Create a CloudWatch alarm in AWS

Create a CloudWatch metric for the alarm to watch, and the threshold for that metric. The alarm goes to the ALARM state when the metric breaches the threshold for a specified number of evaluation periods.

Before you begin

  • Ensure you have an account in AWS.
  • Ensure you have created a topic and its subscription in AWS and have subscribed your endpoint webhook to that topic.

Role required: Responder, Manager, or Administrator

About this task

Note: While this integration with a third-party product is supported, the documentation here is based upon information provided by that third-party. More current information about the operation of that third-party’s system may be available from them directly.

Procedure

  1. Search for CloudWatch.
  2. Click the Services list and select Alarms > In alarm.
    The Create alarm button.
  3. Click Create alarm.
    The Specify metric and conditions page.
  4. On the Specify metric and conditions page, click Select metric.
    Tiles of all metrics.
  5. Perform one of the following actions:
    • Choose the service namespace that contains the metric that you want. Continue choosing options as they appear to narrow the choices. When a list of metrics appears, select the check box next to the metric that you want.
    • In the search box, enter the name of a metric, dimension, or resource ID and press Enter. Then choose one of the results and continue until a list of metrics appears. Select the check box next to the metric that you want.
  6. Select the Graphed metrics tab and perform the following actions:
    • Under Statistic, select one of the statistics or predefined percentiles, or specify a custom percentile. For example, p95.45.
    • Under Period, select the evaluation period for the alarm. When evaluating the alarm, each period is aggregated into one data point. You can also choose whether the y-axis legend appears on the left or right while you're creating the alarm. This preference is used only while you're creating the alarm.
  7. Click Select metric.
    The Specify metric and conditions page appears, showing a graph and other information about the metric and statistic you have selected.
    The Specify metric and conditions page.
  8. Scroll down to the Conditions sections and specify the following:
    • Under Threshold type, select whether the threshold alarm type is Static or Anomaly detection.
    • Under Whenever metric is, specify whether the metric must be greater than, less than, or equal to the threshold.
    • Under than..., specify the threshold value.
    The Conditions section.
  9. Click Additional configuration.
  10. For the Datapoints to alarm section, specify how many evaluation periods (data points) must be in the ALARM state to trigger the alarm.
    If the two values match, you create an alarm that goes to the ALARM state if that many consecutive periods are breaching.
  11. To create an M out of N alarm, specify a lower number for the first value than you specify for the second value.
  12. For Missing data treatment, choose how to have the alarm behave when some data points are missing.
  13. Click Next.
    The Configure actions page.
  14. Under the Alarm state trigger section, define the alarm state that will trigger the action.
    • To have the alarm send multiple notifications for the same alarm state or for different alarm states, choose Add notification.
    • To have the alarm not send notifications, choose Remove.
  15. Under the Select an SNS topic section, select an SNS topic to notify when the alarm is in In alarm, OK, or Insufficient data state.
  16. Under the Auto Scaling action section, to have the alarm perform Auto Scaling, EC2, or Systems Manager actions, select the appropriate button and choose the alarm state and action to perform.
  17. Click Next.
    The Add name and description page appears.
    The Add name and description page.
  18. In the Alarm name and Alarm description fields, enter a name and description for the alarm.
    Note: The name must contain only ASCII characters.
  19. Click Next.
    The Preview and create page appears.
    The Preview and create page.
  20. Preview the information and conditions and click Create alarm.
    The Create alarm button.
    An alarm is successfully created.
    Message on successful creation of alarm appears.
  21. Optional: To test the integration:
    1. From the left navigation pane, click Topics and from the existing Topics list, click to open the topic.The Publish message option.
    2. Click Publish message.
    3. In the Message body section, enter the message that you want to send via the Incident Response webhook.

      You can use the sample alert given at Sample alert for AWS to test the integration.

      The Publish message to topic page.
    4. Click Publish message.

      This creates a sample alert in Lightstep Incident Response.