Alarm actions (SNS, Auto Scaling) in AWS - Commands & Configuration

Introduction

Sometimes you want to be notified or automatically fix problems when your cloud resources have issues. Alarm actions let you send messages or change resource capacity when a problem happens.

When you want to get an email alert if your server CPU is too high.

When you want to automatically add more servers if your app gets busy.

When you want to send a message to a team chat when a resource fails.

When you want to reduce server count when traffic is low to save money.

When you want to trigger a custom action using a message service after an alarm.

Config File - alarm.json

alarm.json

{
  "AlarmName": "HighCPUAlarm",
  "AlarmDescription": "Alarm when CPU exceeds 70%",
  "ActionsEnabled": true,
  "OKActions": ["arn:aws:sns:us-east-1:123456789012:NotifyMe"],
  "AlarmActions": ["arn:aws:sns:us-east-1:123456789012:NotifyMe", "arn:aws:autoscaling:us-east-1:123456789012:scalingPolicy:my-scale-out-policy:autoScalingGroupName/my-auto-scaling-group"],
  "MetricName": "CPUUtilization",
  "Namespace": "AWS/EC2",
  "Statistic": "Average",
  "Period": 300,
  "EvaluationPeriods": 1,
  "Threshold": 70.0,
  "ComparisonOperator": "GreaterThanThreshold",
  "Dimensions": [
    {
      "Name": "AutoScalingGroupName",
      "Value": "my-auto-scaling-group"
    }
  ]
}

This JSON defines a CloudWatch alarm named HighCPUAlarm that watches the average CPU usage of an EC2 Auto Scaling group.

AlarmActions triggers two actions when CPU is above 70%: sending a message to an SNS topic and running an Auto Scaling policy to add servers.

OKActions sends a notification when the alarm returns to normal.

The Dimensions specify which Auto Scaling group to monitor.

Commands

This command creates or updates the CloudWatch alarm using the JSON file. It sets the alarm to watch CPU and trigger SNS and Auto Scaling actions.

Terminal

aws cloudwatch put-metric-alarm --cli-input-json file://alarm.json

Expected Output

No output (command runs silently)

→

--cli-input-json - Specifies the JSON file with alarm configuration

This command checks the details of the alarm to confirm it was created and shows its current state and actions.

Terminal

aws cloudwatch describe-alarms --alarm-names HighCPUAlarm

Expected Output

{

    "MetricAlarms": [

        {

            "AlarmName": "HighCPUAlarm",

            "AlarmDescription": "Alarm when CPU exceeds 70%",

            "ActionsEnabled": true,

            "OKActions": [

                "arn:aws:sns:us-east-1:123456789012:NotifyMe"

            ],

            "AlarmActions": [

                "arn:aws:sns:us-east-1:123456789012:NotifyMe",

                "arn:aws:autoscaling:us-east-1:123456789012:scalingPolicy:my-scale-out-policy:autoScalingGroupName/my-auto-scaling-group"

            ],

            "StateValue": "OK",

            "MetricName": "CPUUtilization",

            "Namespace": "AWS/EC2",

            "Statistic": "Average",

            "Period": 300,

            "EvaluationPeriods": 1,

            "Threshold": 70.0,

            "ComparisonOperator": "GreaterThanThreshold",

            "Dimensions": [

                {

                    "Name": "AutoScalingGroupName",

                    "Value": "my-auto-scaling-group"

                }

            ]

        }

    ]

}

→

--alarm-names - Filters output to show only the named alarm

Key Concept

If you remember nothing else from this pattern, remember: alarm actions let you automatically notify people or change resource capacity when a problem happens.

Common Mistakes

Not enabling ActionsEnabled in the alarm configuration

The alarm will not perform any actions even if triggered.

Set "ActionsEnabled": true in the alarm JSON to allow actions.

Using incorrect ARNs for SNS topics or Auto Scaling policies

The alarm cannot find the action targets and will fail silently.

Verify and use the exact ARN strings for SNS topics and Auto Scaling policies.

Not specifying the correct Dimensions for the metric

The alarm monitors the wrong resource and never triggers as expected.

Include the correct Dimension name and value matching the resource to monitor.

Summary

Create a CloudWatch alarm JSON file defining the metric, threshold, and actions.

Use aws cloudwatch put-metric-alarm with the JSON file to create the alarm.

Verify the alarm and its actions with aws cloudwatch describe-alarms.

Practice

1. What is the primary purpose of connecting an AWS CloudWatch alarm to an SNS topic?

easy

A. To create backups of alarm configurations

B. To send notifications when the alarm state changes

C. To store alarm history logs

D. To automatically scale EC2 instances

Solution

1. Step 1: Understand SNS topic role

   SNS topics are used to send messages or notifications to subscribers.

2. Step 2: Connect alarm to SNS for notifications

   When an alarm changes state, it can trigger SNS to notify users or systems.

3. Final Answer:

   To send notifications when the alarm state changes -> Option B

4. Quick Check:

   Alarm + SNS = Notifications [OK]

Hint: SNS topics send messages on alarm changes [OK]

Common Mistakes:

• Confusing SNS with Auto Scaling actions
• Thinking SNS stores logs
• Assuming SNS creates backups

2. Which of the following is the correct way to specify an Auto Scaling action in a CloudWatch alarm configuration?

easy

A. {
"AlarmActions": ["arn:aws:autoscaling:region:account-id:scalingPolicy:policy-id:autoScalingGroupName/group-name:policyName/policy-name"]
}

B. AlarmActions: ["arn:aws:sns:region:account-id:topic-name"]

C. AlarmActions: ["arn:aws:lambda:region:account-id:function:function-name"]

D. AlarmActions: ["arn:aws:s3:::bucket-name"]

Solution

1. Step 1: Identify correct ARN format for Auto Scaling policy

   Auto Scaling policy ARNs include 'autoscaling' and specify scalingPolicy and group name.

2. Step 2: Match with given options

   { "AlarmActions": ["arn:aws:autoscaling:region:account-id:scalingPolicy:policy-id:autoScalingGroupName/group-name:policyName/policy-name"] } matches the correct ARN format for Auto Scaling alarm action.

3. Final Answer:

   Correct Auto Scaling policy ARN format -> Option A

4. Quick Check:

   Auto Scaling action uses autoscaling ARN [OK]

Hint: Auto Scaling ARNs contain 'autoscaling' keyword [OK]

Common Mistakes:

• Using SNS ARN instead of Auto Scaling ARN
• Confusing Lambda or S3 ARNs as alarm actions
• Incorrect ARN structure

3. Given this CloudWatch alarm configuration snippet:

{
  "AlarmName": "HighCPU",
  "MetricName": "CPUUtilization",
  "Namespace": "AWS/EC2",
  "Threshold": 80,
  "ComparisonOperator": "GreaterThanThreshold",
  "EvaluationPeriods": 2,
  "AlarmActions": ["arn:aws:sns:us-east-1:123456789012:NotifyMe"]
}

What happens when the CPU utilization exceeds 80% for 2 evaluation periods?

medium

A. An SNS notification is sent to subscribers of the NotifyMe topic

B. The EC2 instance automatically scales up

C. The alarm resets without any action

D. A Lambda function is triggered

Solution

1. Step 1: Analyze AlarmActions ARN

   The AlarmActions list contains an SNS topic ARN, meaning notifications are sent on alarm.

2. Step 2: Understand alarm trigger

   When CPUUtilization > 80% for 2 periods, alarm state changes and triggers SNS notification.

3. Final Answer:

   An SNS notification is sent to subscribers of the NotifyMe topic -> Option A

4. Quick Check:

   Alarm with SNS ARN sends notifications [OK]

Hint: SNS ARN in AlarmActions means notification sent [OK]

Common Mistakes:

• Assuming Auto Scaling happens without scaling policy
• Thinking alarm resets silently
• Confusing SNS with Lambda triggers

4. You configured a CloudWatch alarm to trigger an Auto Scaling policy, but the instances are not scaling when the alarm state changes. What is the most likely cause?

medium

A. The EC2 instances are stopped

B. The SNS topic subscription is missing

C. The alarm threshold is set too low

D. The alarm's AlarmActions does not include the correct Auto Scaling policy ARN

Solution

1. Step 1: Check AlarmActions configuration

   If the Auto Scaling policy ARN is missing or incorrect, the alarm cannot trigger scaling.

2. Step 2: Rule out other options

   SNS subscription missing affects notifications, not scaling. Threshold too low triggers alarm but no scaling if policy missing. Stopped instances do not scale but alarm triggers still need correct action.

3. Final Answer:

   The alarm's AlarmActions does not include the correct Auto Scaling policy ARN -> Option D

4. Quick Check:

   Correct Auto Scaling ARN needed in AlarmActions [OK]

Hint: Auto Scaling needs correct policy ARN in AlarmActions [OK]

Common Mistakes:

• Confusing SNS subscription with scaling trigger
• Ignoring ARN correctness
• Assuming stopped instances auto scale

5. You want to automatically increase the number of EC2 instances when CPU usage is high and send a notification to your team. Which combination of alarm actions should you configure?

hard

A. Add only the Auto Scaling policy ARN to AlarmActions

B. Add only the SNS topic ARN to AlarmActions

C. Add both the Auto Scaling policy ARN and the SNS topic ARN to the alarm's AlarmActions

D. Create two separate alarms, one for scaling and one for notifications

Solution

1. Step 1: Understand alarm actions for scaling and notifications

   To scale automatically, the alarm must trigger the Auto Scaling policy. To notify, it must trigger the SNS topic.

2. Step 2: Combine both actions in one alarm

   Adding both ARNs in AlarmActions ensures the alarm triggers scaling and sends notifications simultaneously.

3. Final Answer:

   Add both the Auto Scaling policy ARN and the SNS topic ARN to the alarm's AlarmActions -> Option C

4. Quick Check:

   Multiple AlarmActions allow scaling + notifications [OK]

Hint: Use both Auto Scaling and SNS ARNs in AlarmActions [OK]

Common Mistakes:

• Thinking one ARN can do both scaling and notifications
• Creating multiple alarms unnecessarily
• Missing one of the required ARNs