How do I configure custom CloudWatch alarm notifications?

Short description

You can configure metric filters to match specific log events, such as AWS CloudTrail events that contain AccessDenied or UnauthorizedOperations errors. Then, use CloudWatch Logs to get metrics. To monitor metrics, create a CloudWatch alarm.

By default, a CloudWatch alarm that uses Amazon Simple Notification Service (Amazon SNS) delivers a preformatted notification that contains alarm and metric details. To determine what caused the state change, you can incorporate the log events that triggered the CloudWatch alarm into the notification.

To invoke an AWS Lambda function when the alarm state changes, use the CloudWatch alarm direct Lambda integration. The Lambda function can then publish a custom notification with the related log events.

Resolution

Prerequisite: Make sure that you have an existing CloudWatch alarm that monitors a custom metric from a metric filter. For more information, see Create a CloudWatch alarm based on a static threshold.

Create an AWS Lambda function

Configure a Lambda function to perform the following actions:

• Parse the CloudWatch alarm event details, such as alarm name, description, timestamp, and reason for state change. You can incorporate the details into the custom message.

• Use CloudWatch Logs Insights to analyze log data in the related CloudWatch log group.
  When the alarm changes state, the Lambda function issues the StartQuery API call to run a query against the log group. The following example query summarizes CloudTrail API calls that fail with an AccessDenied or UnauthorizedOperation error:

  filter (errorCode="AccessDenied" or errorCode="UnauthorizedOperation")
  | stats count(*) as Hits by errorCode, errorMessage, sourceIPAddress, userIdentity.arn
  | sort Hits desc

• Use GetQueryResults to retrieve corresponding results.

• Use the Amazon SNS Publish API to deliver a custom message that contains alarm details and CloudWatch Logs Insights query results.

Related information

How do I customize the default Amazon SNS email subject line?