AWS AmazonCloudWatch documentation change

Service: AmazonCloudWatch · 2026-06-19 · Documentation low

File: AmazonCloudWatch/latest/monitoring/alarms-and-actions-Lambda.md

Summary

Added an example event object structure for CloudWatch log alarms showing alarm configuration and state data

Security assessment

The change adds a documentation example of a log alarm event payload without addressing any vulnerability or security weakness. It illustrates standard alarm attributes like role ARNs and actions, but doesn't introduce security guidance or address known vulnerabilities.

Diff

diff --git a/AmazonCloudWatch/latest/monitoring/alarms-and-actions-Lambda.md b/AmazonCloudWatch/latest/monitoring/alarms-and-actions-Lambda.md
index d5b611eaf..c1018d0fe 100644
--- a//AmazonCloudWatch/latest/monitoring/alarms-and-actions-Lambda.md
+++ b//AmazonCloudWatch/latest/monitoring/alarms-and-actions-Lambda.md
@@ -199,0 +200,49 @@ The following is an example of an event object from a composite alarm.
+The following is an example of an event object from a log alarm.
+    
+    
+    {
+      "source": "aws.cloudwatch",
+      "alarmArn": "arn:aws:cloudwatch:us-east-1:123456789012:alarm:HighErrorRate",
+      "accountId": "123456789012",
+      "time": "2026-06-10T12:15:30.000+0000",
+      "region": "us-east-1",
+      "alarmData": {
+        "alarmName": "HighErrorRate",
+        "state": {
+          "value": "ALARM",
+          "reason": "Threshold Crossed: 3 out of the last 5 query results [142.0 (10/06/26 12:15:00), 135.0 (10/06/26 12:10:00), 120.0 (10/06/26 12:05:00)] were greater than the threshold (100.0) (minimum 3 datapoints for OK -> ALARM transition).",
+          "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2026-06-10T12:15:30.000+0000\",\"threshold\":100.0,\"queryResultsToEvaluate\":5,\"queryResultsToAlarm\":3,\"results\":[...]}",
+          "timestamp": "2026-06-10T12:15:30.000+0000"
+        },
+        "previousState": {
+          "value": "OK",
+          "reason": "...",
+          "reasonData": "...",
+          "timestamp": "2026-06-10T12:00:00.000+0000"
+        },
+        "configuration": {
+          "logGroupIdentifiers": ["/aws/lambda/my-function"],
+          "queryString": "fields @timestamp, @message | filter @message like /ERROR/",
+          "aggregationExpression": "count(*)",
+          "scheduledQueryRoleARN": "arn:aws:iam::123456789012:role/ScheduledQueryRole",
+          "schedule": {
+            "expression": "rate(5 minutes)",
+            "startTimeOffset": 300,
+            "endTimeOffset": 0
+          },
+          "threshold": 100.0,
+          "comparisonOperator": "GreaterThanThreshold",
+          "treatMissingData": "missing",
+          "queryResultsToEvaluate": 5,
+          "queryResultsToAlarm": 3,
+          "alarmName": "HighErrorRate",
+          "description": "Alarm when error count exceeds 100",
+          "actionsEnabled": true,
+          "timestamp": "2026-06-10T12:00:00.000+0000",
+          "okActions": [],
+          "alarmActions": ["arn:aws:sns:us-east-1:123456789012:my-topic"],
+          "insufficientDataActions": []
+        }
+      }
+    }
+