Table: aws_cloudwatch_alarm - Query AWS CloudWatch Alarms using SQL
The AWS CloudWatch Alarms is a feature of Amazon CloudWatch, a monitoring service for AWS resources and applications. CloudWatch Alarms allow you to monitor Amazon Web Services resources and trigger actions when changes in data points meet certain defined thresholds. They help you react quickly to issues that may affect your applications or infrastructure, thereby enhancing your ability to keep applications running smoothly.
Table Usage Guide
The aws_cloudwatch_alarm
table in Steampipe provides you with information about alarms within AWS CloudWatch. This table allows you, as a DevOps engineer, to query alarm-specific details, including its current state, configuration, and actions associated with each alarm. You can utilize this table to gather insights on alarms, such as alarms in a particular state, alarms associated with specific AWS resources, and understanding the actions that will be triggered when an alarm state changes. The schema outlines the various attributes of the CloudWatch alarm for you, including the alarm name, alarm description, metric name, comparison operator, and associated tags.
Examples
Basic info
Explore the status and configurations of your CloudWatch alarms to understand their current operational state and the conditions that trigger them. This can help you monitor the health and performance of your AWS resources more effectively.
select name, state_value, metric_name, actions_enabled, comparison_operator, namespace, statisticfrom aws_cloudwatch_alarm;
select name, state_value, metric_name, actions_enabled, comparison_operator, namespace, statisticfrom aws_cloudwatch_alarm;
List alarms in alarm state
Discover the segments that are currently in an alarm state. This is useful to quickly identify and address any issues within your cloud infrastructure.
select name, arn, state_value, state_reasonfrom aws_cloudwatch_alarmwhere state_value = 'ALARM';
select name, arn, state_value, state_reasonfrom aws_cloudwatch_alarmwhere state_value = 'ALARM';
List alarms with alarm actions enabled
Identify instances where alarms have been activated with specific actions in the AWS CloudWatch service. This can be useful in understanding the active monitoring and alerting mechanisms in place for system events.
select arn, actions_enabled, alarm_actionsfrom aws_cloudwatch_alarmwhere actions_enabled;
select arn, actions_enabled, alarm_actionsfrom aws_cloudwatch_alarmwhere actions_enabled = 1;
Get the metric attached to each alarm based on a single metric
Discover the segments that have alarms set based on specific metrics within the AWS Cloudwatch service. This is particularly useful for monitoring and managing application performance, resource utilization, and operational health.
select name, metric_name, namespace, period, statistic, dimensionsfrom aws_cloudwatch_alarmwhere metric_name is not null;
select name, metric_name, namespace, period, statistic, dimensionsfrom aws_cloudwatch_alarmwhere metric_name is not null;
Get metrics attached to each alarm based on a metric math expression
Identify the metrics associated with each alarm based on mathematical expressions. This can help in understanding the performance of various elements and aid in proactive monitoring and troubleshooting.
select name, metric ->> 'Id' as metric_id, metric ->> 'Expression' as metric_expression, metric -> 'MetricStat' -> 'Metric' ->> 'MetricName' as metric_name, metric -> 'MetricStat' -> 'Metric' ->> 'Namespace' as metric_namespace, metric -> 'MetricStat' -> 'Metric' ->> 'Dimensions' as metric_dimensions, metric ->> 'ReturnData' as metric_return_datafrom aws_cloudwatch_alarm, jsonb_array_elements(metrics) as metric;
select name, json_extract(metric, '$.Id') as metric_id, json_extract(metric, '$.Expression') as metric_expression, json_extract(metric, '$.MetricStat.Metric.MetricName') as metric_name, json_extract(metric, '$.MetricStat.Metric.Namespace') as metric_namespace, json_extract(metric, '$.MetricStat.Metric.Dimensions') as metric_dimensions, json_extract(metric, '$.ReturnData') as metric_return_datafrom aws_cloudwatch_alarm, json_each(metrics) as metric;
Control examples
- All Controls > CloudWatch > Ensure AWS Organizations changes are monitored
- CIS v1.2.0 > 3 Monitoring > 3.1 Ensure a log metric filter and alarm exist for unauthorized API calls
- CIS v1.2.0 > 3 Monitoring > 3.10 Ensure a log metric filter and alarm exist for security group changes
- CIS v1.2.0 > 3 Monitoring > 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
- CIS v1.2.0 > 3 Monitoring > 3.12 Ensure a log metric filter and alarm exist for changes to network gateways
- CIS v1.2.0 > 3 Monitoring > 3.13 Ensure a log metric filter and alarm exist for route table changes
- CIS v1.2.0 > 3 Monitoring > 3.14 Ensure a log metric filter and alarm exist for VPC changes
- CIS v1.2.0 > 3 Monitoring > 3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
- CIS v1.2.0 > 3 Monitoring > 3.3 Ensure a log metric filter and alarm exist for usage of "root" account
- CIS v1.2.0 > 3 Monitoring > 3.4 Ensure a log metric filter and alarm exist for IAM policy changes
- CIS v1.2.0 > 3 Monitoring > 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- CIS v1.2.0 > 3 Monitoring > 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- CIS v1.2.0 > 3 Monitoring > 3.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
- CIS v1.2.0 > 3 Monitoring > 3.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes
- CIS v1.2.0 > 3 Monitoring > 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
- CIS v1.3.0 > 4 Monitoring > 4.1 Ensure a log metric filter and alarm exist for unauthorized API calls
- CIS v1.3.0 > 4 Monitoring > 4.10 Ensure a log metric filter and alarm exist for security group changes
- CIS v1.3.0 > 4 Monitoring > 4.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
- CIS v1.3.0 > 4 Monitoring > 4.12 Ensure a log metric filter and alarm exist for changes to network gateways
- CIS v1.3.0 > 4 Monitoring > 4.13 Ensure a log metric filter and alarm exist for route table changes
- CIS v1.3.0 > 4 Monitoring > 4.14 Ensure a log metric filter and alarm exist for VPC changes
- CIS v1.3.0 > 4 Monitoring > 4.15 Ensure a log metric filter and alarm exists for AWS Organizations changes
- CIS v1.3.0 > 4 Monitoring > 4.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
- CIS v1.3.0 > 4 Monitoring > 4.3 Ensure a log metric filter and alarm exist for usage of "root" account
- CIS v1.3.0 > 4 Monitoring > 4.4 Ensure a log metric filter and alarm exist for IAM policy changes
- CIS v1.3.0 > 4 Monitoring > 4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- CIS v1.3.0 > 4 Monitoring > 4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- CIS v1.3.0 > 4 Monitoring > 4.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
- CIS v1.3.0 > 4 Monitoring > 4.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes
- CIS v1.3.0 > 4 Monitoring > 4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
- CIS v1.4.0 > 4 Monitoring > 4.1 Ensure a log metric filter and alarm exist for unauthorized API calls
- CIS v1.4.0 > 4 Monitoring > 4.10 Ensure a log metric filter and alarm exist for security group changes
- CIS v1.4.0 > 4 Monitoring > 4.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
- CIS v1.4.0 > 4 Monitoring > 4.12 Ensure a log metric filter and alarm exist for changes to network gateways
- CIS v1.4.0 > 4 Monitoring > 4.13 Ensure a log metric filter and alarm exist for route table changes
- CIS v1.4.0 > 4 Monitoring > 4.14 Ensure a log metric filter and alarm exist for VPC changes
- CIS v1.4.0 > 4 Monitoring > 4.15 Ensure a log metric filter and alarm exists for AWS Organizations changes
- CIS v1.4.0 > 4 Monitoring > 4.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
- CIS v1.4.0 > 4 Monitoring > 4.3 Ensure a log metric filter and alarm exist for usage of 'root' account
- CIS v1.4.0 > 4 Monitoring > 4.4 Ensure a log metric filter and alarm exist for IAM policy changes
- CIS v1.4.0 > 4 Monitoring > 4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- CIS v1.4.0 > 4 Monitoring > 4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- CIS v1.4.0 > 4 Monitoring > 4.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
- CIS v1.4.0 > 4 Monitoring > 4.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes
- CIS v1.4.0 > 4 Monitoring > 4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
- CIS v1.5.0 > 4 Monitoring > 4.1 Ensure a log metric filter and alarm exist for unauthorized API calls
- CIS v1.5.0 > 4 Monitoring > 4.10 Ensure a log metric filter and alarm exist for security group changes
- CIS v1.5.0 > 4 Monitoring > 4.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
- CIS v1.5.0 > 4 Monitoring > 4.12 Ensure a log metric filter and alarm exist for changes to network gateways
- CIS v1.5.0 > 4 Monitoring > 4.13 Ensure a log metric filter and alarm exist for route table changes
- CIS v1.5.0 > 4 Monitoring > 4.14 Ensure a log metric filter and alarm exist for VPC changes
- CIS v1.5.0 > 4 Monitoring > 4.15 Ensure a log metric filter and alarm exists for AWS Organizations changes
- CIS v1.5.0 > 4 Monitoring > 4.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
- CIS v1.5.0 > 4 Monitoring > 4.3 Ensure a log metric filter and alarm exist for usage of 'root' account
- CIS v1.5.0 > 4 Monitoring > 4.4 Ensure a log metric filter and alarm exist for IAM policy changes
- CIS v1.5.0 > 4 Monitoring > 4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- CIS v1.5.0 > 4 Monitoring > 4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- CIS v1.5.0 > 4 Monitoring > 4.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
- CIS v1.5.0 > 4 Monitoring > 4.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes
- CIS v1.5.0 > 4 Monitoring > 4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
- CIS v2.0.0 > 4 Monitoring > 4.1 Ensure unauthorized API calls are monitored
- CIS v2.0.0 > 4 Monitoring > 4.10 Ensure security group changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.11 Ensure Network Access Control Lists (NACL) changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.12 Ensure changes to network gateways are monitored
- CIS v2.0.0 > 4 Monitoring > 4.13 Ensure route table changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.14 Ensure VPC changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.15 Ensure AWS Organizations changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.2 Ensure management console sign-in without MFA is monitored
- CIS v2.0.0 > 4 Monitoring > 4.3 Ensure usage of 'root' account is monitored
- CIS v2.0.0 > 4 Monitoring > 4.4 Ensure IAM policy changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.5 Ensure CloudTrail configuration changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.6 Ensure AWS Management Console authentication failures are monitored
- CIS v2.0.0 > 4 Monitoring > 4.7 Ensure disabling or scheduled deletion of customer created CMKs is monitored
- CIS v2.0.0 > 4 Monitoring > 4.8 Ensure S3 bucket policy changes are monitored
- CIS v2.0.0 > 4 Monitoring > 4.9 Ensure AWS Config configuration changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.1 Ensure unauthorized API calls are monitored
- CIS v3.0.0 > 4 Monitoring > 4.10 Ensure security group changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.11 Ensure Network Access Control Lists (NACL) changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.12 Ensure changes to network gateways are monitored
- CIS v3.0.0 > 4 Monitoring > 4.13 Ensure route table changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.14 Ensure VPC changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.15 Ensure AWS Organizations changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.2 Ensure management console sign-in without MFA is monitored
- CIS v3.0.0 > 4 Monitoring > 4.3 Ensure usage of 'root' account is monitored
- CIS v3.0.0 > 4 Monitoring > 4.4 Ensure IAM policy changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.5 Ensure CloudTrail configuration changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.6 Ensure AWS Management Console authentication failures are monitored
- CIS v3.0.0 > 4 Monitoring > 4.7 Ensure disabling or scheduled deletion of customer created CMKs is monitored
- CIS v3.0.0 > 4 Monitoring > 4.8 Ensure S3 bucket policy changes are monitored
- CIS v3.0.0 > 4 Monitoring > 4.9 Ensure AWS Config configuration changes are monitored
- CloudWatch alarm action should be enabled
- CloudWatch alarm should have an action configured
- Ensure a log metric filter and alarm exist for AWS Config configuration changes
- Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- Ensure a log metric filter and alarm exist for AWS Management Console sign-in without MFA
- Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
- Ensure a log metric filter and alarm exist for changes to network gateways
- Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer managed keys
- Ensure a log metric filter and alarm exist for IAM policy changes
- Ensure a log metric filter and alarm exist for route table changes
- Ensure a log metric filter and alarm exist for S3 bucket policy changes
- Ensure a log metric filter and alarm exist for security group changes
- Ensure a log metric filter and alarm exist for unauthorized API calls
- Ensure a log metric filter and alarm exist for usage of 'root' account
- Ensure a log metric filter and alarm exist for VPC changes
Schema for aws_cloudwatch_alarm
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
account_id | text | =, !=, ~~, ~~*, !~~, !~~* | The AWS Account ID in which the resource is located. |
actions_enabled | boolean | Indicates whether actions should be executed during any changes to the alarm state. | |
akas | jsonb | Array of globally unique identifier strings (also known as) for the resource. | |
alarm_actions | jsonb | The actions to execute when this alarm transitions to the ALARM state from any other state. Each action is specified as an Amazon Resource Name (ARN). | |
alarm_configuration_updated_timestamp | timestamp with time zone | The time stamp of the last update to the alarm configuration. | |
alarm_description | text | The description of the alarm. | |
arn | text | The Amazon Resource Name (ARN) of the alarm. | |
comparison_operator | text | The arithmetic operation to use when comparing the specified statistic and threshold. The specified statistic value is used as the first operand. | |
datapoints_to_alarm | bigint | The number of data points that must be breaching to trigger the alarm. | |
dimensions | jsonb | The dimensions for the metric associated with the alarm. | |
evaluate_low_sample_count_percentile | text | Used only for alarms based on percentiles. | |
evaluation_periods | bigint | The number of periods over which data is compared to the specified threshold. | |
evaluation_state | text | If the value of this field is PARTIAL_DATA , the alarm is being evaluated based on only partial data. This happens if the query used for the alarm returns more than 10,000 metrics. | |
extended_statistic | text | The percentile statistic for the metric associated with the alarm. Specify a value between p0.0 and p100. | |
insufficient_data_actions | jsonb | The actions to execute when this alarm transitions to the INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN). | |
metric_name | text | The name of the metric associated with the alarm, if this is an alarm based on a single metric. | |
metrics | jsonb | An array of MetricDataQuery structures, used in an alarm based on a metric math expression. | |
name | text | = | The name of the alarm. |
namespace | text | The namespace of the metric associated with the alarm. | |
ok_actions | jsonb | The actions to execute when this alarm transitions to the OK state from any other state. Each action is specified as an Amazon Resource Name (ARN). | |
partition | text | The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov). | |
period | bigint | The period, in seconds, over which the statistic is applied. | |
region | text | The AWS Region in which the resource is located. | |
sp_connection_name | text | =, !=, ~~, ~~*, !~~, !~~* | Steampipe connection name. |
sp_ctx | jsonb | Steampipe context in JSON form. | |
state_reason | text | An explanation for the alarm state, in text format. | |
state_reason_data | text | An explanation for the alarm state, in JSON format. | |
state_transitioned_timestamp | timestamp with time zone | The date and time that the alarm's StateValue most recently changed. | |
state_updated_timestamp | timestamp with time zone | The time stamp of the last update to the alarm state. | |
state_value | text | = | The state value for the alarm. |
statistic | text | The statistic for the metric associated with the alarm, other than percentile. | |
tags | jsonb | A map of tags for the resource. | |
tags_src | jsonb | The list of tag keys and values associated with alarm. | |
threshold | double precision | The value to compare with the specified statistic. | |
threshold_metric_id | text | In an alarm based on an anomaly detection model, this is the ID of the ANOMALY_DETECTION_BAND function used as the threshold for the alarm. | |
title | text | Title of the resource. | |
treat_missing_data | text | Sets how this alarm is to handle missing data points. If this parameter is omitted, the default behavior of missing is used. | |
unit | text | The unit of the metric associated with the alarm. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- aws
You can pass the configuration to the command with the --config
argument:
steampipe_export_aws --config '<your_config>' aws_cloudwatch_alarm