Back to Checks
aws

CloudWatch metric alarm has actions configured for the ALARM state

cloudwatch_alarm_actions_alarm_state_configured
Service: cloudwatchSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsCloudWatchAlarm

Amazon CloudWatch metric alarms are evaluated for actions configured for the ALARM state. The finding flags alarms that have no action to execute when their monitored metric crosses its threshold.

Prowler logoProwlerprowler-provider-aws

Risk

Without an ALARM action, threshold breaches trigger no notification or automated response. This delays detection and containment, risking:

  • Availability: prolonged outages or missed scale-out
  • Integrity/confidentiality: unchecked anomalies enabling tampering or data loss

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudwatch_alarm_actions_alarm_state_configured

Recommendation

Assign at least one ALARM-state action per alarm (e.g., notify via SNS or run automated remediation with Lambda/SSM). Keep actions enabled, apply least privilege to targets, and regularly test. For critical metrics, add redundant paths (EventBridge) for defense in depth.

Remediation

CLI

aws cloudwatch put-metric-alarm --alarm-name <alarm-name> --metric-name <metric-name> --namespace <namespace> --statistic <statistic> --period <period-seconds> --evaluation-periods <evaluation-periods> --threshold <threshold> --comparison-operator <comparison-operator> --alarm-actions <action-arn>

Terraform

# Terraform: add an ALARM action to a metric alarm
resource "aws_cloudwatch_metric_alarm" "<example_resource_name>" {
  alarm_name          = "<example_resource_name>"
  metric_name         = "<metric-name>"
  namespace           = "<namespace>"
  statistic           = "Average"
  period              = 60
  evaluation_periods  = 1
  threshold           = 1
  comparison_operator = "GreaterThanThreshold"
  alarm_actions       = ["<action-arn>"] # CRITICAL: ensures an action is configured for ALARM state
}

NativeIaC

# CloudFormation: add an ALARM action to a metric alarm
Resources:
  <example_resource_name>:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: <example_resource_name>
      MetricName: <metric-name>
      Namespace: <namespace>
      Statistic: Average
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - <action-arn>  # CRITICAL: adds an action for ALARM state so the check passes

Other

1Open the AWS Console and go to CloudWatch > Alarms
2Select the target alarm and choose Edit (or Modify alarm)
3In Actions, under When alarm state is ALARM, add an action (e.g., select an SNS topic or other supported action)
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
    cloudwatch_client,
)


class cloudwatch_alarm_actions_alarm_state_configured(Check):
    def execute(self):
        findings = []
        if cloudwatch_client.metric_alarms is not None:
            for metric_alarm in cloudwatch_client.metric_alarms:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=metric_alarm
                )
                report.status = "PASS"
                report.status_extended = f"CloudWatch metric alarm {metric_alarm.name} has actions configured for the ALARM state."
                if not metric_alarm.alarm_actions:
                    report.status = "FAIL"
                    report.status_extended = f"CloudWatch metric alarm {metric_alarm.name} does not have actions configured for the ALARM state."
                findings.append(report)
        return findings

References