AWS CloudWatch alarms

CloudWatch sends each alarm state change to an Amazon SNS topic. SNS sends it to Squasher, and Squasher opens an incident on ALARM and resolves it on OK. This page is about alarms. To send CloudWatch logs to Squasher, see AWS CloudWatch logs.

What you need

A CloudWatch alarm that sends notifications to an SNS topic, for both the ALARM and the OK state.
The topic ARN, for example arn:aws:sns:us-east-1:123456789012:production-alarms.
The Squasher CLI, signed in with write access to the project. See Alert sources.

Connect CloudWatch

Create the connector

squasher alert-connectors create \
  --project "$SQUASHER_PROJECT_ID" \
  --provider aws_cloudwatch \
  --topic-arn "arn:aws:sns:us-east-1:123456789012:production-alarms" \
  --display-name "Production CloudWatch"

Save setup.endpoint from the output. CloudWatch connectors have no secret: Squasher checks the SNS signature instead.

Subscribe the endpoint to the topic

aws sns subscribe \
  --topic-arn "arn:aws:sns:us-east-1:123456789012:production-alarms" \
  --protocol https \
  --notification-endpoint "https://api.squasher.ai/v1/hooks/alert-connectors/<connector-id>"

Squasher confirms the subscription automatically. Leave raw message delivery off: Squasher needs the SNS envelope to check the signature.

Test the alarm

Set the alarm to ALARM for a short time, then back to OK:

aws cloudwatch set-alarm-state --alarm-name "<alarm-name>" \
  --state-value ALARM --state-reason "Squasher test"

Check that one incident opens in Incidents. Run the command again with --state-value OK, and check that the same incident resolves.

How Squasher reads an alarm

CloudWatch field	Squasher incident
`AlarmArn`	Alert key. All state changes of one alarm go to one incident. Open in AWS CloudWatch opens the alarm in the AWS console.
SNS `MessageId`	Event key. SNS retries of one message are applied once.
`NewStateValue: ALARM`	Opens the incident, or updates it if it is open.
`NewStateValue: OK`	Resolves the incident.
`NewStateValue: INSUFFICIENT_DATA`	Ignored.
`AlarmName`	Title.
`NewStateReason`	Message on the incident timeline.
`AlarmDescription`	Summary.
`StateChangeTime`	Event time. An older state change does not replace a newer one.

The severity always comes from the connector’s default severity (sev-1 unless you set --severity). CloudWatch alarms do not carry a severity. To keep incidents open when the alarm returns to OK, create the connector with --config '{"resolve_on_ok": false}'.

Limits

Each connector accepts one SNS topic. The topic ARN in each message must match it exactly, including the partition, region, and account. Create one connector for each topic.
Squasher rejects messages that are more than 24 hours old or more than 5 minutes in the future, with 401.
The signing certificate must come from the SNS host of the topic’s region (sns.<region>.amazonaws.com).
If SNS removes the subscription, the connector records the error. Subscribe the endpoint again to receive alarms.
To move to a new topic, update the connector, then subscribe the endpoint to the new topic. The update replaces the whole config, so send every field again: squasher alert-connectors update <connector-id> --config '{"topic_arn": "<new-arn>", "default_severity": "sev-1", "resolve_on_ok": true}'.

Get started

Guides

AWS CloudWatch alarms

What you need

Connect CloudWatch

How Squasher reads an alarm

Limits

Next steps

Alert sources

Route incidents

​What you need

​Connect CloudWatch

​How Squasher reads an alarm

​Limits

​Next steps

Alert sources

Route incidents

What you need

Connect CloudWatch

How Squasher reads an alarm

Limits

Next steps