Question

我在CloudWatch警报状态更改上触发Cloudwatch规则时遇到问题。这是规则的事件模式。它不会向状态更改的SNS发送消息。

{
  "detail-type": [
    "CloudWatch Alarm State Change"
  ],
  "resources": [
    !Sub "arn:aws:cloudwatch:${AWS:Region}:${AWS:AccountId}:alarm:Admin dead"
  ],
  "source": [
    "aws.cloudwatch"
  ],
  "detail": {
    "state": [
      "ALARM"
    ]
  }
}

警报本身正常工作，并并行向SNS发送消息。另外，如果我要删除此部分：

"detail": {
    "state": [
      "ALARM"
    ]
  }

然后，该规则对每个状态更改均适用。但我只需要将其更改为“处于警报状态”（因为它显示在用户界面中）。

谢谢您的建议

Answer 1

调试此问题的好方法是删除“详细信息”部分，并使用电子邮件或lambda函数或类似功能订阅SNS主题，以查看实际的警报事件内容。

看起来您的“详细信息”规则缺少“值”参数，以下规则有效：

{
    "source": [
        "aws.cloudwatch"
    ],
    "detail-type": [
        "CloudWatch Alarm State Change"
    ],
    "detail": {
        "state": {
            "value": [
                "ALARM"
            ]
        }
    }
}

根据this，示例事件如下：

{
  "version": "0",
  "id": "2dde0eb1-528b-d2d5-9ca6-6d590caf2329",
  "detail-type": "CloudWatch Alarm State Change",
  "source": "aws.cloudwatch",
  "account": "123456789012",
  "time": "2019-10-02T17:20:48Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:cloudwatch:us-east-1:123456789012:alarm:TotalNetworkTrafficTooHigh"
  ],
  "detail": {
    "alarmName": "TotalNetworkTrafficTooHigh",
    "configuration": {
      "description": "Goes into alarm if total network traffic exceeds 10Kb",
      "metrics": [...]
    },
    "previousState": {
      "reason": "Unchecked: Initial alarm creation",
      "timestamp": "2019-10-02T17:20:03.642+0000",
      "value": "INSUFFICIENT_DATA"
    },
    "state": {
      "reason": "Threshold Crossed: 1 out of the last 1 datapoints [45628.0 (02/10/19 17:10:00)] was greater than the threshold (10000.0) (minimum 1 datapoint for OK -> ALARM transition).",
      "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-02T17:20:48.551+0000\",\"startDate\":\"2019-10-02T17:10:00.000+0000\",\"period\":300,\"recentDatapoints\":[45628.0],\"threshold\":10000.0}",
      "timestamp": "2019-10-02T17:20:48.554+0000",
      "value": "ALARM"
    }
  }
}

Answer 2

下面的技巧对我有用。我想通过云监视规则获取所有处于警报状态的警报。

{
    "source": [
        "aws.cloudwatch"
    ],
    "detail-type": [
        "CloudWatch Alarm State Change"
    ],
    "detail": {
        "state": {
            "value": [
                "ALARM"
            ]
        }
    }
}

AWS。 Cloudwatch触发警报状态更改的规则

2 个答案: