Feature/preventative action for network bugs

.github/workflows/ci.yml

@@ -1,7 +1,6 @@
 name: CI
 
 on:
-  push:
   pull_request:
 
 concurrency:

.gitignore

@@ -0,0 +1,3 @@
+.idea/
+__pycache__/
+*.pyc

ApiServer/main.py

@@ -3,7 +3,8 @@
 import sys
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from aws_xray_sdk.core import xray_recorder
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from sqlalchemy import text
 
@@ -48,6 +49,16 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(title="ChatSystem API", lifespan=lifespan)
 
+
+@app.middleware("http")
+async def xray_middleware(request: Request, call_next):
+    xray_recorder.begin_segment(f"{request.method} {request.url.path}")
+    try:
+        return await call_next(request)
+    finally:
+        xray_recorder.end_segment()
+
+
 app.add_middleware(
     CORSMiddleware,
     allow_origins=settings.cors_origins_list,

ApiServer/requirements.txt

@@ -1,4 +1,5 @@
 annotated-doc==0.0.4
+aws-xray-sdk
 annotated-types==0.7.0
 anyio==4.13.0
 asyncpg==0.31.0

ChatInfra/environments/dev/main.tf

@@ -78,6 +78,8 @@ module "ecs_services" {
   execution_role_chatserver_arn     = module.ecs.execution_role_chatserver_arn
   execution_role_presenceserver_arn = module.ecs.execution_role_presenceserver_arn
   chatserver_task_role_arn          = module.ecs.chatserver_task_role_arn
+  apiserver_task_role_arn           = module.ecs.apiserver_task_role_arn
+  presenceserver_task_role_arn      = module.ecs.presenceserver_task_role_arn
   private_subnet_ids                = module.vpc.private_subnets
   ecs_tasks_sg_id                   = module.security_groups.ecs_tasks_sg_id
   chatserver_nlb_dns_name           = module.alb.chatserver_nlb_dns_name
@@ -92,5 +94,8 @@ module "ecs_services" {
   apiserver_log_group               = module.ecs.apiserver_log_group
   chatserver_log_group              = module.ecs.chatserver_log_group
   presenceserver_log_group          = module.ecs.presenceserver_log_group
+  apiserver_xray_log_group          = module.ecs.apiserver_xray_log_group
+  chatserver_xray_log_group         = module.ecs.chatserver_xray_log_group
+  presenceserver_xray_log_group     = module.ecs.presenceserver_xray_log_group
   cloudfront_domain                 = module.static_site.cloudfront_domain
 }

ChatInfra/modules/ecs/main.tf

@@ -219,3 +219,126 @@ resource "aws_iam_role_policy" "chatserver_sqs" {
     }]
   })
 }
+
+resource "aws_iam_role_policy" "chatserver_xray" {
+  name = "${var.project_name}-chatserver-xray"
+  role = aws_iam_role.chatserver_task.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = [
+        "xray:PutTraceSegments",
+        "xray:PutTelemetryRecords",
+        "xray:GetSamplingRules",
+        "xray:GetSamplingTargets",
+        "xray:GetSamplingStatisticSummaries",
+      ]
+      Resource = "*"
+    }]
+  })
+}
+
+# --- ApiServer task role ---
+
+resource "aws_iam_role" "apiserver_task" {
+  name = "${var.project_name}-apiserver-task"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "ecs-tasks.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+      Condition = {
+        ArnLike = {
+          "aws:SourceArn" = "arn:aws:ecs:${var.region}:${data.aws_caller_identity.current.account_id}:*"
+        }
+        StringEquals = {
+          "aws:SourceAccount" = data.aws_caller_identity.current.account_id
+        }
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "apiserver_xray" {
+  name = "${var.project_name}-apiserver-xray"
+  role = aws_iam_role.apiserver_task.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = [
+        "xray:PutTraceSegments",
+        "xray:PutTelemetryRecords",
+        "xray:GetSamplingRules",
+        "xray:GetSamplingTargets",
+        "xray:GetSamplingStatisticSummaries",
+      ]
+      Resource = "*"
+    }]
+  })
+}
+
+# --- PresenceServer task role ---
+
+resource "aws_iam_role" "presenceserver_task" {
+  name = "${var.project_name}-presenceserver-task"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "ecs-tasks.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+      Condition = {
+        ArnLike = {
+          "aws:SourceArn" = "arn:aws:ecs:${var.region}:${data.aws_caller_identity.current.account_id}:*"
+        }
+        StringEquals = {
+          "aws:SourceAccount" = data.aws_caller_identity.current.account_id
+        }
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "presenceserver_xray" {
+  name = "${var.project_name}-presenceserver-xray"
+  role = aws_iam_role.presenceserver_task.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = [
+        "xray:PutTraceSegments",
+        "xray:PutTelemetryRecords",
+        "xray:GetSamplingRules",
+        "xray:GetSamplingTargets",
+        "xray:GetSamplingStatisticSummaries",
+      ]
+      Resource = "*"
+    }]
+  })
+}
+
+# --- X-Ray daemon log groups ---
+
+resource "aws_cloudwatch_log_group" "apiserver_xray" {
+  name              = "/ecs/${var.project_name}/apiserver-xray"
+  retention_in_days = 365
+}
+
+resource "aws_cloudwatch_log_group" "chatserver_xray" {
+  name              = "/ecs/${var.project_name}/chatserver-xray"
+  retention_in_days = 365
+}
+
+resource "aws_cloudwatch_log_group" "presenceserver_xray" {
+  name              = "/ecs/${var.project_name}/presenceserver-xray"
+  retention_in_days = 365
+}