AWS AWSCloudFormation documentation change
Summary
Updated documentation for CloudWatch LogAlarm with clarifications on default values, required conditions, valid values for actions, and added examples for ARN formats in alarm actions.
Security assessment
Changes are clarifications and documentation improvements (default values, required conditions, valid ARN formats). No evidence of security vulnerability fixes or security feature additions. The IAM role requirement for ActionRoleArn when ActionLogLineCount>0 is a pre-existing security best practice, not a new security feature.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md index 1743a15b7..6bde658df 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-logalarm.md @@ -84 +84 @@ To declare this entity in your CloudFormation template, use the following syntax -The number of log lines from the most recent scheduled query execution that are included in alarm action notifications. Valid range is 0 through 50. A value of 0 means no log lines are included. +The number of log lines from the most recent scheduled query execution to include in alarm action notifications. Valid range is 0 through 50. The default is 0, which means no log lines are included. @@ -99 +99 @@ _Required_ : No -The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to retrieve log events for inclusion in alarm action notifications. Set when `ActionLogLineCount` is greater than 0. +The Amazon Resource Name (ARN) of an IAM role that CloudWatch assumes to retrieve log events for inclusion in alarm action notifications. Required when `ActionLogLineCount` is greater than 0. @@ -110 +110 @@ _Required_ : No -Indicates whether actions should be executed during any changes to the alarm state. +Indicates whether actions should be executed during any changes to the alarm state. The default is `true`. @@ -122,0 +123,21 @@ The actions to execute when this alarm transitions to the `ALARM` state from any +Valid Values: + +**Amazon SNS actions:** + +`arn:aws:sns:_region_ :_account-id_ :_sns-topic-name_` + +**Lambda actions:** + + * Invoke the latest version of a Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_` + + * Invoke a specific version of a Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_ :_version-number_` + + * Invoke a function by using an alias Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_ :_alias-name_` + + + + +**Systems Manager actions:** + +`arn:aws:ssm:_region_ :_account-id_ :opsitem:_severity_` + @@ -132 +153 @@ _Required_ : No -The description of the alarm. +The description for the alarm. @@ -143 +164 @@ _Required_ : No -The name of the alarm. +The name for the alarm. This name must be unique within the AWS account and Region. @@ -158 +179 @@ _Required_ : No -The arithmetic operation to use when comparing the aggregated query result and the threshold. The aggregated query result is used as the first operand. +The arithmetic operation to use when comparing the aggregated query result and the threshold. The aggregated query result is used as the first operand. Valid values are `GreaterThanThreshold`, `GreaterThanOrEqualToThreshold`, `LessThanThreshold`, and `LessThanOrEqualToThreshold`. @@ -170,0 +192,17 @@ The actions to execute when this alarm transitions to the `INSUFFICIENT_DATA` st +Valid Values: + +**Amazon SNS actions:** + +`arn:aws:sns:_region_ :_account-id_ :_sns-topic-name_` + +**Lambda actions:** + + * Invoke the latest version of a Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_` + + * Invoke a specific version of a Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_ :_version-number_` + + * Invoke a function by using an alias Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_ :_alias-name_` + + + + @@ -181,0 +220,17 @@ The actions to execute when this alarm transitions to the `OK` state from any ot +Valid Values: + +**Amazon SNS actions:** + +`arn:aws:sns:_region_ :_account-id_ :_sns-topic-name_` + +**Lambda actions:** + + * Invoke the latest version of a Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_` + + * Invoke a specific version of a Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_ :_version-number_` + + * Invoke a function by using an alias Lambda function: `arn:aws:lambda:_region_ :_account-id_ :function:_function-name_ :_alias-name_` + + + + @@ -191 +246 @@ _Required_ : No -The number of query results, out of the most recent `QueryResultsToEvaluate` results, that must breach the threshold to trigger the alarm to transition to `ALARM` (the M in M-of-N evaluation). +The number of query results, out of the most recent `QueryResultsToEvaluate` results, that must breach the threshold to trigger the alarm to transition to `ALARM` (the M in M-of-N evaluation). Must be less than or equal to `QueryResultsToEvaluate`. @@ -202 +257 @@ _Required_ : Yes -The number of most recent scheduled query results that the alarm evaluates against the threshold (the N in M-of-N evaluation). +The number of most recent scheduled query results to evaluate against the threshold (the N in M-of-N evaluation). Valid range is 1 through 100. @@ -224 +279 @@ _Required_ : Yes -Property description not available. +A list of key-value pairs to associate with the alarm. You can use tags to categorize and manage your alarms. @@ -248 +303 @@ _Required_ : Yes -How this alarm handles missing data points. Valid values are `breaching`, `notBreaching`, `ignore`, and `missing`. +Sets how this alarm is to handle missing data points. Valid values are `breaching`, `notBreaching`, `ignore`, and `missing`. If this parameter is omitted, the default behavior of `missing` is used.