cloudwatch-alarms

CloudWatch alarms in ALARM, by the CloudWatch API

Returns how many CloudWatch alarms of an AWS region are in the state ALARM, and their names, read through the CloudWatch API with an access key that may only read. The alarms are those the account already defines in CloudWatch, metric, composite and log alarms: the collector reads their state and does not judge the metrics again. One watch is offered, set on the probe.

Versions

Generic: the CloudWatch API is one service, the same in every region. The collector asks for its version 2010-08-01 in the Query protocol, which AWS says it keeps supporting beside the JSON protocol its newer SDKs use.

How it works

GET https://monitoring.<aws:region>.amazonaws.com/?Action=DescribeAlarms&AlarmTypes.member.1=MetricAlarm&AlarmTypes.member.2=CompositeAlarm&AlarmTypes.member.3=LogAlarm&MaxRecords=100&StateValue=ALARM&Version=2010-08-01, with AlarmNamePrefix=<aws:alarm-prefix> when it is set, signed by aws.sign (Signature Version 4, service monitoring), page after page by NextToken. The answer is XML:

<DescribeAlarmsResponse xmlns="http://monitoring.amazonaws.com/doc/2010-08-01/">
  <DescribeAlarmsResult>
    <MetricAlarms>
      <member><AlarmName>prod-cpu-high</AlarmName><StateValue>ALARM</StateValue>…</member>
    </MetricAlarms>
    <CompositeAlarms/>
    <LogAlarms/>
    <NextToken>…</NextToken>
  </DescribeAlarmsResult>
  <ResponseMetadata><RequestId>…</RequestId></ResponseMetadata>
</DescribeAlarmsResponse>

• Without AlarmTypes, AWS lists the metric alarms only: the three kinds are asked for, and counted together.
• alarms is the number of alarms in ALARM; alarm-names their names, joined by | , empty when there is none.
• The region goes into the name of the host: a region with other characters than lower-case letters, digits and hyphens stops the collector misconfigured before anything leaves.
• A code 400, 401 or 403 stops the collector misconfigured, with the error code AWS writes (InvalidClientTokenId, AccessDenied, SignatureDoesNotMatch…); a throttled request (Throttling), a code 500 or above, or any other code but 200 stops it unreachable.

The keys come from protocol:aws: the secret key never leaves the poller, only the signature it makes. The answer is not secret.

Prerequisites

• An IAM user with an access key, or a role whose temporary keys are set with their session token, allowed this action and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "cloudwatch:DescribeAlarms", "Resource": "*" }
  ]
}

AWS returns the composite alarms only to a cloudwatch:DescribeAlarms scoped to *. The access key ID goes in protocol:aws:access-key-id, the secret key in protocol:aws:secret-access-key, the session token, for temporary keys only, in protocol:aws:session-token.

• The poller reaches monitoring.<region>.amazonaws.com in HTTPS, and its clock is right within a few minutes: AWS refuses a request signed more than fifteen minutes away from its own time. The certificates of AWS are issued by public authorities: the profile "Standard" trusts them.

Variables

Outputs

Watches

Limits

• One region per probe. The regions of AWS in China (amazonaws.com.cn) are not served.
• The alarms in INSUFFICIENT_DATA are not counted.
• Not checked against an AWS account: the action, its parameters and its fields are those of the Amazon CloudWatch API Reference ("DescribeAlarms") and of the Query protocol of AWS (Smithy, "AWS query protocol": the answer under DescribeAlarmsResult, each item of a list under member); the reference no longer gives a sample of an XML answer. That the Query protocol stays supported is said by "FAQs on CloudWatch supported protocols".