Skip to main content

🛡️ AWS CloudWatch Metric Alarm auto-provisioning status🟢

  • Contextual name: 🛡️ CloudWatch Metric Alarm auto-provisioning status🟢
  • ID: /ce/ca/automated-provisioning/aws-cloudwatch-metric-alarm
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY

Stats​

not available

Logic​

Description​

Open File

Description​

Identify AWS CloudWatch Metric Alarms that were provisioned through AWS CloudFormation or AWS Service Catalog.

This policy checks for AWS-reserved tags that identify a CloudWatch metric alarm as a resource provisioned through AWS CloudFormation or AWS Service Catalog. It does not require every metric alarm to have these tags, and it does not treat customer-defined tags as proof of provisioning origin.

Rationale​

AWS-managed provisioning tags provide evidence that a metric alarm is associated with a CloudFormation stack or a Service Catalog provisioned product. This allows to distinguish alarms with supported AWS-managed provisioning indicators from alarms that are not identified by this tag-based method.

Audit​

This policy classifies an AWS CloudWatch Metric Alarm as identified by automated provisioning evidence when the alarm has at least one of the following AWS-reserved tag keys:

  • aws:cloudformation:logical-id
  • aws:cloudformation:stack-id
  • aws:cloudformation:stack-name
  • aws:servicecatalog:portfolioArn

... see more

Remediation​

Open File

Remediation​

Review the CloudWatch metric alarm and confirm its provisioning source.

Validate whether the alarm is associated with a CloudFormation stack, a Service Catalog provisioned product, another automation workflow, or a manual process. If the provisioning source is known, document the ownership and lifecycle expectations. If the alarm is no longer needed, remove it through the appropriate operational process.

policy.yaml​

Open File