Description
Identify AWS CloudWatch Metric Alarms that were provisioned through AWS CloudFormation or AWS Service Catalog.
This policy checks for AWS-reserved tags that identify a CloudWatch metric alarm as a resource provisioned through AWS CloudFormation or AWS Service Catalog. It does not require every metric alarm to have these tags, and it does not treat customer-defined tags as proof of provisioning origin.
Rationale
AWS-managed provisioning tags provide evidence that a metric alarm is associated with a CloudFormation stack or a Service Catalog provisioned product. This allows to distinguish alarms with supported AWS-managed provisioning indicators from alarms that are not identified by this tag-based method.
Audit
This policy classifies an AWS CloudWatch Metric Alarm as identified by automated provisioning evidence when the alarm has at least one of the following AWS-reserved tag keys:
aws:cloudformation:logical-idaws:cloudformation:stack-idaws:cloudformation:stack-nameaws:servicecatalog:portfolioArnaws:servicecatalog:productArnaws:servicecatalog:provisioningPrincipalArnaws:servicecatalog:provisionedProductArnaws:servicecatalog:provisioningArtifactIdentifier
The CloudFormation tags are included because AWS documents that CloudFormation automatically creates the aws:cloudformation:logical-id, aws:cloudformation:stack-id, and aws:cloudformation:stack-name stack-level tags. The Service Catalog tags are included because AWS documents these keys as Service Catalog tags that identify the origin of provisioned resources.
Metric alarms without one of the supported AWS-managed provisioning tags are classified as not identified by this automated provisioning tag signal. This result is not evidence by itself that the alarm is misconfigured.