feat(observability): emit a CloudWatch metric when webhook guardrail screening fails (fail-open silently degrades enrichment)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 68/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- aws, typescript
- Domain
- cloud, observability
Research direction
Start by reading the three named screening paths in jira-webhook-processor.ts and linear-webhook-processor.ts, then inspect the shared SNS alarm-notification plane described in #686. Add a CloudWatch metric for each fail-open source and wire it into that shared alarm plane, with all three webhook paths producing the expected signal.
Written by the indexing model from the issue text.
Description
Non-blocking follow-up from the PR #788 review (silent-failure-hunter finding).
Problem
The three webhook screening paths — jira-webhook-processor.ts screenCommentsOrDrop, and linear-webhook-processor.ts screenProjectDocsOrDrop / screenCommentsOrDrop — fail open on a Bedrock Guardrail error: they logger.warn(...) and drop the third-party content so the task proceeds. That posture is correct (see the ADR proposed in #793), but the only signal is a log line. A sustained Bedrock Guardrail outage would silently degrade comment/doc enrichment fleet-wide, discoverable only via log search — there is no metric and nothing to alarm on.
Proposed fix
Emit a CloudWatch metric (e.g. WebhookScreeningFailed with a source dimension — jira-comments / linear-docs / linear-comments) on each fail-open path, so the degradation is graphable and alarmable. Wire it into the shared alarm plane rather than a bespoke alarm.
Related
- #686 — shared SNS alarm-notification plane (wire the alarm here)
- #485 — security operations metrics (coverage)
- PR #788 (the fail-open suppressions)
- Dominant language
- TypeScript
- Stars
- 158
- Forks
- 49
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 17
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aws-samples/sample-autonomous-cloud-coding-agents
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
aws-samples/sample-autonomous-cloud-coding-agents#950 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
aws-samples/sample-autonomous-cloud-coding-agents#908 ·
Maintainers usually reply within 1 day
-
bug v1
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
aws-samples/sample-autonomous-cloud-coding-agents#886 ·
Maintainers usually reply within 1 day
-
bug v1
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
aws-samples/sample-autonomous-cloud-coding-agents#861 ·
Maintainers usually reply within 1 day
-
documentation P2 security
Difficulty 2/5 1-2 days Newbie friendliness 74/100
aws-samples/sample-autonomous-cloud-coding-agents#793 ·
Maintainers usually reply within 1 day
All issues in aws-samples/sample-autonomous-cloud-coding-agents
Similar issues
-
affected/v17 affected/v18 area/frontend type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
umbraco/Umbraco-CMS#24186 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
better-auth/better-auth#11723 · 1 reaction ·
Maintainers usually reply within 1 day
-
area: docs difficulty: easy documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Worker-Erstellung bricht langsame Git-Worktree-Checkouts nach 20 Sekunden abPossibly taken @KajoVanBuyten claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 69/100
AgentSystemLabs/agent-office#367 ·
Maintainers usually reply within 1 day