ROSAENG-14171: add probe history and LB security group checks to console-ErrorBudgetBurn investigation

pkg/aws/aws.go

@@ -103,10 +103,13 @@ type Client interface {
 	FindHostedZone(ctx context.Context, dnsName string, private bool) (string, error)
 	HasResourceRecordSet(ctx context.Context, hostedZoneID, recordName, recordType string) (bool, error)
 	GetVpcDhcpConfiguration(ctx context.Context, infraID string) ([]string, error)
-	FindNLBByDNSName(ctx context.Context, dnsName string) (arn string, name string, err error)
+	FindNLBByDNSName(ctx context.Context, dnsName string) (arn string, name string, securityGroups []string, err error)
 	FindCLBByDNSName(ctx context.Context, dnsName string) (name string, err error)
 	GetNLBTargetHealth(ctx context.Context, lbARN string) ([]NLBTargetHealth, error)
 	GetCLBInstanceHealth(ctx context.Context, lbName string) ([]CLBInstanceHealth, error)
+	GetCLBSecurityGroupIDs(ctx context.Context, lbName string) ([]string, error)
+	GetSecurityGroupRules(ctx context.Context, sgIDs []string) ([]ec2v2types.SecurityGroup, error)
+	GetInstanceSecurityGroupIDs(ctx context.Context, instanceIDs []string) (map[string][]string, error)
 }
 
 type SdkClient struct {
@@ -728,26 +731,26 @@ func (c *SdkClient) GetVpcDhcpConfiguration(ctx context.Context, infraID string)
 	return servers, nil
 }
 
-func (c *SdkClient) FindNLBByDNSName(ctx context.Context, dnsName string) (string, string, error) {
+func (c *SdkClient) FindNLBByDNSName(ctx context.Context, dnsName string) (string, string, []string, error) {
 	var marker *string
 	for {
 		out, err := c.Elbv2Client.DescribeLoadBalancers(ctx, &elbv2.DescribeLoadBalancersInput{
 			Marker: marker,
 		})
 		if err != nil {
-			return "", "", fmt.Errorf("failed to describe NLBs: %w", err)
+			return "", "", nil, fmt.Errorf("failed to describe NLBs: %w", err)
 		}
 		for _, lb := range out.LoadBalancers {
 			if lb.Type == elbv2types.LoadBalancerTypeEnumNetwork && awsv2.ToString(lb.DNSName) == dnsName {
-				return awsv2.ToString(lb.LoadBalancerArn), awsv2.ToString(lb.LoadBalancerName), nil
+				return awsv2.ToString(lb.LoadBalancerArn), awsv2.ToString(lb.LoadBalancerName), lb.SecurityGroups, nil
 			}
 		}
 		if out.NextMarker == nil {
 			break
 		}
 		marker = out.NextMarker
 	}
-	return "", "", nil
+	return "", "", nil, nil
 }
 
 func (c *SdkClient) FindCLBByDNSName(ctx context.Context, dnsName string) (string, error) {
@@ -829,6 +832,51 @@ func (c *SdkClient) GetCLBInstanceHealth(ctx context.Context, lbName string) ([]
 	return results, nil
 }
 
+func (c *SdkClient) GetCLBSecurityGroupIDs(ctx context.Context, lbName string) ([]string, error) {
+	out, err := c.ElbClient.DescribeLoadBalancers(ctx, &elbv1.DescribeLoadBalancersInput{
+		LoadBalancerNames: []string{lbName},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to describe CLB %s: %w", lbName, err)
+	}
+	if len(out.LoadBalancerDescriptions) == 0 {
+		return nil, fmt.Errorf("CLB %s not found", lbName)
+	}
+	return out.LoadBalancerDescriptions[0].SecurityGroups, nil
+}
+
+// GetSecurityGroupRules returns full security group objects including their inbound rules
+func (c *SdkClient) GetSecurityGroupRules(ctx context.Context, sgIDs []string) ([]ec2v2types.SecurityGroup, error) {
+	out, err := c.Ec2Client.DescribeSecurityGroups(ctx, &ec2v2.DescribeSecurityGroupsInput{
+		GroupIds: sgIDs,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to describe security groups: %w", err)
+	}
+	return out.SecurityGroups, nil
+}
+
+func (c *SdkClient) GetInstanceSecurityGroupIDs(ctx context.Context, instanceIDs []string) (map[string][]string, error) {
+	out, err := c.Ec2Client.DescribeInstances(ctx, &ec2v2.DescribeInstancesInput{
+		InstanceIds: instanceIDs,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to describe instances: %w", err)
+	}
+	result := make(map[string][]string)
+	for _, res := range out.Reservations {
+		for _, inst := range res.Instances {
+			id := awsv2.ToString(inst.InstanceId)
+			sgs := make([]string, 0, len(inst.SecurityGroups))
+			for _, sg := range inst.SecurityGroups {
+				sgs = append(sgs, awsv2.ToString(sg.GroupId))
+			}
+			result[id] = sgs
+		}
+	}
+	return result, nil
+}
+
 func populateStopTime(instances []ec2v2types.Instance) (map[string]time.Time, error) {
 	idToStopTime := make(map[string]time.Time)
 	for _, instance := range instances {