Back to Checks
aws

CloudWatch metric alarm has actions enabled

cloudwatch_alarm_actions_enabled
Service: cloudwatchSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsCloudWatchAlarm

CloudWatch metric alarms are evaluated for alarm actions activation (actions_enabled: true), enabling state changes to invoke configured notifications or automated responses.

Prowler logoProwlerprowler-provider-aws

Risk

With alarm actions disabled, state changes neither notify nor remediate. Incidents can persist unnoticed, enabling unauthorized activity, configuration drift, or capacity exhaustion. Visibility drops, MTTR rises, and confidentiality, integrity, and availability are all at greater risk.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudwatch_alarm_actions_enabled

Recommendation

Enable actions_enabled on critical alarms and attach least-privilege actions (SNS, automation) for ALARM and recovery states. Use redundant targets, regularly test notifications, and integrate with incident response. Apply defense in depth with complementary detections to ensure timely, reliable alerting.

Remediation

CLI

aws cloudwatch enable-alarm-actions --alarm-names <alarm-name>

Terraform

resource "aws_cloudwatch_metric_alarm" "<example_resource_name>" {
  alarm_name          = "<example_resource_name>"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "<example_metric_name>"
  namespace           = "<example_metric_namespace>"
  period              = 60
  statistic           = "Average"
  threshold           = 1

  actions_enabled = true  # FIX: activates alarm actions so the check passes
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: true  # FIX: activates alarm actions so the check passes
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      MetricName: <example_metric_name>
      Namespace: <example_metric_namespace>
      Period: 60
      Statistic: Average
      Threshold: 1

Other

1Open the CloudWatch console
2Go to Alarms > All alarms and select the alarm
3Choose Actions > Alarm actions - new > Enable
4Confirm to activate actions

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
    cloudwatch_client,
)


class cloudwatch_alarm_actions_enabled(Check):
    def execute(self):
        findings = []
        if cloudwatch_client.metric_alarms is not None:
            for metric_alarm in cloudwatch_client.metric_alarms:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=metric_alarm
                )
                report.status = "PASS"
                report.status_extended = (
                    f"CloudWatch metric alarm {metric_alarm.name} has actions enabled."
                )
                if not metric_alarm.actions_enabled:
                    report.status = "FAIL"
                    report.status_extended = f"CloudWatch metric alarm {metric_alarm.name} does not have actions enabled."
                findings.append(report)
        return findings

References