Creating Alarms and Notifications
Trigger SNS alerts when a security threshold is crossed.
What a CloudWatch Alarm Does
A CloudWatch alarm watches a single metric and changes state when the value crosses a threshold you define over a period of time. Its job is to convert a number that breaches a limit into an action, most often a notification. Alarms are how monitoring becomes alerting.
The Three Alarm States
An alarm is always in one of three states: OK when the metric is within bounds, ALARM when the threshold is breached, and INSUFFICIENT_DATA when there is not enough data to decide. Actions can be attached to any state transition, so you can notify both when trouble starts and when it clears.
All lessons in this course
- Collecting Logs into CloudWatch
- Metric Filters for Security Events
- Creating Alarms and Notifications
- Detecting Root Account Usage