Skip to main content
The AWS CloudWatch alert connector turns ALARM notifications into Squasher incidents and resolves the same incident when CloudWatch sends OK. The incident then uses your normal Squasher notification routes, including Slack, webhooks, email, and PagerDuty. This is an inbound alert source. It is separate from the AWS CloudWatch log connector and from notification destinations that send incidents out of Squasher.

​
Create the connector

The response includes an HTTPS setup.endpoint. Subscribe that endpoint to the exact SNS topic configured above:
Squasher verifies the AWS signature, validates the certificate host against the topic region, checks the exact topic ARN, and confirms the subscription. No email confirmation or Lambda relay is required. Squasher automatically follows a valid signed SubscriptionConfirmation URL only after matching its topic, token, regional AWS hostname, and exact confirmation URL shape. A signed UnsubscribeConfirmation is recorded but never followed. If SNS unsubscribes the endpoint, subscribe it again or disable and delete the connector.

​
Incident behavior

  • ALARM opens an incident with the CloudWatch alarm ARN as its stable key.
  • A newer ALARM transition updates the open incident.
  • OK resolves the matching incident when resolve_on_ok is enabled (the default).
  • INSUFFICIENT_DATA does not open or resolve an incident.
  • SNS retries and out-of-order state changes are deduplicated by message ID and state-change timestamp.
  • Every opened, updated, and resolved incident flows through Squasher notification routing.
The default severity is sev-1. Override it at creation with --severity, or update the connector config through the API.

​
Test it

Temporarily set a connected CloudWatch alarm to ALARM, then return it to OK. Confirm that one Squasher incident opens and resolves, and that its notification deliveries appear under Settings → Notifications.

​
Security and troubleshooting

CloudWatch connectors do not have a Squasher bearer secret to rotate. Squasher verifies the SNS signature and certificate, then requires the notification’s topic ARN to exactly match the connector config. To change topics, update the connector, subscribe its endpoint to the new topic, verify a firing and recovery event, and remove the old subscription. The signing-certificate URL must use HTTPS on the exact AWS SNS hostname for the topic’s region, contain no credentials, port, query, or fragment, and match AWS’s certificate path. Squasher validates the certificate’s validity period and rejects messages more than 24 hours old or more than 5 minutes in the future. If SNS reports a failed delivery, confirm that the subscription is confirmed, the connector is enabled, and the configured topic ARN includes the correct AWS partition, region, account, and topic name. A 401 response means the topic, signature, certificate URL, or timestamp validation failed. A 503 response with Retry-After: 5 means certificate retrieval or parsing, certificate validity, subscription confirmation, or processing failed temporarily and is retryable. Related: Inbound alert connectors, Alert Connectors API, Notifications.