github-for-jira.sd.yml

buildNumber: 0.0.0
name: Github For Jira
description: Connect app for integrating GitHub into Jira
organization: Infrastructure Services - Open Toolchain
notifications:
  email: fusion-arc@atlassian.com
tags:
  brahmos: enabled

compose:
  pgbouncer:
    image: docker.atl-paas.net/sox/micros/pgbouncer
    tag: 1.15.0
    command: [ "database" ]
  microservice:
    image: ${DOCKER_IMAGE_NAME}
    tag: ${DOCKER_IMAGE_TAG}
    ports:
      - 8080:8080
    links:
      - pgbouncer
      - cryptor
    depends_on:
      - cryptor
  cryptor:
    image: docker.atl-paas.net/sox/cryptor-sidecar-application
    tag: 1.1-stable-release

computeClassification:
  dataType:
    - UGC/Label                # name of GitHub org / Jira site
    - PII/IndirectConfidential # name of GitHub org
    - UGC/Configuration        # data about the installation of the GitHub app into Jira sites
    - Security/Secret          # shared Connect secret
    - UGC/PrimaryIdentifier    # references to GitHub entities (commits, pull requests, etc.) and Jira issues
    - UGC/Primary              # GitHub entities (non-persistent) like commits, pull requests, etc.

links:
  healthcheck:
    uri: healthcheck
  deepcheck:
    uri: deepcheck
  source:
    url: git@bitbucket.org:atlassian/github-jira-integration.git

httpRedirect: true

cleanup: false

serviceProxy:
  enabled: true
  ingress:
    authentication:
      enabled: true
  egress:
    dependencies:
      - name: brahmos-wiremock
  plugins:
    auth:
      logLevel: info
      authentication:
        plugins:
          - type: asap
          - type: slauthtoken
      authorization:
        plugins:
          - type: poco

lifecycleEvents:
  source: queue
  # Number of seconds between the termination message and when the instance is terminated.
  timeout: 30

resources:
  - type: slauth-gateway # needed for "atlas slauth curl" calls, see https://hello.atlassian.net/wiki/spaces/MICROS/pages/1463433257/Network+Segmentation+for+Micros+EC2+compute#Add-a-slauth-gateway-resource
    name: ingress
  - type: redisx
    name: cache
    attributes:
      version: 6.x
      size: 500
      clusterModeEnabled: false
      transitEncryptionEnabled: true
      dataType:
        - UGC/Label                # name of GitHub org / Jira site
        - PII/IndirectConfidential # name of GitHub org
        - UGC/PrimaryIdentifier    # references to GitHub entities (commits, pull requests, etc.) and Jira issues

  - type: sqs
    name: backfill
    attributes:
      MaxReceiveCount: 3
      MessageRetentionPeriod: 1209600
      VisibilityTimeout: 602 #Visibility timeout will be overridden by the SQS Listener when we read message from the queue. We set it here anyway in case if that override fails.
      dataType:
        - UGC/Label                # name of GitHub org
        - PII/IndirectConfidential # name of GitHub org

  - type: sqs
    name: push
    attributes:
      MaxReceiveCount: 5
      MessageRetentionPeriod: 1209600
      VisibilityTimeout: 62 #Visibility timeout will be overridden by the SQS Listener when we read message from the queue. We set it here anyway in case if that override fails
      dataType:
        - UGC/Label                # name of GitHub org
        - PII/IndirectConfidential # name of GitHub org
        - UGC/PrimaryIdentifier    # references to GitHub entities (commits, pull requests, etc.) and Jira issues

  - type: sqs
    name: deployment
    attributes:
      MaxReceiveCount: 5
      MessageRetentionPeriod: 1209600
      VisibilityTimeout: 62 #Visibility timeout will be overridden by the SQS Listener when we read message from the queue. We set it here anyway in case if that override fails
      dataType:
        - UGC/Label                # name of GitHub org, URL/name of Jira site
        - PII/IndirectConfidential # name of GitHub org
        - UGC/PrimaryIdentifier    # references to GitHub entities (commits, pull requests, etc.) and Jira issues

  - type: sqs
    name: branch
    attributes:
      MaxReceiveCount: 5
      MessageRetentionPeriod: 1209600
      VisibilityTimeout: 62 #Visibility timeout will be overridden by the SQS Listener when we read message from the queue. We set it here anyway in case if that override fails
      dataType:
        - UGC/Label                # name of GitHub org, URL/name of Jira site
        - PII/IndirectConfidential # name of GitHub org
        - UGC/PrimaryIdentifier    # references to GitHub entities (commits, pull requests, etc.) and Jira issues

  - name: rds
    type: dedicated-rds
    attributes:
      dataType:
        - UGC/Label                # name of GitHub org / Jira site
        - PII/IndirectConfidential # name of GitHub org
      parameters:
        DBType: postgres1211
        CustomParameters:
          log_min_duration_statement: 5000

  - name: database
    type: postgres-db
    attributes:
      connectionLimit: 150 # keep in sync with PGBOUNCER_DEFAULT_POOL_SIZE.
        # For ddev and staging we have scaling policy different from prod: up to 5 Worker and up to 5 WebServer nodes.
        # Therefore, when all the nodes are running, we might have up to "PGBOUNCER_DEFAULT_POOL_SIZE * 10" number
      # of connections.
      dataType:
        - UGC/Label                # name of GitHub org / Jira site
        - PII/IndirectConfidential # name of GitHub org
        - UGC/Configuration        # data about the installation of the GitHub app into Jira sites
        - Security/Secret          # shared Connect secret
      dedicatedRds:
        # Name of the service that owns the RDS
        service: github-for-jira
        # Name of the RDS resource from above
        resource: rds

  - type: s3
    name: "dumps" # for heapdumps, temp resource, will be deleted after the investigation is over
    attributes:
      dataType:
        - UGC/Label                # name of GitHub org / Jira site
        - PII/IndirectConfidential # name of GitHub org
        - UGC/Configuration        # data about the installation of the GitHub app into Jira sites
        - Security/Secret          # shared Connect secret
        - UGC/PrimaryIdentifier    # references to GitHub entities (commits, pull requests, etc.) and Jira issues
        - UGC/Primary              # GitHub entities (non-persistent) like commits, pull requests, etc.

  - name: deployment-history-cache
    type: dynamo-db
    attributes: &table-attributes
      HashKeyName: Id
      HashKeyType: "S"
      RangeKeyName: CreatedAt
      RangeKeyType: "N"
      ReadWriteCapacityMode: ON_DEMAND
      TTLAttributeName: ExpiredAfter
      dataType:
        - UGC/PrimaryIdentifier    # Sha of a commit that point to user's code
  - name: audit-log
    type: dynamo-db
    attributes: &audit-log-table-attributes
      HashKeyName: Id
      HashKeyType: "S"
      RangeKeyName: CreatedAt
      RangeKeyType: "N"
      ReadWriteCapacityMode: ON_DEMAND
      TTLAttributeName: ExpiredAfter
      dataType:
        - UGC/PrimaryIdentifier    # Sha of a commit that point to user's code

scaling:
  instance: t2.small
  min: 1
  max: 5
  metrics: &CpuMemScalingRules
    complexScalingRule:
      EvaluationPeriods: 1
      Threshold:
        Lower: 30
        Upper: 80
      Metrics:
        - Expression: "MAX([cpuUsage, memoryUsage])"
          Id: "combinedCpuRam"
          Label: "Scaling based on CPU and Memory consumption"
        - MetricStat:
            Metric:
              # Dimensions can be ignored here due to defaulting
              MetricName: CPUUtilization
              Namespace: AWS/EC2
            Period: 300
            Stat: Maximum
          Id: cpuUsage
          ReturnData: false
        - MetricStat:
            Metric:
              # Dimensions can be ignored here due to defaulting
              MetricName: MemoryUtilization
              Namespace: System/Linux
            Period: 300
            Stat: Maximum
          Id: memoryUsage
          ReturnData: false

alarms:
  overrides:
    MemoryConsumptionAlert:
      Namespace: System/Linux
      MetricName: MemoryUtilization
      Description: "Memory utilization is more than 90%"
      Threshold: 90
      Priority: Low
      EvaluationPeriods: 5
      Period: 120
      ComparisonOperator: GreaterThanThreshold
      Statistic: Average
    HighSeverityAlarmWhenTooManyBackend5xxErrors: null
    HighSeverityAlarmWhenTooManyELB5xxErrors: null
    LowSeverityAlarmWhenTooManyBackend5xxErrors: null
    LowSeverityAlarmWhenTooManyELB5xxErrors: null
    UnHealthyHostCount:
      EvaluationPeriods: 4
      Period: 60
      Threshold: 2
    ManyUnHealthyHostCount:
      EvaluationPeriods: 8
      Period: 60
      Threshold: 3

config:
  environmentVariables:
    NODE_ENV: production
    NODE_OPTIONS: "--no-deprecation"
    LOG_LEVEL: info
    PORT: "8080"
    CONCURRENT_WORKERS: "40"
    PG_DATABASE_BOUNCER: pgbouncer
    GIT_COMMIT_SHA: ${GIT_COMMIT_SHA}
    GIT_COMMIT_DATE: ${GIT_COMMIT_DATE}
    GIT_BRANCH_NAME: ${GIT_BRANCH_NAME}
    DEPLOYMENT_DATE: ${DEPLOYMENT_DATE}
    PRIVATE_KEY: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-private-key-stg
    GITHUB_CLIENT_SECRET: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-client-secret-stg
    WEBHOOK_SECRETS: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-webhook-secrets-stg
    COOKIE_SESSION_KEY: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-cookie-session-key-stg

    CRYPTOR_URL: http://cryptor:26272
    CRYPTOR_SIDECAR_CLIENT_IDENTIFICATION_CHALLENGE: "6CF9E6A52167B58CBB0DED180CC8B848" # https://developer.atlassian.com/platform/cryptor/integration/integrating-sidecar/#enabling-ssrf-protection
    # These secret environment variables need to be stashed with "atlas micros stash" for each environment:
    # STORAGE_SECRET: secret generated by running openssl rand -hex 32
    # SENTRY_DSN: client key required to connect to Sentry
    # WEBHOOK_SECRET: the webhook secret configured in the GitHub app
    PGBOUNCER_POOL_MODE: "session"
    PGBOUNCER_DEFAULT_POOL_SIZE: "15" # Max scale up:
      #   (30 web servers + 15 workers) * 10 pool size  = 675 connections (See postgres-db connections limit)
      # Normal business:
    #   (5 web servers + 3 workers) * 15 pool size = 120 connections
    PGBOUNCER_SERVER_IDLE_TIMEOUT: "60"
    PGBOUNCER_MAX_CLIENT_CONN: "1000"

loadBalancer:
  type: ALB
  single: true
  slowStart: 180

workers:
  - name: Worker
    scaling:
      instance: t2.small
      min: 1
      max: 5
      metrics: &CpuMemAndQueuesScalingRules
        complexScalingRule:
          EvaluationPeriods: 3
          Threshold:
            # Scale down if max value from queues, cpu and memory is below 30 for 3 consecutive periods of 60 seconds
            Lower: 30
            # Scale up if max value from queues, cpu and memory is over 80 for 3 consecutive periods of 60 seconds
            Upper: 80
          Metrics:
            - Expression: "MAX([cpuUsage, memoryUsage, (pushQueueMessages/250)*100, (backfillQueueMessages/10)*100, (branchQueueMessages/250)*100, (deploymentQueueMessages/250)*100])"
              Id: "combinedCpuRamAndQueues"
              Label: "Scaling based on Queue Sizes and CPU and Memory consumption"
            - MetricStat:
                Metric:
                  # Dimensions can be ignored here due to defaulting
                  MetricName: CPUUtilization
                  Namespace: AWS/EC2
                Period: 60
                Stat: Maximum
              Id: cpuUsage
              ReturnData: false
            - MetricStat:
                Metric:
                  # Dimensions can be ignored here due to defaulting
                  MetricName: MemoryUtilization
                  Namespace: System/Linux
                Period: 60
                Stat: Maximum
              Id: memoryUsage
              ReturnData: false
            - MetricStat:
                Metric:
                  MetricName: ApproximateNumberOfMessagesVisible
                  Namespace: AWS/SQS
                  Dimensions:
                    - LogicalQueueName: 'push'
                Period: 60
                Stat: Maximum
              Id: pushQueueMessages
              ReturnData: false
            - MetricStat:
                Metric:
                  MetricName: ApproximateNumberOfMessagesVisible
                  Namespace: AWS/SQS
                  Dimensions:
                    - LogicalQueueName: 'backfill'
                Period: 60
                Stat: Maximum
              Id: backfillQueueMessages
              ReturnData: false
            - MetricStat:
                Metric:
                  MetricName: ApproximateNumberOfMessagesVisible
                  Namespace: AWS/SQS
                  Dimensions:
                    - LogicalQueueName: 'branch'
                Period: 60
                Stat: Maximum
              Id: branchQueueMessages
              ReturnData: false
            - MetricStat:
                Metric:
                  MetricName: ApproximateNumberOfMessagesVisible
                  Namespace: AWS/SQS
                  Dimensions:
                    - LogicalQueueName: 'deployment'
                Period: 60
                Stat: Maximum
              Id: deploymentQueueMessages
              ReturnData: false


environmentOverrides:
  ddev:
    #  Uncomment lines 140-149 if you want remote debugging in ddev
    #    loadBalancer:
    #      type: ELB # needed for remote debugging, default is "ALB"
    #    compose:
    #      microservice:
    #        ports:
    #          - 8080:8080
    #          - 5005:5005 # remote debugging port (has to be 5005 because that is hard coded into Micros)
    #    links:
    #      remoteDebug: true
    config:
      environmentVariables:
        APP_URL: https://github-for-jira.dev.services.atlassian.com
        WEBHOOK_PROXY_URL: https://github-for-jira.dev.services.atlassian.com
        APP_KEY: com.github.integration.development
        NODE_OPTIONS: "--no-deprecation"
        LOG_LEVEL: debug
        SENTRY_ENVIRONMENT: ddev
        APP_ID: '124403'
        GITHUB_CLIENT_ID: Iv1.600bf90a20f1ab18
        PRIVATE_KEY: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-private-key-ddev
        GITHUB_CLIENT_SECRET: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-client-secret-ddev
        WEBHOOK_SECRETS: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-webhook-secrets-ddev
        COOKIE_SESSION_KEY: vault://secret/data/builds/micros-sv--github-for-jira-dl-admins/github-app-cookie-session-key-ddev
    scaling:
      instance: t2.small
      min: 1
      max: 1
      metrics: *CpuMemScalingRules
    workers:
      - name: Worker
        scaling:
          instance: t2.small
          min: 1
          max: 5
          metrics: *CpuMemAndQueuesScalingRules
    resources:
      - type: globaledge
        name: proxy
        attributes:
          default_vanity_dns: false
          domain:
            - github.dev.atlassian.com
          ip_whitelist:
            - public
          routes: &blackholeSpammingIPs
            - match: # Blackhole IP that keeps spamming us
                prefix: /
                external_address_header_match:
                  - 94.156.174.137
              route:
                cluster: blackhole # Deny by sending traffic to blackhole

      - &cryptorGithubServerAppSecrets
        name: github-server-app-secrets
        type: cryptor
        attributes:
          parameters:
            encryptingServices:
              - github-for-jira
            decryptingServices:
              - github-for-jira

      - &cryptorJiraInstanceSecrets
        name: jira-instance-secrets
        type: cryptor
        attributes:
          parameters:
            encryptingServices:
              - github-for-jira
            decryptingServices:
              - github-for-jira

      - name: deployment-history-cache
        type: dynamo-db
        attributes:
          <<: *table-attributes
      - name: audit-log
        type: dynamo-db
        attributes:
          <<: *audit-log-table-attributes

    alarms:
      overrides:
        LatencyHigh: null
        HealthyHostCount: null
        UnHealthyHostCount: null
        WebServerAlarmWhenLowCPUCredits: null
        WebServerDiskSpaceUtilizationAlarmHigh: null
        WebServerInstanceVolumeSpaceUtilizationAlarmHigh: null
        WebServerMemoryAlarmHigh: null
        WebServerServiceRespawnAlarm: null

  staging:
    config:
      environmentVariables:
        APP_URL: https://github.stg.atlassian.com
        WEBHOOK_PROXY_URL: https://github.stg.atlassian.com
        APP_KEY: com.github.integration.staging
        LOG_LEVEL: debug
        SENTRY_ENVIRONMENT: stg-west
        APP_ID: '12645'
        GITHUB_CLIENT_ID: Iv1.2d8e2a184a746aec
    scaling:
      instance: c5.large
      min: 1
      max: 5
      metrics: &CpuMemAlbScalingRules
        complexScalingRule:
          EvaluationPeriods: 1
          Threshold:
            Lower: 30
            Upper: 80
          Metrics:
            - Expression: "MAX([(responseTime/5)*100, cpuUsage, memoryUsage])"
              Id: "combinedCpuRamAndLatency"
              Label: "Scaling based on CPU and Memory consumption or response time"
            - MetricStat:
                Metric:
                  MetricName: CPUUtilization
                  Namespace: AWS/EC2
                Period: 300
                Stat: Maximum
              Id: cpuUsage
              ReturnData: false
            - MetricStat:
                Metric:
                  MetricName: MemoryUtilization
                  Namespace: System/Linux
                Period: 300
                Stat: Maximum
              Id: memoryUsage
              ReturnData: false
            - MetricStat:
                Metric:
                  Dimensions:
                    - Name: LoadBalancer
                      Value: { "Fn::GetAtt": ["EnvironmentStack", "LoadBalancerName"] }
                    - Name: TargetGroup
                      Value: { "Fn::GetAtt": [ "ALBTargetGroup", "TargetGroupFullName" ] }
                  MetricName: TargetResponseTime
                  Namespace: AWS/ApplicationELB
                Period: 300
                Stat: Average
              Id: responseTime
              ReturnData: false
    alarms:
      overrides:
        LatencyHigh: null
    #TODO Uncomment when we stop doing hourly deployments
    #        ElbResponseTimeAlert:
    #          Namespace: AWS/ApplicationELB
    #          MetricName: TargetResponseTime
    #          Description: "Response latency is too high. Runbook: https://hello.atlassian.net/wiki/spaces/PF/pages/1283532004/HOWTO+Investigate+High+CPU+Memory+or+Latency+Alarms"
    #          Dimensions:
    #            - Name: LoadBalancer
    #              Value: { "Fn::GetAtt": ["EnvironmentStack", "LoadBalancerName"] }
    #            - Name: TargetGroup
    #              Value: { "Fn::GetAtt": [ "ALBTargetGroup", "TargetGroupFullName" ] }
    #          Threshold: 5
    #          Priority: Low
    #          EvaluationPeriods: 5
    #          Period: 180
    #          ComparisonOperator: GreaterThanThreshold
    #          Statistic: Average
    workers:
      - name: Worker
        scaling:
          instance: t3.medium
          min: 1
          max: 5
          metrics: *CpuMemAndQueuesScalingRules
    resources:
      - name: rds
        type: dedicated-rds
        attributes:
          parameters:
            DBInstanceClass: db.t2.medium
            # Adding read replica in staging as it's not enabled by default so we can read state
            ReadReplica: true

      - name: deployment-history-cache
        type: dynamo-db
        attributes:
          <<: *table-attributes
      - name: audit-log
        type: dynamo-db
        attributes:
          <<: *audit-log-table-attributes

      - type: globaledge
        name: proxy
        attributes:
          default_vanity_dns: false
          domain:
            - github.stg.atlassian.com
          ip_whitelist:
            - public
          routes: *blackholeSpammingIPs

      - *cryptorGithubServerAppSecrets
      - *cryptorJiraInstanceSecrets

  prod:
    serviceProxy:
      egress:
        dependencies:
          - name: brahmos-wiremock
    config:
      environmentVariables:
        APP_URL:  https://github.atlassian.com
        WEBHOOK_PROXY_URL:  https://github.atlassian.com
        APP_KEY: com.github.integration.production
        SENTRY_ENVIRONMENT: prod-west
        APP_ID: '14320'
        GITHUB_CLIENT_ID: Iv1.45aafbb099e1c1d7
        PRIVATE_KEY: vault://secret/data/builds/micros-sv--github-for-jira-dl-vault-compliant/github-app-private-key
        GITHUB_CLIENT_SECRET: vault://secret/data/builds/micros-sv--github-for-jira-dl-vault-compliant/github-app-client-secret
        WEBHOOK_SECRETS: vault://secret/data/builds/micros-sv--github-for-jira-dl-vault-compliant/github-app-webhook-secrets
        COOKIE_SESSION_KEY: vault://secret/data/builds/micros-sv--github-for-jira-dl-vault-compliant/github-app-cookie-session-key
        CRYPTOR_SIDECAR_CLIENT_IDENTIFICATION_CHALLENGE: "D92A2D7364AC3057D2A90BA9512D8CA0"
    scaling:
      instance: c5.2xlarge
      min: 15
      max: 30 # keep in sync with PGBOUNCER_DEFAULT_POOL_SIZE
      metrics: *CpuMemAlbScalingRules
    workers:
      - name: Worker
        scaling:
          instance: c5.2xlarge
          min: 5
          max: 15 # keep in sync with PGBOUNCER_DEFAULT_POOL_SIZE
          metrics: *CpuMemAndQueuesScalingRules
    alarms:
      overrides:
        LatencyHigh: null
    #TODO Uncomment when we stop doing hourly deployments
    #        ElbResponseTimeAlert:
    #          Namespace: AWS/ApplicationELB
    #          MetricName: TargetResponseTime
    #          Description: "Response latency is too high. Runbook: https://hello.atlassian.net/wiki/spaces/PF/pages/1283532004/HOWTO+Investigate+High+CPU+Memory+or+Latency+Alarms"
    #          Dimensions:
    #            - Name: LoadBalancer
    #              Value: { "Fn::GetAtt": ["EnvironmentStack", "LoadBalancerName"] }
    #            - Name: TargetGroup
    #              Value: { "Fn::GetAtt": [ "ALBTargetGroup", "TargetGroupFullName" ] }
    #          Threshold: 5
    #          Priority: Low
    #          EvaluationPeriods: 5
    #          Period: 180
    #          ComparisonOperator: GreaterThanThreshold
    #          Statistic: Average
    resources:
      - type: redisx
        name: cache
        attributes:
          size: 5000
        alarms:
          AlarmOnNumConnections:
            MetricName: CurrConnections
            Description: "The number of client connections is too high. Please follow the runbook: https://hello.atlassian.net/wiki/spaces/PF/pages/1453195358/HOWTO+Investigate+Redis+Issues"
            Threshold: 10000
            EvaluationPeriods: 3
            Period: 120
            Priority: Low
            ComparisonOperator: GreaterThanThreshold
            Statistic: Maximum
            Unit: Count

      - name: database
        type: postgres-db
        attributes:
          connectionLimit: 675 # keep in sync with PGBOUNCER_DEFAULT_POOL_SIZE.
          # Should be set to Max Connections can be used by nodes + some room if we have to scale even more manually. PGBOUNCER_DEFAULT_POOL_SIZE*N*1.5

      - name: rds
        type: dedicated-rds
        attributes:
          parameters:
            DBInstanceClass: db.r5.4xlarge
            AllocatedStorage: 40 # GB
            MaxAllocatedStorage: 100
            ConnectionAlarm: 900 # keep in sync with PGBOUNCER_DEFAULT_POOL_SIZE * 2 * N (cause two stacks can work
            # together during the deploy)
            TransactionLogsDiskUsageAlarm: 4000000000 # approximately 4GB

      - name: deployment-history-cache
        type: dynamo-db
        attributes:
          <<: *table-attributes
      - name: audit-log
        type: dynamo-db
        attributes:
          <<: *audit-log-table-attributes

      - type: globaledge
        name: proxy
        attributes:
          default_vanity_dns: false
          domain:
            - github.atlassian.com
          ip_whitelist:
            - public
          routes: *blackholeSpammingIPs

      - type: sqs
        name: backfill
        alarms:
          AlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for backfill queue too high! Follow the runbook: https://hello.atlassian.net/wiki/spaces/PF/pages/1550488861/HOWTO+Respond+to+Too+Many+Messages+on+the+Queue+Alert"
            Threshold: 3000 #~ Autoscaling Threshold x 5. So we'll be alerted if autoscaling failed to fix the piling messages
            Priority: High
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "QueueName" }
            EvaluationPeriods: 6
            Period: 600
            ComparisonOperator: GreaterThanThreshold
            Statistic: Maximum
          DLQAlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for backfill dead letter queue too high! Please follow the runbook: https://hello.atlassian.net/wiki/spaces/OTFS/pages/2314414972/HOWTO+Analyse+and+Replay+the+DLQ"
            Threshold: 50
            Priority: Low
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "DLQueueName" }
            EvaluationPeriods: 5
            Period: 300
            ComparisonOperator: GreaterThanOrEqualToThreshold
            Statistic: Maximum

      - type: sqs
        name: push
        alarms:
          AlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for push queue too high! Follow the runbook: https://hello.atlassian.net/wiki/spaces/PF/pages/1550488861/HOWTO+Respond+to+Too+Many+Messages+on+the+Queue+Alert"
            Threshold: 500 #~ Autoscaling Threshold x 2. So we'll be alerted if autoscaling failed to fix the piling messages
            Priority: High
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "QueueName" }
            EvaluationPeriods: 5
            Period: 300
            ComparisonOperator: GreaterThanThreshold
            Statistic: Maximum
          DLQAlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for push dead letter queue too high! Please follow the runbook: https://hello.atlassian.net/wiki/spaces/OTFS/pages/2314414972/HOWTO+Analyse+and+Replay+the+DLQ"
            Threshold: 100
            Priority: Low
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "DLQueueName" }
            EvaluationPeriods: 5
            Period: 300
            ComparisonOperator: GreaterThanOrEqualToThreshold
            Statistic: Maximum

      - type: sqs
        name: deployment
        alarms:
          AlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for deployment queue too high! Follow the runbook: https://hello.atlassian.net/wiki/spaces/PF/pages/1550488861/HOWTO+Respond+to+Too+Many+Messages+on+the+Queue+Alert"
            Threshold: 500 #~ Autoscaling Threshold x 2. So we'll be alerted if autoscaling failed to fix the piling messages
            Priority: Low
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "QueueName" }
            EvaluationPeriods: 5
            Period: 300
            ComparisonOperator: GreaterThanThreshold
            Statistic: Maximum
          DLQAlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for deployment dead letter queue too high! Please follow the runbook: https://hello.atlassian.net/wiki/spaces/OTFS/pages/2314414972/HOWTO+Analyse+and+Replay+the+DLQ"
            Threshold: 5000 # number is initially high until we start bringing numbers down
            Priority: Low
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "DLQueueName" }
            EvaluationPeriods: 5
            Period: 300
            ComparisonOperator: GreaterThanOrEqualToThreshold
            Statistic: Maximum

      - type: sqs
        name: branch
        alarms:
          AlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for branch queue too high! Follow the runbook: https://hello.atlassian.net/wiki/spaces/PF/pages/1550488861/HOWTO+Respond+to+Too+Many+Messages+on+the+Queue+Alert"
            Threshold: 500 #~ Autoscaling Threshold x 2. So we'll be alerted if autoscaling failed to fix the piling messages
            Priority: High
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "QueueName" }
            EvaluationPeriods: 5
            Period: 300
            ComparisonOperator: GreaterThanThreshold
            Statistic: Maximum
          DLQAlarmOnTooManyMessages:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Description: "Message count for branch dead letter queue too high! Please follow the runbook: https://hello.atlassian.net/wiki/spaces/OTFS/pages/2314414972/HOWTO+Analyse+and+Replay+the+DLQ"
            Threshold: 1000 # number is initially high until we start bringing numbers down
            Priority: Low
            Dimensions:
              - Name: QueueName
                Value: { "Ref": "DLQueueName" }
            EvaluationPeriods: 5
            Period: 300
            ComparisonOperator: GreaterThanOrEqualToThreshold
            Statistic: Maximum

      - name: github-server-app-secrets
        type: cryptor
        attributes:
          parameters:
            encryptingServices:
              - github-for-jira
            decryptingServices:
              - github-for-jira
      - name: jira-instance-secrets
        type: cryptor
        attributes:
          parameters:
            encryptingServices:
              - github-for-jira
            decryptingServices:
              - github-for-jira
      - type: lambda
        name: auto-deployment-github-app
        attributes:
          runtime: nodejs18.x
          prefetchMicrosEnvVars: true
          artifact: "_sox/github-for-jira/auto-deployment-github-app-${BITBUCKET_BUILD_NUMBER}.zip"
          handler: auto-deployment.handler
          private: true
          concurrentExecutions: 2
          timeout: 60
          scheduledRules:
            - name: 'PipelinesExecutionForGH4J'
              # Cron for running 10 minutes
              expression: 'cron(0/10 * * * ? *)'
          dataType:
            - Atlassian/Configuration