aws

Documentation

Overview

Package aws polls AWS APIs and emits cloud-resource alerts into the same pipeline as the in-cluster Kubernetes watchers. It implements one sources.Source per AWS service, each gated by its own config toggle and scoped to the configured regions (S3 and Route53 are global, built once):

• EKS - control-plane / nodegroup health
• CloudWatch - alarms in ALARM state
• EC2 - instance status-check failures
• ELBv2 - load-balancer / target-group health
• RDS - DB-instance health
• DynamoDB - table status
• ElastiCache - cluster status
• S3 - public-access exposure (global)
• CloudTrail - curated security/change events
• ASG - Auto Scaling group health
• KMS - key state
• EBS - volume status
• Aurora - cluster health
• NAT - NAT gateway state
• EFS - file-system state
• ACM - certificate expiry/status
• VPN - VPN connection state
• Route53 - health-check status (global)

Credentials resolve through the standard AWS chain (config.LoadDefaultConfig): IAM Roles for Service Accounts (IRSA) in-cluster, or env/shared-config when run locally. Each source declares a narrow per-service interface (eksAPI, cloudwatchAPI, ec2API, ...) naming exactly the API calls it makes, so the sources unit-test against canned responses without the SDK touching the network or real credentials.

Index

• func NewProvider(ctx context.Context, cfg *config.Config) ([]sources.Source, error)

Functions

func NewProvider

func NewProvider(ctx context.Context, cfg *config.Config) ([]sources.Source, error)

NewProvider builds the enabled AWS sources, one client set per configured region. It returns an error if AWS config/credentials cannot be resolved for a region; the caller logs it and continues without AWS so a cloud-auth problem never takes down the Kubernetes watchers.