Dsos 2552 create ebs volume dashboard nomis

terraform/environments/nomis/cloudwatch_dashboard/dashboard.tf

@@ -1,10 +1,29 @@
+resource "aws_ssm_association" "calculate_ebs_performance_metrics" {
+  name                 = "AWSSupport-CalculateEBSPerformanceMetrics"
+  schedule_expression  = "rate(2 hours)"
+  automation_target_parameter_name = "ResourceId"
+
+  parameters = {
+    AutomationAssumeRole = "arn:aws:iam::612659970365:role/EBSPerformanceMonitoringRole"
+    StartTime            = local.ebs_performance_start_time
+    EndTime              = local.ebs_performance_end_time
+  }
+  targets {
+    key = "InstanceIds"
+    values = ["*"]
+  }
+}
+
 resource "aws_cloudwatch_dashboard" "nomis_cloudwatch_dashboard" {
   dashboard_name = "CloudWatch-Default"
   dashboard_body = jsonencode(local.dashboard_body)
 }
 
 locals {
-
+  start_time = timeadd(timestamp(), "-24h")
+  ebs_performance_start_time = replace(local.start_time, "/[Z]/", "")
+  ebs_performance_end_time = replace(timestamp(), "/[Z]/", "")
+
   cloudwatch_period = 300
   region            = "eu-west-2"
 

terraform/environments/nomis/locals_test.tf

@@ -4,6 +4,7 @@ locals {
   # baseline presets config
   test_baseline_presets_options = {
     enable_observability_platform_monitoring = true
+    enable_ebs_performance_monitoring = true
     sns_topics = {
       pagerduty_integrations = {
         dso_pagerduty               = "nomis_nonprod_alarms"

terraform/modules/baseline_presets/iam_roles.tf

@@ -7,6 +7,7 @@ locals {
     var.options.enable_image_builder ? ["EC2ImageBuilderDistributionCrossAccountRole"] : [],
     var.options.enable_ec2_oracle_enterprise_managed_server ? ["EC2OracleEnterpriseManagementSecretsRole"] : [],
     var.options.enable_observability_platform_monitoring ? ["observability-platform"] : [],
+    var.options.enable_ebs_performance_monitoring ? ["EBSPerformanceMonitoringRole"] : [],
   ]))
 
   iam_roles = {
@@ -90,6 +91,23 @@ locals {
       ]
     }
 
+    # allow SSM to call AWS services for EBS Performance Metrics
+    EBSPerformanceMonitoringRole = {
+      assume_role_policy = [{
+        effect = "Allow"
+        actions = ["sts:AssumeRole"]
+        principals = {
+          type = "AWS"
+          identifiers = ["*"]
+        }
+      }]
+      policy_attachments = [
+        "arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole",
+        "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
+        "arn:aws:iam::aws:policy/CloudWatchFullAccess",
+      ]
+    }
+
     SasTokenRotatorRole = {
       assume_role_policy = [{
         effect  = "Allow"

terraform/modules/baseline_presets/variables.tf

@@ -31,6 +31,7 @@ variable "options" {
     enable_ec2_user_keypair                      = optional(bool, false)
     enable_shared_s3                             = optional(bool, false)
     enable_observability_platform_monitoring     = optional(bool, false)
+    enable_ebs_performance_monitoring            = optional(bool, false)
     db_backup_s3                                 = optional(bool, false)
     route53_resolver_rules                       = optional(map(list(string)), {})
     iam_policies_filter                          = optional(list(string), [])