AWS Security ChangesHomeSearch

AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2026-06-28 · Documentation low

File: AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md

Summary

Added comprehensive documentation for AWS::CloudWatch::LogAlarm resource including purpose, alarm evaluation logic, state transitions, required permissions, and detailed property descriptions.

Security assessment

The change adds documentation about required IAM permissions ('cloudwatch:PutLogAlarm') and role configurations needed for secure operation. However, there's no evidence of addressing a specific security vulnerability.

Diff

diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md
index 8d5997e03..1743a15b7 100644
--- a//AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md
+++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md
@@ -11 +11,11 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo
-The `AWS::CloudWatch::LogAlarm` resource Property description not available. for CloudWatch.
+Creates or updates a log alarm. A log alarm evaluates the results of a CloudWatch Logs scheduled query against the configured threshold and comparison operator to determine its state.
+
+When you create a log alarm, the operation creates a service-managed CloudWatch Logs scheduled query that runs the query string you provide on the schedule you configure. Each scheduled query execution returns one or more aggregated values determined by the `AggregationExpression`, and each aggregated value is compared against the alarm `Threshold` to determine the alarm state. The alarm uses M-out-of-N evaluation: if `QueryResultsToAlarm` out of the most recent `QueryResultsToEvaluate` query results breach the threshold, the alarm transitions to `ALARM`.
+
+Log alarms support the alarm states (`OK`, `ALARM`, `INSUFFICIENT_DATA`). Configure transition actions using `OKActions`, `AlarmActions`, and `InsufficientDataActions`.
+
+If you call this operation with the name of an existing log alarm, the operation replaces the previous configuration of that alarm.
+
+**Permissions**
+
+To create or update a log alarm, you must have the `cloudwatch:PutLogAlarm` permission. The IAM role specified in `ScheduledQueryRoleARN` must grant the CloudWatch Alarms service permission to execute scheduled queries on the specified log groups. If you set `ActionLogLineCount`, the role specified in `ActionLogLineRoleArn` must grant permission to retrieve log events for inclusion in alarm notifications.
@@ -74 +84 @@ To declare this entity in your CloudFormation template, use the following syntax
-Property description not available.
+The number of log lines from the most recent scheduled query execution that are included in alarm action notifications. Valid range is 0 through 50. A value of 0 means no log lines are included.
@@ -89 +99 @@ _Required_ : No
-Property description not available.
+The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to retrieve log events for inclusion in alarm action notifications. Set when `ActionLogLineCount` is greater than 0.
@@ -100 +110 @@ _Required_ : No
-Property description not available.
+Indicates whether actions should be executed during any changes to the alarm state.
@@ -111 +121 @@ _Required_ : No
-Property description not available.
+The actions to execute when this alarm transitions to the `ALARM` state from any other state. Each action is specified as an Amazon Resource Name (ARN).
@@ -122 +132 @@ _Required_ : No
-Property description not available.
+The description of the alarm.
@@ -133 +143 @@ _Required_ : No
-Property description not available.
+The name of the alarm.
@@ -148 +158 @@ _Required_ : No
-Property description not available.
+The arithmetic operation to use when comparing the aggregated query result and the threshold. The aggregated query result is used as the first operand.
@@ -159 +169 @@ _Required_ : Yes
-Property description not available.
+The actions to execute when this alarm transitions to the `INSUFFICIENT_DATA` state from any other state. Each action is specified as an Amazon Resource Name (ARN).
@@ -170 +180 @@ _Required_ : No
-Property description not available.
+The actions to execute when this alarm transitions to the `OK` state from any other state. Each action is specified as an Amazon Resource Name (ARN).
@@ -181 +191 @@ _Required_ : No
-Property description not available.
+The number of query results, out of the most recent `QueryResultsToEvaluate` results, that must breach the threshold to trigger the alarm to transition to `ALARM` (the M in M-of-N evaluation).
@@ -192 +202 @@ _Required_ : Yes
-Property description not available.
+The number of most recent scheduled query results that the alarm evaluates against the threshold (the N in M-of-N evaluation).
@@ -203 +213 @@ _Required_ : Yes
-Property description not available.
+The configuration of the underlying CloudWatch Logs scheduled query, including the query string, log groups, schedule, aggregation expression, and the ARN of the managed scheduled query.
@@ -227 +237 @@ _Required_ : No
-Property description not available.
+The value to compare with the aggregated query result.
@@ -238 +248 @@ _Required_ : Yes
-Property description not available.
+How this alarm handles missing data points. Valid values are `breaching`, `notBreaching`, `ignore`, and `missing`.