Setting up Amazon User Notifications Setting up an SNS topic

Notifying users on alarm changes

This section explains how you can use Amazon User Notifications or Amazon Simple Notification Service to have users be notified of alarm changes.

Setting up Amazon User Notifications

You can use Amazon User Notifications to set up delivery channels to get notified about CloudWatch alarm state change and configuration change events. You receive a notification when an event matches a rule that you specify. You can receive notifications for events through multiple channels, including email, Amazon Chatbot chat notifications, or Amazon Console Mobile Application push notifications. You can also see notifications in the at Console Notifications Center. User Notifications supports aggregation, which can reduce the number of notifications you receive during specific events.

The notification configurations you create with Amazon User Notifications do not count towards the limit on the number of actions you can configure per target alarm state. As Amazon User Notificatinos matches the events emitted to Amazon EventBridge, it sends notifications for all the alarms in your account and selected Regions, unless you specify an advanced filter to allowlist or denylist specific alarms or patterns.

The following example of an advanced filter matches an alarm state change from OK to ALARM on the alarm named ServerCpuTooHigh.


{
"detail": {
    "alarmName": ["ServerCpuTooHigh"],
    "previousState": { "value": ["OK"] },
    "state": { "value": ["ALARM"] }
  }
}

You can use any of the properties published by an alarm in EventBridge events to create a filter. For more information, see Alarm events and EventBridge.

Setting up Amazon SNS notifications

You can use Amazon Simple Notification Service to send both application-to-application (A2A) messaging and application-to-person (A2P) messaging, including mobile text messaging (SMS) and email messages. For more information, see Amazon SNS event destinations.

For every state that an alarm can take, you can configure the alarm to send a message to an SNS topic. Every Amazon SNS topic you configure for a state on a given alarm counts towards the limit on the number of actions you can configure for that alarm and state. You can send messages to the same Amazon SNS topic from any alarms in your account, and use the same Amazon SNS topic for both application (A2A) and person (A2P) consumers. Because this configuration is done at the alarm level, only the alarms you have configured send messages to the selected Amazon SNS topic.

First, create a topic, then subscribe to it. You can optionally publish a test message to the topic. For an example, see Setting up an Amazon SNS topic using the Amazon Web Services Management Console. Or for more information, see Getting started with Amazon SNS.

Alternatively, if you plan to use the Amazon Web Services Management Console to create your CloudWatch alarm, you can skip this procedure because you can create the topic when you create the alarm.

When you create a CloudWatch alarm, you can add actions for any target state the alarm enters. Add an Amazon SNS notification for the state you want to be notified about, and select the Amazon SNS topic you created in the previous step to send an email notification when the alarm enters the selected state.

Note

When you create an Amazon SNS topic, you choose to make it a standard topic or a FIFO topic. CloudWatch guarantees the publication of all alarm notifications to both types of topics. However, even if you use a FIFO topic, in rare cases CloudWatch sends the notifications to the topic out of order. If you use a FIFO topic, the alarm sets the message group ID of the alarm notifications to be a hash of the ARN of the alarm.

Preventing confused deputy issues

To prevent cross-service confused deputy security issues, we recommend that you use the aws:SourceArn and aws:SourceAccount global condition keys in the Amazon SNS resource policy that grants permission to CloudWatch to access your Amazon SNS resources.

The following example resource policy uses the aws:SourceArn condition key to narrow the SNS:Publish permission to be used only by CloudWatch alarms in the specified account.


{
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "Service": "cloudwatch.amazonaws.com"
        },
        "Action": "SNS:Publish",
        "Resource": "arn:aws:sns:us-east-2:444455556666:MyTopic",
        "Condition": {
            "ArnLike": {
                "aws:SourceArn": "arn:aws:cloudwatch:us-east-2:111122223333:alarm:*"
            },
            "StringEquals": {
                "aws:SourceAccount": "111122223333"
            }
        }
    }]
}

If an alarm ARN includes any non-ASCII characters, use only the aws:SourceAccount global condition key to limit the permissions.

First, create a topic, then subscribe to it. You can optionally publish a test message to the topic.

To create an SNS topic

Open the Amazon SNS console at https://console.amazonaws.cn/sns/v3/home.
On the Amazon SNS dashboard, under Common actions, choose Create Topic.
In the Create new topic dialog box, for Topic name, enter a name for the topic (for example, my-topic).
Choose Create topic.
Copy the Topic ARN for the next task (for example, arn:aws:sns:us-east-1:111122223333:my-topic).

To subscribe to an SNS topic

Open the Amazon SNS console at https://console.amazonaws.cn/sns/v3/home.
In the navigation pane, choose Subscriptions, Create subscription.
In the Create subscription dialog box, for Topic ARN, paste the topic ARN that you created in the previous task.
For Protocol, choose Email.
For Endpoint, enter an email address that you can use to receive the notification, and then choose Create subscription.
From your email application, open the message from Amazon Notifications and confirm your subscription.

Your web browser displays a confirmation response from Amazon SNS.

To publish a test message to an SNS topic

Open the Amazon SNS console at https://console.amazonaws.cn/sns/v3/home.
In the navigation pane, choose Topics.
On the Topics page, select a topic and choose Publish to topic.
In the Publish a message page, for Subject, enter a subject line for your message, and for Message, enter a brief message.
Choose Publish Message.
Check your email to confirm that you received the message.

First, you create an SNS topic, and then you publish a message directly to the topic to test that you have properly configured it.

To set up an SNS topic

Create the topic using the create-topic command as follows.
```
aws sns create-topic --name my-topic
```
Amazon SNS returns a topic ARN with the following format:
```
{
    "TopicArn": "arn:aws:sns:us-east-1:111122223333:my-topic"
}
```
Subscribe your email address to the topic using the subscribe command. If the subscription request succeeds, you receive a confirmation email message.
```
aws sns subscribe --topic-arn arn:aws:sns:us-east-1:111122223333:my-topic --protocol email --notification-endpoint my-email-address
```
Amazon SNS returns the following:
```
{
    "SubscriptionArn": "pending confirmation"
}
```
From your email application, open the message from Amazon Notifications and confirm your subscription.

Your web browser displays a confirmation response from Amazon Simple Notification Service.

Check the subscription using the list-subscriptions-by-topic command.


aws sns list-subscriptions-by-topic --topic-arn arn:aws:sns:us-east-1:111122223333:my-topic

Amazon SNS returns the following:


{
  "Subscriptions": [
    {
        "Owner": "111122223333",
        "Endpoint": "me@mycompany.com",
        "Protocol": "email",
        "TopicArn": "arn:aws:sns:us-east-1:111122223333:my-topic",
        "SubscriptionArn": "arn:aws:sns:us-east-1:111122223333:my-topic:64886986-bf10-48fb-a2f1-dab033aa67a3"
    }
  ]
}

(Optional) Publish a test message to the topic using the publish command.


aws sns publish --message "Verification" --topic arn:aws:sns:us-east-1:111122223333:my-topic

Amazon SNS returns the following.


{
    "MessageId": "42f189a0-3094-5cf6-8fd7-c2dde61a4d7d"
}

Check your email to confirm that you received the message.

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Acting on alarm changes

Alarm events and EventBridge