AWS logo
Amazon QDetector Library

Setup Cloudformation Alarms High

Cloudwatch alarms notifies if capacity limits are approaching or if throttling occurs. Make Sure that DatapointsToAlarm and Threshold is set.

Detector ID
cloudformation/checkov-custom-setup-cloudwatch-alarms@v1.0
Category
Common Weakness Enumeration (CWE) external icon
-

Noncompliant example

1Resources:
2  NonCompliantReadCapacityAlarm:
3    Type: AWS::CloudWatch::Alarm
4    Properties:
5      # Noncompliant: `DatapointsToAlarm` is missing.
6      AlarmName: !Sub '${TableName}-NonCompliantReadCapacity'
7      MetricName: ConsumedReadCapacityUnits
8      Namespace: AWS/DynamoDB
9      Statistic: Sum
10      Period: 60
11      EvaluationPeriods: 1
12      Threshold: 95
13      AlarmDescription: "Non-compliant alarm for read capacity monitoring"
14      ComparisonOperator: GreaterThanThreshold
15      Dimensions:
16        - Name: TableName
17          Value: !Ref TableName
18      AlarmActions:
19        - !Ref NonCompliantMonitoringTopic
20      TreatMissingData: ignore

Compliant example

1Resources:
2  CompliantReadCapacityAlarm:
3    Type: AWS::CloudWatch::Alarm
4    Properties:
5      AlarmName: !Sub '${TableName}-CompliantReadCapacity'
6      MetricName: ConsumedReadCapacityUnits
7      Namespace: AWS/DynamoDB
8      Statistic: Sum
9      Period: 300
10      EvaluationPeriods: 2
11      # Compliant: `DatapointsToAlarm` and `Threshold` are set.
12      DatapointsToAlarm: 2
13      Threshold: 80
14      AlarmDescription: "Compliant alarm for read capacity monitoring"
15      ComparisonOperator: GreaterThanThreshold
16      Dimensions:
17        - Name: TableName
18          Value: !Ref TableName
19      AlarmActions:
20        - !Ref CompliantMonitoringTopic
21      InsufficientDataActions:
22        - !Ref CompliantMonitoringTopic
23      OKActions:
24        - !Ref CompliantMonitoringTopic
25      TreatMissingData: breaching