What is the best way to import Amazon CloudWatch alerts into an existing monitoring tool? There is a documented process for Netcool to receive these alerts via HTTPS. The problem is the log solution is an isolated on-prem system behind a DMZ. The traffic needs to remain internal and not traverse the internet. Is there a way to have Amazon Simple Notification Service (SNS) send an alert without traversing the internet? I don't think so since this is an abstracted service that doesn't live within a customers VPC. I don't think a VPC endpoint will help as that just solves the problem between alerts getting from CloudWatch to SNS, but once SNS sends an HTTP alert there is no way to use the VPC connectivity. Looking for options to recommend the to the customer.
Option 1: Open ports so the existing tool can receive HTTS traffic via the internet.
Option 2: Could we create an AWS Lambda function that would receive a CloudWatch event then generate an HTTPS message that could use routing to keep the HTTPS traffic internal?