AWS. Cloudwatch trigger Rule on Alarm state change

Question

I have an issue to trigger Cloudwatch Rule on CloudWatch Alarm State Change. This is an Event pattern for a Rule. It doesn't send a message to SNS of state change.

{
  "detail-type": [
    "CloudWatch Alarm State Change"
  ],
  "resources": [
    !Sub "arn:aws:cloudwatch:${AWS:Region}:${AWS:AccountId}:alarm:Admin dead"
  ],
  "source": [
    "aws.cloudwatch"
  ],
  "detail": {
    "state": [
      "ALARM"
    ]
  }
}

The Alarm itself works properly and send a message to SNS in parallel. Also if I will remove this part:

"detail": {
    "state": [
      "ALARM"
    ]
  }

then the Rule works properly for each state change. But I need only on it's changed to "In alarm" (as it's displayed in UI).

Thanks for any advise

Also in "Show metrics for the rule" on the graphics I see only invocations when the state part is removed — 4d61726b

Vilsepi Vilsepi · Accepted Answer · 2020-02-26T12:48:44

A good way to debug this would be to remove the "detail" part, and subscribe to the SNS topic with email or a lambda function or similar to see the actual alarm event content.

Looks like your rule for "detail" is missing "value" parameter, the following rule works:

{
    "source": [
        "aws.cloudwatch"
    ],
    "detail-type": [
        "CloudWatch Alarm State Change"
    ],
    "detail": {
        "state": {
            "value": [
                "ALARM"
            ]
        }
    }
}

According to this, an example event looks like:

{
  "version": "0",
  "id": "2dde0eb1-528b-d2d5-9ca6-6d590caf2329",
  "detail-type": "CloudWatch Alarm State Change",
  "source": "aws.cloudwatch",
  "account": "123456789012",
  "time": "2019-10-02T17:20:48Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:cloudwatch:us-east-1:123456789012:alarm:TotalNetworkTrafficTooHigh"
  ],
  "detail": {
    "alarmName": "TotalNetworkTrafficTooHigh",
    "configuration": {
      "description": "Goes into alarm if total network traffic exceeds 10Kb",
      "metrics": [...]
    },
    "previousState": {
      "reason": "Unchecked: Initial alarm creation",
      "timestamp": "2019-10-02T17:20:03.642+0000",
      "value": "INSUFFICIENT_DATA"
    },
    "state": {
      "reason": "Threshold Crossed: 1 out of the last 1 datapoints [45628.0 (02/10/19 17:10:00)] was greater than the threshold (10000.0) (minimum 1 datapoint for OK -> ALARM transition).",
      "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-02T17:20:48.551+0000\",\"startDate\":\"2019-10-02T17:10:00.000+0000\",\"period\":300,\"recentDatapoints\":[45628.0],\"threshold\":10000.0}",
      "timestamp": "2019-10-02T17:20:48.554+0000",
      "value": "ALARM"
    }
  }
}

AWS. Cloudwatch trigger Rule on Alarm state change

2 Answers