AWS AmazonCloudWatch documentation change
Summary
Added documentation for log-based CloudWatch alarms including event structures for state changes, creation, updates, and deletion of single-value and multi-contributor log alarms.
Security assessment
The changes document new event structures for log-based alarms but contain no references to security vulnerabilities, patches, or security-specific configurations. The examples show routine alarm monitoring without security implications.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.md b/AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.md index 0b4d68b96..6dd0002c1 100644 --- a//AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.md +++ b//AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.md @@ -356,0 +357,117 @@ Events generated when an Alarm Contributor or an Alarm changes state. Alarm Cont +Log Alarm + + +Events generated when a single-value log alarm (without a BY clause) changes state. + + + { + "version": "0", + "id": "c4c1c1c9-6542-e61b-6ef0-8c4d36933a92", + "detail-type": "CloudWatch Alarm State Change", + "source": "aws.cloudwatch", + "account": "123456789012", + "time": "2026-06-10T12:15:30Z", + "region": "us-east-1", + "resources": [ + "arn:aws:cloudwatch:us-east-1:123456789012:alarm:HighErrorRate" + ], + "detail": { + "alarmName": "HighErrorRate", + "state": { + "value": "ALARM", + "reason": "Threshold Crossed: 3 out of the last 5 query results [142.0 (10/06/26 12:15:00), 135.0 (10/06/26 12:10:00), 120.0 (10/06/26 12:05:00)] were greater than the threshold (100.0) (minimum 3 datapoints for OK -> ALARM transition).", + "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2026-06-10T12:15:30.000+0000\",\"threshold\":100.0,\"queryResultsToEvaluate\":5,\"queryResultsToAlarm\":3,\"results\":[...]}", + "timestamp": "2026-06-10T12:15:30.000+0000" + }, + "previousState": { + "value": "OK", + "reason": "...", + "reasonData": "...", + "timestamp": "2026-06-10T12:00:00.000+0000" + }, + "configuration": { + "logGroupIdentifiers": ["/aws/lambda/my-function"], + "queryString": "fields @timestamp, @message | filter @message like /ERROR/", + "aggregationExpression": "count(*)", + "scheduledQueryRoleARN": "arn:aws:iam::123456789012:role/ScheduledQueryRole", + "actionLogLineRoleArn": "arn:aws:iam::123456789012:role/LogLinesRole", + "actionLogLineCount": 5, + "schedule": { + "expression": "rate(5 minutes)", + "startTimeOffset": 300, + "endTimeOffset": 0 + }, + "threshold": 10.0, + "comparisonOperator": "GreaterThanThreshold", + "treatMissingData": "notBreaching", + "queryResultsToEvaluate": 5, + "queryResultsToAlarm": 3, + "alarmName": "HighErrorRate", + "description": "Alarm when error count exceeds threshold", + "actionsEnabled": true, + "timestamp": "2026-06-10T12:00:00.000+0000", + "okActions": [], + "alarmActions": ["arn:aws:sns:us-east-1:123456789012:my-topic"], + "insufficientDataActions": [] + } + } + } + +Multi-Contributor Log Alarm + + +Events generated when a contributor of a multi-contributor log alarm (with a BY clause) changes state. Each contributor generates a separate event. + + + { + "version": "0", + "id": "6d226bbc-07f0-9a31-3359-1736968f8ded", + "detail-type": "CloudWatch Alarm Contributor State Change", + "source": "aws.cloudwatch", + "account": "123456789012", + "time": "2026-06-10T12:20:15Z", + "region": "us-east-1", + "resources": [ + "arn:aws:cloudwatch:us-east-1:123456789012:alarm:EndpointLatency" + ], + "detail": { + "alarmName": "EndpointLatency", + "alarmContributor": { + "id": "a1b2c3d4e5f6g7h8", + "attributes": { + "endpoint": "/api/orders" + } + }, + "state": { + "value": "ALARM", + "reason": "Threshold Crossed: 3 out of the last 5 query results [1250.0 (10/06/26 12:20:00), 1100.0 (10/06/26 12:15:00), 1050.0 (10/06/26 12:10:00)] were greater than the threshold (1000.0) (minimum 3 datapoints for OK -> ALARM transition).", + "timestamp": "2026-06-10T12:20:15.000+0000" + }, + "configuration": { + "logGroupIdentifiers": ["/aws/lambda/my-function", "/aws/ecs/my-service"], + "queryString": "fields @timestamp, @message | filter @message like /ERROR/", + "aggregationExpression": "count(*) by serviceName", + "scheduledQueryRoleARN": "arn:aws:iam::123456789012:role/ScheduledQueryRole", + "actionLogLineRoleArn": "arn:aws:iam::123456789012:role/LogLinesRole", + "actionLogLineCount": 5, + "schedule": { + "expression": "rate(5 minutes)", + "startTimeOffset": 300, + "endTimeOffset": 60 + }, + "threshold": 10.0, + "comparisonOperator": "GreaterThanThreshold", + "treatMissingData": "notBreaching", + "queryResultsToEvaluate": 5, + "queryResultsToAlarm": 3, + "alarmName": "EndpointLatency", + "description": "description", + "actionsEnabled": true, + "timestamp": "2026-06-10T12:00:00.000+0000", + "okActions": [], + "alarmActions": [], + "insufficientDataActions": [] + } + } + } + @@ -435,0 +553,49 @@ Events generated when new alarms are created. These events include the initial a +**Log Alarm Example** + + + { + "version": "0", + "id": "91535fdd-1e9c-849d-624b-9a9f2b1d09d0", + "detail-type": "CloudWatch Alarm Configuration Change", + "source": "aws.cloudwatch", + "account": "123456789012", + "time": "2026-06-10T12:00:00Z", + "region": "us-east-1", + "resources": [ + "arn:aws:cloudwatch:us-east-1:123456789012:alarm:HighErrorRate" + ], + "detail": { + "alarmName": "HighErrorRate", + "operation": "create", + "state": { + "value": "INSUFFICIENT_DATA", + "timestamp": "2026-06-10T12:00:00.000+0000" + }, + "configuration": { + "logGroupIdentifiers": ["/aws/lambda/my-function"], + "queryString": "fields @timestamp, @message | filter @message like /ERROR/", + "aggregationExpression": "count(*)", + "scheduledQueryRoleARN": "arn:aws:iam::123456789012:role/ScheduledQueryRole", + "actionLogLineRoleArn": "arn:aws:iam::123456789012:role/LogLinesRole", + "actionLogLineCount": 5, + "schedule": { + "expression": "rate(5 minutes)", + "startTimeOffset": 300, + "endTimeOffset": 0 + }, + "threshold": 100.0, + "comparisonOperator": "GreaterThanThreshold", + "treatMissingData": "missing", + "queryResultsToEvaluate": 5, + "queryResultsToAlarm": 3, + "alarmName": "HighErrorRate", + "description": "Alarm when error count exceeds 100", + "actionsEnabled": true, + "timestamp": "2026-06-10T12:00:00.000+0000", + "okActions": [], + "alarmActions": ["arn:aws:sns:us-east-1:123456789012:my-topic"], + "insufficientDataActions": [] + } + } + } + @@ -574,0 +741,74 @@ Events generated when existing alarms are modified. These events contain both `c +**Log Alarm Update Example** + + + { + "version": "0", + "id": "bc7d3391-47f8-ae47-f457-1b4d06118d50", + "detail-type": "CloudWatch Alarm Configuration Change", + "source": "aws.cloudwatch", + "account": "123456789012", + "time": "2026-06-10T13:00:00Z", + "region": "us-east-1", + "resources": [ + "arn:aws:cloudwatch:us-east-1:123456789012:alarm:HighErrorRate" + ], + "detail": { + "alarmName": "HighErrorRate", + "operation": "update", + "state": { + "value": "ALARM", + "timestamp": "2026-06-10T12:15:30.000+0000" + }, + "configuration": { + "logGroupIdentifiers": ["/aws/lambda/my-function"], + "queryString": "fields @timestamp, @message | filter @message like /ERROR/", + "aggregationExpression": "count(*)", + "scheduledQueryRoleARN": "arn:aws:iam::123456789012:role/ScheduledQueryRole", + "actionLogLineRoleArn": "arn:aws:iam::123456789012:role/LogLinesRole",