# Ensure CloudWatch Alarm Action Check

- Source: https://support.icompaas.com/support/solutions/articles/62000223682-ensure-cloudwatch-alarm-action-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

You can specify what actions an alarm takes when it changes state between the OK, ALARM, and INSUFFICIENT\_DATA states. The most common type of alarm action is to notify one or more people by sending a message to an Amazon Simple Notification Service topic. 

### **Rationale:**

A metric alarm has the following possible states:

-   `OK` – The metric or expression is within the defined threshold.
    
-   `ALARM` – The metric or expression is outside of the defined threshold.
    
-   `INSUFFICIENT_DATA` – The alarm has just started, the metric is not available, or not enough data is available for the metric to determine the alarm state.
    

### **Impact:**

Cloud Watch doesn't test or validate the actions that you specify, nor does it detect any Amazon EC2 Auto Scaling or Amazon SNS errors resulting from an attempt to invoke nonexistent actions. Make sure that your alarm actions exist.

### **Default Value:**

cloud watch alarm default value is disabled.

 **Pre-requisites:**

-   make sure at least one cloudwatch alarm exists
    

### **Audit:**

1.  Open the Cloud Watch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/").
    
2.  In the navigation pane, choose **Alarms**, **All alarms**.
    
3.  Choose to **Create an alarm**.![](https://support.icompaas.com/assets/kb/d583beac423a4ea9.png)
    
4.  Choose **Select Metric**. ![](https://support.icompaas.com/assets/kb/94c2c9970cb81bc0.png) 
    
5.   In the **Metric Name** column, verify each alarm available for the **EC2instance**  metric parameter name. If the **EC2 instance** metric is not used by any of your existing alarms, the configuration changes made to your EC2 are **not monitored** using Amazon Cloud Watch![](https://support.icompaas.com/assets/kb/bed060d9f074e758.png)

  

### **Remediation:**

### **Implementation Steps:**

**Step 1:**Open the Cloud Watch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/").

**Step 2**:In the navigation pane, choose **Alarms**, **All alarms**.

**Step 03:**Choose **Create alarm**.

**Step 04:**Choose **Select Metric**. ![](https://support.icompaas.com/assets/kb/afc87bc100730d6e.png) 

**Step 05**: After selecting metric, you can select **define alarm** ![](https://support.icompaas.com/assets/kb/de2be6d9e474de6a.png) 

**Step 06:**:In the **Actions** section, click the  **Notification** button, select **State is ALARM** from the **Whenever this alarm** dropdown menu, and choose the AWS SNS topic name created at **Step 1** from **Send notification** to. ![](https://support.icompaas.com/assets/kb/21e6106625104e1d.png) 

**Step07:**In the **Alarm Preview** section, select **Minutes** from the **Period** dropdown list and **Sum** from the **Statistic** list. ![](https://support.icompaas.com/assets/kb/5531ea1a81b70e5c.png) 

**Step 08**:Review the Cloud Watch alarm configuration details then click **Create Alarm**.  

### **Using AWS CLI:**

This command is used to describe the Cloudwatch metrics

aws cloudwatch describe-alarms-for-metric
    --region us-east-1
    --metric-name EC2 Intances EventCount
    --namespace CloudTrailMetrics

  

### **Back out Plan:**

If you want to remove or delete then to select the metric, follow the below steps:

1.  Open the Cloud Watch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/")
    
2.  In the navigation pane, choose **Alarms**.
    
3.  Select the check box to the left of the name of the alarm, and choose **Actions**, choose **Delete**.
    

  

**Reference**

[![](https://support.icompaas.com/assets/kb/0d2f76df4e6197aa.png)Create a CloudWatch alarm based on a static threshold - Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ConsoleAlarms.html) 

[![](https://support.icompaas.com/assets/kb/85096c3fd31bfd07.png)Using Amazon CloudWatch alarms - Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.