> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudWatch alerts

> Turn signed CloudWatch alarm transitions delivered by Amazon SNS into Squasher incidents.

The AWS CloudWatch alert connector turns `ALARM` notifications into Squasher
incidents and resolves the same incident when CloudWatch sends `OK`. The
incident then uses your normal Squasher notification routes, including Slack,
webhooks, email, and PagerDuty.

This is an inbound alert source. It is separate from the AWS CloudWatch log
connector and from notification destinations that send incidents out of Squasher.

## Create the connector

```bash theme={null}
squasher alert-connectors create \
  --project "$SQUASHER_PROJECT_ID" \
  --provider aws-cloudwatch \
  --topic-arn "arn:aws:sns:us-east-1:123456789012:production-alarms" \
  --display-name "Production CloudWatch"
```

The response includes an HTTPS `setup.endpoint`. Subscribe that endpoint to
the exact SNS topic configured above:

```bash theme={null}
aws sns subscribe \
  --topic-arn "arn:aws:sns:us-east-1:123456789012:production-alarms" \
  --protocol https \
  --notification-endpoint "<setup.endpoint>"
```

Squasher verifies the AWS signature, validates the certificate host against
the topic region, checks the exact topic ARN, and confirms the subscription.
No email confirmation or Lambda relay is required.

Squasher automatically follows a valid signed `SubscriptionConfirmation` URL only
after matching its topic, token, regional AWS hostname, and exact confirmation URL
shape. A signed `UnsubscribeConfirmation` is recorded but never followed. If SNS
unsubscribes the endpoint, subscribe it again or disable and delete the connector.

## Incident behavior

* `ALARM` opens an incident with the CloudWatch alarm ARN as its stable key.
* A newer `ALARM` transition updates the open incident.
* `OK` resolves the matching incident when `resolve_on_ok` is enabled (the default).
* `INSUFFICIENT_DATA` does not open or resolve an incident.
* SNS retries and out-of-order state changes are deduplicated by message ID and
  state-change timestamp.
* Every opened, updated, and resolved incident flows through
  [Squasher notification routing](/features/alerts).

The default severity is `sev-1`. Override it at creation with `--severity`, or
update the connector config through the API.

## Test it

Temporarily set a connected CloudWatch alarm to `ALARM`, then return it to
`OK`. Confirm that one Squasher incident opens and resolves, and that its
notification deliveries appear under **Settings → Notifications**.

## Security and troubleshooting

CloudWatch connectors do not have a Squasher bearer secret to rotate. Squasher
verifies the SNS signature and certificate, then requires the notification's topic
ARN to exactly match the connector config. To change topics, update the connector,
subscribe its endpoint to the new topic, verify a firing and recovery event, and
remove the old subscription.

The signing-certificate URL must use HTTPS on the exact AWS SNS hostname for the
topic's region, contain no credentials, port, query, or fragment, and match AWS's
certificate path. Squasher validates the certificate's validity period and rejects
messages more than 24 hours old or more than 5 minutes in the future.

If SNS reports a failed delivery, confirm that the subscription is confirmed, the
connector is enabled, and the configured topic ARN includes the correct AWS
partition, region, account, and topic name. A `401` response means the topic,
signature, certificate URL, or timestamp validation failed. A `503` response with
`Retry-After: 5` means certificate retrieval or parsing, certificate validity,
subscription confirmation, or processing failed temporarily and is retryable.

Related: [Inbound alert connectors](/integrations/alert-connectors),
[Alert Connectors API](/api-reference/alert-connectors),
[Notifications](/features/alerts).