By using AWS re:Post, you agree to the Terms of Use

CloudWatch Alarm Metadata in notifications

0

Is it possible to include metadata about the source of a CloudWatch alarm in onward notification to SNS?

I'm working on a multi-account configuration hosting various services and plan to integrate with a third party notification and ops toolset. It would be very helpful to let operational teams receiving notifications know more about the alarm (e.g. source account, service, environment). The only fields I can see are name and description, these could be used but are unstructured so may be prone to error. Another solution would be to have multiple SNS topics, but ideally operational teams would manage any categorisation in their ops tool rather than making changes to infrastructure.

Any suggestions appreciated. Thanks.

asked 6 months ago111 views
1 Answer
0
Accepted Answer

Hi, it is not possible to enrich or modify the initial alarm notification. In most cases, users who are looking for a way to enrich or customize the notification use a lambda to forge the notification output format they want. Then there are 2 strategies to trigger the lambda:

  • catch Eventbridge events and leave the alarm actions blank
  • configure alarm actions to post a state change notification to an SNS topic, subscribe the lambda to that topic - note that in that case the Lambda ought to post its output to a different SNS topic

The 1st strategy works well if you need the same lambda to process all alarms in your account, as an event gets posted for every alarm state change, thus triggering your lambda every time. The 2nd strategy might be a better fit if you want to tailor the notification only for a handful of specific alarms. The https://aws.amazon.com/blogs/mt/customize-amazon-cloudwatch-alarm-notifications-to-your-local-time-zone-part-1/ blog post gives an example of strategy 1.

For what you are looking to do, you'd likely need to parse the event to retrieve an id (e.g. the instance id of an EC2), then place a call to the API to fetch the metadata you're looking for.

Would that approach work for your case?

answered 6 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions