Optional: Enable Scheduled Automation

​

What this wires up

• Alert rule evaluation — metric threshold checks with notification fan-out (see Alert Rules).
• Report schedule execution — render PDF/CSV, narrate via LLM, deliver to configured destinations (see Report Schedules).

​

What still works without EventBridge

• Alert rules — defined in /settings/alerts, stored in the database, and invokable manually by hitting /api/cron/tick with a valid x-cron-token. Rules simply stay dormant until evaluated.
• Notification destinations — created and tested via the Test button in /settings/integrations → Notifications; fire on demand via POST /api/v1/notifications/send.
• Report templates — built in /settings/reports, previewed live, and executed immediately via the Run Now button or POST /api/v1/reports/templates/[id]/run-now.
• Report schedules — can be created and will show a nextRunAt value, but will not fire automatically until this page is wired. Use Run Now in the meantime.
• Dashboard Export — every dashboard’s Export dropdown (PDF / CSV / Markdown / HTML) works unconditionally; no cron required.
• Save as Report — creates the ReportTemplate + ReportSchedule rows immediately; scheduled firing waits on this page.

​

When to enable

• You want alerts to fire without a human triggering the tick.
• You need scheduled reports to arrive on cadence (daily digests, weekly executive summaries).
• Pilot guardrails for LLM / notification spend are in place.

​

Setup (when you’re ready)

​

Prerequisites

1. KaireonAI deployed with a reachable HTTPS URL (e.g., App Runner URL or custom domain).
2. At least one notification destination configured.
3. At least one alert rule enabled and referencing that destination, or at least one report schedule.
4. CRON_TOKEN environment variable set on the API service to a strong random value (32+ chars). Example:
   openssl rand -hex 32
   

​

Step 1 — Store the token in AWS Systems Manager Parameter Store

1. AWS Console → Systems Manager → Parameter Store → Create parameter.
2. Name: /kaireonai/prod/cron-token (pick a path that matches your env conventions).
3. Type: SecureString.
4. KMS key: default AWS-managed key is fine for most deployments; use a customer-managed KMS key if your security policy requires it.
5. Value: paste the 32+ character token.
6. Create.

​

Step 2 — Create an EventBridge Scheduler IAM role

1. IAM → Roles → Create role.
2. Trusted entity type: Custom trust policy. Paste:
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": { "Service": "scheduler.amazonaws.com" },
         "Action": "sts:AssumeRole"
       }
     ]
   }
   
3. Attach an inline policy with the minimum permissions:
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "ssm:GetParameter",
         "Resource": "arn:aws:ssm:us-east-1:ACCOUNT_ID:parameter/kaireonai/prod/cron-token"
       }
     ]
   }
   
   Replace ACCOUNT_ID, region, and the parameter path as needed.
4. Role name: e.g., kaireonai-scheduler-role.
5. Create.

​

Step 3 — Create the EventBridge Scheduler

1. EventBridge → Scheduler → Schedules → Create schedule.
2. Name: kaireonai-alert-tick.
3. Schedule pattern: Recurring schedule. For a once-per-minute cadence:
   rate(1 minute)
   
   Or use a cron expression like cron(*/5 * * * ? *) for every 5 minutes.
4. Flexible time window: Off (keep ticks punctual).
5. Click Next.
6. Target API: API destinations is the cleanest option, but HTTPS → Invoke API Destination requires a separate connection + destination setup. The simplest path is to use HTTP target:
   • Target type: Universal targets → API Gateway / HTTP.
   • URL: https://your-deployment/api/cron/tick
   • Method: POST
   • HTTP headers:
     • x-cron-token: <resolve:ssm:/kaireonai/prod/cron-token>
     • Content-Type: application/json
   • Request body: empty.
7. Execution role: select kaireonai-scheduler-role from Step 2.
8. Retry policy: up to 3 attempts, 60s retention is reasonable — the /api/cron/tick endpoint is idempotent (each tick reads current state) so retries do not cause duplicate fires beyond what cooldownMinutes already suppresses.
9. Dead-letter queue: optional. Useful for spotting systemic failures.
10. Create schedule.

​

Step 4 — Verify

1. Wait one minute.
2. Check App Runner / CloudWatch logs for the service — you should see an entry like:
   cron.tick Tick complete { ok: true, tenantsProcessed: N, ... }
   
3. In the platform UI, open Settings → Alert Rules — the Last fired column should update when a rule triggers.

​

Rotating the token

1. Generate a new token (openssl rand -hex 32).
2. Update the Parameter Store value.
3. Update the API service’s CRON_TOKEN env (App Runner deploy or equivalent).
4. The next EventBridge invocation after both updates are live uses the new token.

​

Cadence guidance

​

Troubleshooting