# Source: paas-metrics
---

- type: replace
  path: /instance_groups/name=prometheus2/jobs/name=prometheus2/properties/prometheus/custom_rules?/-
  value:
    name: CloudFrontInvalidTLSCertificates
    rules:

      - alert: CloudFrontInvalidTLSCertificates_Warning
        expr: "count(paas_cdn_tls_certificates_validity == 0) >= 3"
        for: 5m
        annotations:
          summary: "At least 3 tenant/CloudFront TLS certificates are invalid"
          description: "At least 3 tenant/CloudFront TLS certificates are invalid"
          url: "https://team-manual.cloud.service.gov.uk/incident_management/responding_to_alerts/#invalid-certificates"
        labels:
          severity: warning
          notify: email
          service: cloudfront

      - alert: CloudFrontInvalidTLSCertificates_Critical
        expr: "count(paas_cdn_tls_certificates_validity == 0) >= 5"
        for: 5m
        annotations:
          summary: "At least 5 tenant/CloudFront TLS certificates are invalid"
          description: "At least 5 tenant/CloudFront TLS certificates are invalid"
          url: "https://team-manual.cloud.service.gov.uk/incident_management/responding_to_alerts/#invalid-certificates"
        labels:
          severity: critical
          notify: email
          service: cloudfront

Add bulk tenant CloudFront TLS certificate validity alert to Prometheus
Add bulk tenant CloudFront TLS certificate validity alert to Prometheus

Original DataDog monitor:
min(last_4h):avg:cdn.tls.certificates.validity{deploy_env:prod} <= 0.75

The intent behind the fixed implementation of this DD monitor
(paas-cf#1545) was to warn if a high number of tenant certificates are
invalid, whilst not alerting when a small number of tenants are
mid-cdn-route-setup and their certificates have not yet been issued.

After discussion with @alext, these different thresholds and
implementation achieve the same intent more clearly.
