Documentation forSolarWinds Incident Response

AWS CloudWatch Event Rules

AWS CloudWatch Events delivers a near real-time stream of system events that describe changes in AWS resources. Using simple rules that you can quickly set up, you can match events and route them to one or more target functions or streams.

Route detailed alerts from AWS CloudWatch Event Rules to the right users in Incident Response.

How to integrate AWS CloudWatch Event Rules with Incident Response

  1. Navigate to Services -> Service Overview -> select or search for your Service. Expand the accordion -> In the Alert Sources section, click Add.

    2. Integration of Amazon CloudWatch Event Rules as alert source with Squadcast

  2. Select Amazon CloudWatch Event Rules. Copy the displayed Webhook URL to configure it within Amazon CloudWatch Event Rules. Finish by clicking Add Alert Source -> Done.

Webhook URL configuration within Amazon CloudWatch Event Rules in Squadcast

When an alert source turns Active, it’ll show up under Configured Alert Sources. You can either generate a test alert from the integration or wait for a real-time alert to be generated by the Alert Source.

An Alert Source is active if there is a recorded incident via that Alert Source for the Service.

In AWS: Configure SNS Endpoint

  1. Log in to your AWS account and proceed to SNS

  2. Click on Create topic

  3. Within the dialog box, fill in the details as per your requirements and then click on Create topic

    4. AWS SNS Endpoint Configuration

  4. Inside the topic, click on Create Subscription

    5. AWS SNS Topic Creation and Subscription Process

  5. Select the protocol as HTTPS and in the endpoint enter the URL you obtained from the previous step

  6. Finally, click on Create Subscription to create the subscription

AWS SNS Subscription Creation with HTTPS Endpoint

The Subscription ID for the subscription should immediately change to Confirmed from PendingConfirmation. Click on the refresh button to verify the same.

In AWS: Configure CloudWatch Event Rules

  1. Go to CloudWatch and click on Rules under Events

  2. Click on Create Rule

    3. Creating CloudWatch Event Rules in AWS

  3. Select desired Service Name and Event Type In this example, we're selecting Service Name: EC2 and Event Type: All Events

    4. Selecting Service Name and Event Type in CloudWatch Event Rules

  4. Under Targets click on Add Target

  5. Select SNS Topic and your topic name from the dropdown In this example, we're selecting Topic: Instance-state-change

    6. Adding SNS Topic as Target in CloudWatch Event Rules

  6. Click on Configure rule details. Enter the name of your rule. Add a description as needed

  7. Click on Create a rule to save this configuration

Configuring Rule Details in CloudWatch Event Rules

That's it, you are good to go! Your AWS CloudWatch Event Rules integration is complete.

  • Now, whenever an event is triggered that matches your Event Rules, an incident will be created in Incident Response for it.

FAQ:

Q: If an alert gets resolved in AWS CloudWatch Event Rules, does it send auto-resolve signals to Incident Response?

A: No, AWS CloudWatch Event Rules does not send auto-resolve signals to Incident Response. Hence, Incident Response incidents from AWS CloudWatch Event Rules should be resolved manually.