an invocation is the value of Duration rounded up to the nearest millisecond. Duration does not include cold start time.

 Dependent item aws.lambda.duration.avg

Preprocessing

  • JSON Path: $.[?(@.Label == "Duration")].Values.first().first()

    ⛔️Custom on fail: Discard value

  • Custom multiplier: 0.001

Triggers

Name Description Expression Severity Dependencies and additional info
AWS Lambda: Failed to get metrics data

Failed to get CloudWatch metrics for the Lambda function.

 length(last(/AWS Lambda by HTTP/aws.lambda.metrics.check))>0 Warning
AWS Lambda: Failed to get alarms data

Failed to get CloudWatch alarms for the Lambda function.

 length(last(/AWS Lambda by HTTP/aws.lambda.alarms.check))>0 Warning

LLD rule Lambda alarm discovery

Name Description Type Key and additional info
Lambda alarm discovery

Used for the discovery of alarm Lambda functions.

 Dependent item aws.lambda.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for Lambda alarm discovery

Name Description Type Key and additional info
[{#ALARM_NAME}]: Get metrics

Get metrics about the alarm state and its reason.

 Dependent item aws.lambda.alarm.get_metrics["{#ALARM_NAME}"]

Preprocessing

  • JSON Path: $.[?(@.AlarmName == "{#ALARM_NAME}")].first()

    ⛔️Custom on fail: Discard value
[{#ALARM_NAME}]: State reason

An explanation for the alarm state reason in text format.

Alarm description:

{#ALARM_DESCRIPTION}

 Dependent item aws.lambda.alarm.state_reason["{#ALARM_NAME}"]

Preprocessing

  • JSON Path: $.StateReason

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 3h
[{#ALARM_NAME}]: State

The value of the alarm state. Possible values:

0 - OK;

1 - INSUFFICIENT_DATA;

2 - ALARM.

Alarm description:

{#ALARM_DESCRIPTION}

 Dependent item aws.lambda.alarm.state["{#ALARM_NAME}"]

Preprocessing

  • JSON Path: $.StateValue

    ⛔️Custom on fail: Set value to: 3

  • JavaScript: The text is too long. Please see the template.

Trigger prototypes for Lambda alarm discovery

Name Description Expression Severity Dependencies and additional info
AWS Lambda: [{#ALARM_NAME}] has 'Alarm' state

The alarm {#ALARM_NAME} is in the ALARM state.
Reason: {ITEM.LASTVALUE2}

 last(/AWS Lambda by HTTP/aws.lambda.alarm.state["{#ALARM_NAME}"])=2 and length(last(/AWS Lambda by HTTP/aws.lambda.alarm.state_reason["{#ALARM_NAME}"]))>0 Average
AWS Lambda: [{#ALARM_NAME}] has 'Insufficient data' state

Either the alarm has just started, the metric is not available, or not enough data is available for the metric to determine the alarm state.

 last(/AWS Lambda by HTTP/aws.lambda.alarm.state["{#ALARM_NAME}"])=1 Info

Articles and documentation

+ Propose new article

Didn't find what you are looking for?

Request custom integration

Zabbix integration team will develop custom integration based on your requirements and Zabbix best practices.

Request

Propose integration

Have you already developed high quality integration and want to submit to Zabbix integration repository?

Propose