Integrations
AWS CloudWatch
EvoHub receives CloudWatch alarms through an Amazon SNS topic with an HTTPS subscription. An alarm that goes to ALARM opens an EvoHub alert; the same alarm returning to OK resolves it.
Set it up
Create the integration
In EvoHub, go to On-Call → Integrations → + Add Integration, choose AWS CloudWatch, pick an Escalation Policy and click Create Integration. Copy the Webhook URL.
Subscribe EvoHub to the topic
Add a subscription to the topic with Protocol HTTPS and Endpoint your webhook URL. Leave Raw message delivery off: EvoHub needs the SNS envelope to check its signature.
Note
EvoHub checks the SNS signature on every message against Amazon's signing certificate, so only messages that really come from Amazon SNS are accepted; anything else is refused with 403. If the certificate cannot be fetched at that moment, EvoHub answers 503 and SNS delivers the message again.
What EvoHub reads
| EvoHub alert | Taken from |
|---|---|
| Title | AlarmName (else the SNS subject). |
| Description | AlarmDescription, else NewStateReason. |
| Labels | state — the alarm's new state. |
Severity
| Alarm state | EvoHub severity |
|---|---|
ALARM |
critical |
INSUFFICIENT_DATA |
low |
OK |
resolves the alert |
INSUFFICIENT_DATA only reaches EvoHub if you also set the topic as the alarm's Insufficient data action; leave that action empty unless a metric that stops reporting should open a low alert.
Resolve and deduplication
An alert is identified by the AWS account, the region and the alarm name, so identically named alarms in two accounts or regions stay two alerts. While it is open, the alarm firing again is recorded as Retriggered instead of paging again; OK resolves it. One SNS topic can carry any number of alarms.
CloudTrail
CloudTrail activity — a root sign-in, logging turned off — pages through this same integration, with a metric filter and an alarm. See AWS CloudTrail.
Related
Was this page helpful?
