CloudWatch metric alarm has actions configured for the ALARM state
cloudwatch_alarm_actions_alarm_state_configured
Amazon CloudWatch metric alarms are evaluated for actions configured for the ALARM state. The finding flags alarms that have no action to execute when their monitored metric crosses its threshold.
Risk
Without an ALARM action, threshold breaches trigger no notification or automated response. This delays detection and containment, risking:
- Availability: prolonged outages or missed scale-out
- Integrity/confidentiality: unchecked anomalies enabling tampering or data loss
prowler aws --checks cloudwatch_alarm_actions_alarm_state_configured
Recommendation
Assign at least one ALARM-state action per alarm (e.g., notify via SNS or run automated remediation with Lambda/SSM). Keep actions enabled, apply least privilege to targets, and regularly test. For critical metrics, add redundant paths (EventBridge) for defense in depth.
Remediation
aws cloudwatch put-metric-alarm --alarm-name <alarm-name> --metric-name <metric-name> --namespace <namespace> --statistic <statistic> --period <period-seconds> --evaluation-periods <evaluation-periods> --threshold <threshold> --comparison-operator <comparison-operator> --alarm-actions <action-arn>
- Open the AWS Console and go to CloudWatch > Alarms
- Select the target alarm and choose Edit (or Modify alarm)
- In Actions, under When alarm state is ALARM, add an action (e.g., select an SNS topic or other supported action)
- Click Save changes
Source Code
Resource Type
AwsCloudWatchAlarm
References
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-actions
- https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudwatch/client/put_metric_alarm.html
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm
- https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html#cloudwatch-15
- https://support.icompaas.com/support/solutions/articles/62000233431-ensure-cloudwatch-alarms-have-specified-actions-configured-for-the-alarm-state
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudWatch/cloudwatch-alarm-action.html
- https://awscli.amazonaws.com/v2/documentation/api/2.0.34/reference/cloudwatch/put-metric-alarm.html