AWS AWSCloudFormation documentation change
Summary
Added comprehensive documentation for AWS::CloudWatch::LogAlarm resource including purpose, alarm evaluation logic, state transitions, required permissions, and detailed property descriptions.
Security assessment
The change adds documentation about required IAM permissions ('cloudwatch:PutLogAlarm') and role configurations needed for secure operation. However, there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md index 8d5997e03..1743a15b7 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md @@ -11 +11,11 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -The `AWS::CloudWatch::LogAlarm` resource Property description not available. for CloudWatch. +Creates or updates a log alarm. A log alarm evaluates the results of a CloudWatch Logs scheduled query against the configured threshold and comparison operator to determine its state. + +When you create a log alarm, the operation creates a service-managed CloudWatch Logs scheduled query that runs the query string you provide on the schedule you configure. Each scheduled query execution returns one or more aggregated values determined by the `AggregationExpression`, and each aggregated value is compared against the alarm `Threshold` to determine the alarm state. The alarm uses M-out-of-N evaluation: if `QueryResultsToAlarm` out of the most recent `QueryResultsToEvaluate` query results breach the threshold, the alarm transitions to `ALARM`. + +Log alarms support the alarm states (`OK`, `ALARM`, `INSUFFICIENT_DATA`). Configure transition actions using `OKActions`, `AlarmActions`, and `InsufficientDataActions`. + +If you call this operation with the name of an existing log alarm, the operation replaces the previous configuration of that alarm. + +**Permissions** + +To create or update a log alarm, you must have the `cloudwatch:PutLogAlarm` permission. The IAM role specified in `ScheduledQueryRoleARN` must grant the CloudWatch Alarms service permission to execute scheduled queries on the specified log groups. If you set `ActionLogLineCount`, the role specified in `ActionLogLineRoleArn` must grant permission to retrieve log events for inclusion in alarm notifications. @@ -74 +84 @@ To declare this entity in your CloudFormation template, use the following syntax -Property description not available. +The number of log lines from the most recent scheduled query execution that are included in alarm action notifications. Valid range is 0 through 50. A value of 0 means no log lines are included. @@ -89 +99 @@ _Required_ : No -Property description not available. +The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to retrieve log events for inclusion in alarm action notifications. Set when `ActionLogLineCount` is greater than 0. @@ -100 +110 @@ _Required_ : No -Property description not available. +Indicates whether actions should be executed during any changes to the alarm state. @@ -111 +121 @@ _Required_ : No -Property description not available. +The actions to execute when this alarm transitions to the `ALARM` state from any other state. Each action is specified as an Amazon Resource Name (ARN). @@ -122 +132 @@ _Required_ : No -Property description not available. +The description of the alarm. @@ -133 +143 @@ _Required_ : No -Property description not available. +The name of the alarm. @@ -148 +158 @@ _Required_ : No -Property description not available. +The arithmetic operation to use when comparing the aggregated query result and the threshold. The aggregated query result is used as the first operand. @@ -159 +169 @@ _Required_ : Yes -Property description not available. +The actions to execute when this alarm transitions to the `INSUFFICIENT_DATA` state from any other state. Each action is specified as an Amazon Resource Name (ARN). @@ -170 +180 @@ _Required_ : No -Property description not available. +The actions to execute when this alarm transitions to the `OK` state from any other state. Each action is specified as an Amazon Resource Name (ARN). @@ -181 +191 @@ _Required_ : No -Property description not available. +The number of query results, out of the most recent `QueryResultsToEvaluate` results, that must breach the threshold to trigger the alarm to transition to `ALARM` (the M in M-of-N evaluation). @@ -192 +202 @@ _Required_ : Yes -Property description not available. +The number of most recent scheduled query results that the alarm evaluates against the threshold (the N in M-of-N evaluation). @@ -203 +213 @@ _Required_ : Yes -Property description not available. +The configuration of the underlying CloudWatch Logs scheduled query, including the query string, log groups, schedule, aggregation expression, and the ARN of the managed scheduled query. @@ -227 +237 @@ _Required_ : No -Property description not available. +The value to compare with the aggregated query result. @@ -238 +248 @@ _Required_ : Yes -Property description not available. +How this alarm handles missing data points. Valid values are `breaching`, `notBreaching`, `ignore`, and `missing`.