metric-stream.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "CloudFormation template for Highlight.io metrics integration"

Parameters:
  HighlightProjectID:
    Type: String
    Description: Your Highlight.io Project ID

  OTelEndpoint:
    Type: String
    Description: OpenTelemetry endpoint URL for metrics
    Default: https://otel.highlight.io/v1/metrics

  MonitoredRegions:
    Type: CommaDelimitedList
    Description: List of AWS regions to monitor (e.g., us-east-1,us-west-2)
    Default: us-east-1

  MetricNamespaces:
    Type: CommaDelimitedList
    Description: List of CloudWatch namespaces to monitor
    Default: AWS/EC2,AWS/Lambda,AWS/RDS

Resources:
  MetricStreamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: streams.metrics.cloudwatch.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: MetricStreamPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - firehose:PutRecord
                  - firehose:PutRecordBatch
                Resource: !GetAtt DeliveryStream.Arn

  BackupBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub highlight-metrics-backup-${AWS::StackName}-${AWS::AccountId}
      LifecycleConfiguration:
        Rules:
          - Id: DeleteOldBackups
            Status: Enabled
            ExpirationInDays: 14

  FirehoseRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: firehose.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: FirehosePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/kinesisfirehose/highlight-metrics-${AWS::StackName}:*
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                Resource:
                  - !Sub ${BackupBucket.Arn}/*

  DeliveryStream:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamName: !Sub highlight-metrics-${AWS::StackName}
      DeliveryStreamType: DirectPut
      HttpEndpointDestinationConfiguration:
        EndpointConfiguration:
          Url: !Ref OTelEndpoint
        RequestConfiguration:
          ContentEncoding: GZIP
          CommonAttributes:
            - Key: x-highlight-project
              Value: !Ref HighlightProjectID
        BufferingHints:
          IntervalInSeconds: 60
          SizeInMBs: 1
        RoleARN: !GetAtt FirehoseRole.Arn
        S3BackupMode: FailedDataOnly
        S3Configuration:
          BucketARN: !GetAtt BackupBucket.Arn
          BufferingHints:
            IntervalInSeconds: 300
            SizeInMBs: 5
          CompressionFormat: GZIP
          RoleARN: !GetAtt FirehoseRole.Arn
          Prefix: failed-metrics/

  MetricStream:
    Type: AWS::CloudWatch::MetricStream
    Properties:
      FirehoseArn: !GetAtt DeliveryStream.Arn
      IncludeFilters:
        Fn::Transform:
          - Name: "AWS::Include"
            Parameters:
              Location: !Sub "${MetricNamespaces}"
      OutputFormat: opentelemetry0.7
      RoleArn: !GetAtt MetricStreamRole.Arn
      Name: !Sub highlight-metric-stream-${AWS::StackName}
      IncludeRegions: !Ref MonitoredRegions

Outputs:
  MetricStreamArn:
    Description: ARN of the created metric stream
    Value: !GetAtt MetricStream.Arn

  FirehoseArn:
    Description: ARN of the created Kinesis Firehose
    Value: !GetAtt DeliveryStream.Arn

  BackupBucketName:
    Description: Name of the S3 bucket for failed delivery backups
    Value: !Ref BackupBucket