| 1 | # 🤖 Account-level hygiene, sibling to cloudtrail.tf: a spending alarm and |
| 2 | # the EBS encryption default. Both are settings, not infrastructure — cheap, |
| 3 | # reversible, and account-wide. |
| 4 | |
| 5 | # The budget alarm: actual spend runs ~$5/month (books.json publishes it), |
| 6 | # so $25 is ~5× headroom — quiet in normal months, loud the month something |
| 7 | # runs away (a leaked key mining, a misconfigured loop hammering S3). |
| 8 | # Alerts at 80% actual and 100% forecasted, to the team address. |
| 9 | resource "aws_budgets_budget" "monthly" { |
| 10 | name = "eleven-monthly" |
| 11 | budget_type = "COST" |
| 12 | limit_amount = "25" |
| 13 | limit_unit = "USD" |
| 14 | time_unit = "MONTHLY" |
| 15 | |
| 16 | notification { |
| 17 | comparison_operator = "GREATER_THAN" |
| 18 | threshold = 80 |
| 19 | threshold_type = "PERCENTAGE" |
| 20 | notification_type = "ACTUAL" |
| 21 | subscriber_email_addresses = ["team@elevenmessenger.com"] |
| 22 | } |
| 23 | |
| 24 | notification { |
| 25 | comparison_operator = "GREATER_THAN" |
| 26 | threshold = 100 |
| 27 | threshold_type = "PERCENTAGE" |
| 28 | notification_type = "FORECASTED" |
| 29 | subscriber_email_addresses = ["team@elevenmessenger.com"] |
| 30 | } |
| 31 | } |
| 32 | |
| 33 | # Every NEW EBS volume in eu-west-1 (the only region we use) is encrypted at |
| 34 | # rest with the default KMS key. Existing volumes are untouched — the one |
| 35 | # unencrypted volume (the dev box's root) is fixed by recreating the box |
| 36 | # (infra/dev/compute.tf now declares its root encrypted; apply with |
| 37 | # -replace=aws_instance.dev_box). |
| 38 | resource "aws_ebs_encryption_by_default" "on" { |
| 39 | enabled = true |
| 40 | } |
| 41 | |
amadan