cloudwatch-log-alarm-lambda-remediation-cdk: Log-based alarm with auto-remediation#3228
Open
NithinChandranR-AWS wants to merge 1 commit into
Conversation
…ediation Deploy self-healing architecture using AWS::CloudWatch::LogAlarm (new CFN resource, July 2026). Logs Insights query counts ERROR messages every 5 minutes, triggers alarm when threshold breached, Amazon SNS fans out to AWS Lambda which runs remediation via AWS Systems Manager RunCommand on tagged Amazon EC2 instances. Eliminates the 3-resource MetricFilter workaround — single LogAlarm resource replaces MetricFilter + Metric + Standard Alarm. 5 services composed: Amazon CloudWatch Logs, Log Alarm, Amazon SNS, AWS Lambda, AWS Systems Manager.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Monitor application logs with Amazon CloudWatch Logs Insights queries and auto-remediate via AWS Lambda and AWS Systems Manager when error thresholds are breached.
Key Innovation
Uses the new
AWS::CloudWatch::LogAlarmCloudFormation resource (GA July 2026) which eliminates the traditional 3-resource workaround (MetricFilter + Metric + Standard Alarm). A single LogAlarm resource runs a Logs Insights query on schedule and evaluates results against a threshold directly.Architecture
Amazon CloudWatch Logs → Amazon CloudWatch Log Alarm (Logs Insights query, 5-min schedule) → Amazon SNS → AWS Lambda (remediation) → AWS Systems Manager RunCommand
How it works
filter @message like /ERROR/ | stats count(*)every 5 minutesDeployed and Tested
Stack deploys in us-east-1 (~50s). Full notification chain verified:
AutoRemediate=true