如何使用 CloudFormation 在指标过滤器中设置警报

Question

如何为指标过滤器创建警报并连接 SNS 主题。

我的任务是：

1. 创建 SNS 主题和电子邮件订阅
2. 创建 CloudWatch 日志组
3. 为该 CloudWatch 日志组创建指标过滤器并创建警报并连接 SNS 主题

AWSTemplateFormatVersion: "2010-09-09"
#Parameters:
 #EmailAddress:
  #Type: String
  #Description: The email address to use for alarm notifications.

Resources:
 # Create SNS and email subscription
 MySNSTopic:
  Type: AWS::SNS::Topic
  Properties:
    Subscription:
    - Endpoint: "abcd@abc.com"
      Protocol: email
   
 # Create CloudWatch log group
 snstopic: 
  Type: AWS::Logs::LogGroup
  DependsOn: MySNSTopic
  Properties: 
    RetentionInDays: 7
  
 # Create metric filter
 UnauthorizedApiCalls: 
  Type: AWS::Logs::MetricFilter
  DependsOn: snstopic
  Properties: 
    LogGroupName: 
      Ref: "snstopic"
    FilterPattern: '{($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")}'
    MetricTransformations: 
      - MetricValue: "1"
        MetricNamespace: "unauthorized-api-calls"
        MetricName: "LogMetrics"
  
 # Create alarm
 UnauthorizedApiCallsAlarm:
  Type: AWS::CloudWatch::Alarm
  DependsOn: UnauthorizedApiCalls
  Properties:
    AlarmName: UnauthorizedApiCallsAlarm
    AlarmActions: !Ref snstopic
    MetricName: UnauthorizedApiCalls
    Namespace: LogMetrics
    ComparisonOperator: GreaterThanOrEqualToThreshold
    EvaluationPeriods: '1'
    Period: '5'
    Statistic: Sum
    Threshold: '1'
    TreatMissingData: breaching

Answer 1

试试这个。根据documentation，AlarmActions的类型为List of String。

# Create alarm
UnauthorizedApiCallsAlarm:
 Type: AWS::CloudWatch::Alarm
 DependsOn: UnauthorizedApiCalls
 Properties:
   AlarmName: UnauthorizedApiCallsAlarm
   AlarmActions: 
   - !Ref snstopic
   MetricName: UnauthorizedApiCalls
   Namespace: LogMetrics
   ComparisonOperator: GreaterThanOrEqualToThreshold
   EvaluationPeriods: '1'
   Period: '5'
   Statistic: Sum
   Threshold: '1'
   TreatMissingData: breaching