An alert turns a monitored measurement into a response. In AWS, a CloudWatch alarm watches a metric, evaluates it against a configured condition, and can take an action when the condition is met. That action might notify someone, recover an EC2 instance, or trigger scaling. CloudWatch also collects logs, but logs are useful for investigating a result; the alarm acts on a metric. section 6.2.3 section 13.1.1 section 17.2.2 section 6.2.2
To configure an alarm, choose:
- A metric and its scope: for example, a Lambda function’s Errors metric, selected by function name, or an EC2 metric scoped to an instance. section 6.2.3 section 13.1
- An evaluation rule: a statistic, period, number of evaluation periods, comparison operator, and threshold determine when the alarm condition is met. section 17.2.2
- An action appropriate to the problem: an SNS topic for email notification, EC2 recovery for a failed host, or a scaling policy for changing capacity. section 6.2.3 section 13.1 section 17.2.2
Email when a website health check fails
A scheduled EventBridge rule runs a Lambda website check every five minutes. If the check fails, the function returns an error, increasing its CloudWatch Errors count. In the CloudWatch console, create an alarm on that function’s Errors metric. Choose Sum, a five-minute period, a static threshold greater than zero, and an In Alarm action using a new SNS topic for email. Any reported error in that period changes the alarm state to ALARM; otherwise it is OK. Check the Lambda logs when you need to investigate what happened. Alarms on Errors and Throttles are recommended for Lambda functions. section 6.2 section 6.2.3 section 6.2.2
Listing 13.2 Creating a CloudWatch alarm to recover a failed EC2 instance
RecoveryAlarm: #1
Type: 'AWS::CloudWatch::Alarm'
Properties:
AlarmDescription: 'Recover EC2 instance when underlying hardware fails.'
Namespace: 'AWS/EC2' #2
MetricName: 'StatusCheckFailed_System' #3
Statistic: Maximum #4
Period: 60 #5
EvaluationPeriods: 5 #6
ComparisonOperator: GreaterThanThreshold #7
Threshold: 0 #8
AlarmActions: #9
- !Sub 'arn:aws:automate:${AWS::Region}:ec2:recover'
Dimensions:
- Name: InstanceId #10
Value: !Ref Instance
This CloudFormation alarm shows the recovery variant: it watches an EC2 system status metric and sets an EC2 recovery action instead of an email action. section 13.1
Choose the metric and response to match the risk. An EC2 system status check can detect host hardware, software, power, or connectivity problems; its alarm can recover an eligible EBS-backed instance on another host. That does not replace a multi-Availability-Zone design for a data-center outage. CloudWatch alarms also support scaling when load crosses a threshold, while RDS and cache metrics can warn of storage, CPU, memory, eviction, or replication problems. Thresholds need to reflect the resource being monitored. section 13.1.1 section 13.4 section 17.2.2 section 10.7
