Check provider logo

CloudWatch metric alarm has actions enabled

cloudwatch_alarm_actions_enabled

Severityhigh
Servicecloudwatch
by Prowler
resilience

CloudWatch metric alarms are evaluated for alarm actions activation (actions_enabled: true), enabling state changes to invoke configured notifications or automated responses.

Risk

With alarm actions disabled, state changes neither notify nor remediate. Incidents can persist unnoticed, enabling unauthorized activity, configuration drift, or capacity exhaustion. Visibility drops, MTTR rises, and confidentiality, integrity, and availability are all at greater risk.

Run this check with Prowler CLI

prowler aws --checks cloudwatch_alarm_actions_enabled

Run in Prowler Cloud

Recommendation

Enable actions_enabled on critical alarms and attach least-privilege actions (SNS, automation) for ALARM and recovery states. Use redundant targets, regularly test notifications, and integrate with incident response. Apply defense in depth with complementary detections to ensure timely, reliable alerting.

Remediation

CLI

aws cloudwatch enable-alarm-actions --alarm-names <alarm-name>

Native IaC
Terraform
Other
  1. Open the CloudWatch console
  2. Go to Alarms > All alarms and select the alarm
  3. Choose Actions > Alarm actions - new > Enable
  4. Confirm to activate actions

Source Code

Resource Type

AwsCloudWatchAlarm

References