600 Reference 080807b8

AWS CloudFormation CloudWatch - Detailed Reference

Table of Contents

• CloudWatch Resources
• Common Properties
• Alarm Configuration
• Dashboard Widgets
• Log Group Configuration
• Metric Properties

CloudWatch Resources

AWS::CloudWatch::Alarm

Main resource for creating CloudWatch alarms.

Main Properties

ComparisonOperator Values

ComparisonOperator:
  - GreaterThanThreshold
  - GreaterThanOrEqualToThreshold
  - LessThanThreshold
  - LessThanOrEqualToThreshold
  - GreaterThanUpperBound
  - LessThanLowerBound

TreatMissingData Values

TreatMissingData:
  # Treat as breaching (alarm goes to ALARM)
  - breaching
  # Treat as not breaching (alarm goes to OK)
  - notBreaching
  # Treat as missing (alarm goes to INSUFFICIENT_DATA)
  - missing
  # Maintain current state
  - ignore

Complete Example

Resources:
  CompleteAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: production-error-alarm
      AlarmDescription: Alert on production errors exceeding threshold
      MetricName: Errors
      Namespace: MyApplication/Production
      Dimensions:
        - Name: Service
          Value: api-service
        - Name: Region
          Value: us-east-1
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 5
      DatapointsToAlarm: 3
      Threshold: 10
      ComparisonOperator: GreaterThanThreshold
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmTopic
        - !Ref PagerDutyTopic
      InsufficientDataActions:
        - !Ref AlarmTopic
      OKActions:
        - !Ref RecoveryTopic
      Tags:
        - Key: Environment
          Value: production
        - Key: Severity
          Value: critical

AWS::CloudWatch::CompositeAlarm

Combines multiple alarms into a single logical expression.

Properties

AlarmRule Operators

AlarmRule: !Or
  - !Ref Alarm1
  - !Ref Alarm2
  - !And
    - !Ref Alarm3
    - !Ref Alarm4
  - !Not
    - !Ref Alarm5

AWS::CloudWatch::AnomalyDetector

Configures anomaly detection for metrics.

Properties

Configuration

Configuration:
  ExcludedTimeRanges:
    - StartTime: "2023-12-25T00:00:00"
      EndTime: "2023-12-26T00:00:00"
  MetricTimeZone: UTC

AWS::CloudWatch::Dashboard

Creates CloudWatch dashboards for metric visualization.

DashboardBody Structure

DashboardBody:
  "start": "-PT6H"
  "end": "P0D"
  "widgets": [
    {
      "type": "metric",
      "x": 0,
      "y": 0,
      "width": 12,
      "height": 6,
      "properties": {
        "title": "Widget Title",
        "view": "timeSeries",
        "stacked": false,
        "region": "us-east-1",
        "metrics": [
          ["Namespace", "MetricName", "Dimension1", "Value1"],
          [".", ".", ".", "."]
        ],
        "period": 300,
        "stat": "Sum",
        "annotations": {
          "horizontal": [
            {
              "value": 100,
              "label": "Threshold",
              "color": "#ff7f0e"
            }
          ]
        }
      }
    }
  ]

View Types

view:
  - timeSeries    # Line chart
  - bar           # Bar chart
  - pie           # Pie chart
  - singleValue   # Single value display
  - table         # Tabular view

AWS::Logs::LogGroup

Creates CloudWatch log groups.

Properties

Retention Values

RetentionInDays:
  - 1        # 1 day
  - 3        # 3 days
  - 5        # 5 days
  - 7        # 1 week
  - 14       # 2 weeks
  - 30       # 1 month
  - 60       # 2 months
  - 90       # 3 months
  - 120      # 4 months
  - 150      # 5 months
  - 180      # 6 months
  - 365      # 1 year
  - 400      # 13 months
  - 545      # 18 months
  - 731      # 2 years
  - 1095     # 3 years
  - 1827     # 5 years
  - 2190     # 6 years
  - 2555     # 7 years
  - 2922     # 8 years
  - 3285     # 9 years
  - 3650     # 10 years

AWS::Logs::MetricFilter

Extracts metrics from log patterns.

Properties

MetricTransformation

MetricTransformations:
  - MetricValue: "1"
    MetricNamespace: MyApp/Logs
    MetricName: ErrorCount
    DefaultValue: 0.0

AWS::Logs::SubscriptionFilter

Sends logs to external destinations (Kinesis, Lambda, ES).

Properties

AWS::Logs::QueryDefinition

Saves Log Insights queries.

Properties

AWS::Synthetics::Canary

Creates synthesized canaries for synthetic monitoring.

Properties

Runtime Versions

RuntimeVersion:
  - syn-python-selenium-1.1
  - syn-python-selenium-1.0
  - syn-nodejs-puppeteer-6.0
  - syn-nodejs-puppeteer-5.0
  - syn-nodejs-puppeteer-4.0

Schedule Expression

Schedule:
  Expression: "rate(5 minutes)"
  DurationInSeconds: 120

AWS::CloudWatch::ServiceLevelIndicator

Defines SLI for service health.

Properties

AWS::CloudWatch::ServiceLevelObjective

Defines SLO based on SLI.

Properties

AWS::CloudWatch::ApplicationMonitor

Configures Application Signals for APM.

Properties

Common Properties

Dimensions

Dimensions:
  - Name: DimensionName1
    Value: DimensionValue1
  - Name: DimensionName2
    Value: DimensionValue2

Tags

Tags:
  - Key: Environment
    Value: production
  - Key: Service
    Value: api
  - Key: CostCenter
    Value: engineering

Alarm Configuration

Statistic Types

Statistic:
  - SampleCount    # Number of datapoints
  - Average        # Average
  - Sum            # Sum
  - Minimum        # Minimum
  - Maximum        # Maximum

Extended Statistics

ExtendedStatistic: "p99"        # 99th percentile
ExtendedStatistic: "p95"        # 95th percentile
ExtendedStatistic: "p50"        # Median
ExtendedStatistic: "tc99"       # Trimmed mean 99%
ExtendedStatistic: "wm99"       # Winsorized mean 99%

Metric Selectors

# Single metric
MetricName: Errors
Namespace: AWS/Lambda

# Multiple metrics with dimensions
metrics:
  - ["AWS/Lambda", "Invocations", "FunctionName", "MyFunction"]
  - [".", "Errors", ".", "."]
  - [".", "Duration", ".", ".", {"stat": "p99"}]

# Math expression
metrics:
  - ["AWS/Lambda", "Errors", "FunctionName", "MyFunction"]
  - [".", "Invocations", ".", "."]
  - expression: Errors / Invocations * 100
    label: Error Rate (%)
    id: errorRate

Dashboard Widgets

Metric Widget

{
  "type": "metric",
  "x": 0,
  "y": 0,
  "width": 12,
  "height": 6,
  "properties": {
    "title": "API Gateway Metrics",
    "view": "timeSeries",
    "stacked": false,
    "region": "us-east-1",
    "metrics": [
      ["AWS/ApiGateway", "Count", "ApiName", "MyApi", "Stage", "prod"]
    ],
    "period": 300,
    "stat": "Sum",
    "legend": {
      "position": "bottom"
    },
    "liveData": true,
    "annotations": {
      "horizontal": [
        {
          "value": 1000,
          "label": "Warning Threshold",
          "color": "#ff7f0e"
        }
      ],
      "vertical": [
        {
          "value": "2023-12-31T00:00:00Z",
          "label": "Deployment",
          "color": "#2ca02c"
        }
      ]
    }
  }
}

Text Widget

{
  "type": "text",
  "x": 0,
  "y": 0,
  "width": 12,
  "height": 3,
  "properties": {
    "markdown": "# Production Dashboard\nLast updated: `date`"
  }
}

Log Widget

{
  "type": "log",
  "x": 0,
  "y": 12,
  "width": 24,
  "height": 6,
  "properties": {
    "title": "Application Errors",
    "view": "table",
    "region": "us-east-1",
    "logGroupName": "/aws/applications/prod/app",
    "timeRange": {
      "type": "relative",
      "from": 3600
    },
    "filterPattern": "ERROR | WARN",
    "columns": ["@timestamp", "@message", "@logStream"]
  }
}

Alarm Status Widget

{
  "type": "alarm",
  "x": 0,
  "y": 0,
  "width": 6,
  "height": 6,
  "properties": {
    "title": "Alarm Status",
    "alarms": [
      "arn:aws:cloudwatch:us-east-1:123456789:alarm:ErrorAlarm",
      "arn:aws:cloudwatch:us-east-1:123456789:alarm:LatencyAlarm"
    ]
  }
}

Log Group Configuration

Retention Policy Examples

# Development - short retention
DevLogGroup:
  Type: AWS::Logs::LogGroup
  Properties:
    LogGroupName: /aws/applications/dev/app
    RetentionInDays: 7

# Production - long retention
ProdLogGroup:
  Type: AWS::Logs::LogGroup
  Properties:
    LogGroupName: /aws/applications/prod/app
    RetentionInDays: 90
    KmsKeyId: !Ref ProdLogKmsKey

Encryption Configuration

Resources:
  EncryptedLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/applications/prod/encrypted
      RetentionInDays: 30
      KmsKeyId: !Ref LogEncryptionKey

  LogEncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Key for log encryption
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: logs.us-east-1.amazonaws.com
            Action:
              - kms:Encrypt*
              - kms:Decrypt*
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:Describe*
            Resource: "*"
            Condition:
              ArnEquals:
                aws:SourceArn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*"

Metric Properties

Common Namespace Patterns

Namespace:
  # AWS services
  - AWS/Lambda
  - AWS/ApiGateway
  - AWS/EC2
  - AWS/RDS
  - AWS/ECS
  - AWS/EKS
  - AWS/DynamoDB
  - AWS/S3
  - AWS/SNS
  - AWS/SQS
  - AWS/ElastiCache
  - AWS/ElasticLoadBalancing

  # Custom namespaces
  - MyApplication/Production
  - MyService/Metrics
  - CustomMetrics/Business

Common Metric Names

MetricName:
  # Lambda
  - Invocations
  - Errors
  - Throttles
  - Duration
  - ConcurrentExecutions
  - UnreservedConcurrentExecutions

  # API Gateway
  - Count
  - Latency
  - 4XXError
  - 5XXError
  - IntegrationLatency
  - CacheHitCount
  - CacheMissCount

  # EC2
  - CPUUtilization
  - NetworkIn
  - NetworkOut
  - DiskReadOps
  - DiskWriteOps
  - StatusCheckFailed

  # RDS
  - DatabaseConnections
  - ReadLatency
  - WriteLatency
  - ReadIOPS
  - WriteIOPS
  - FreeStorageSpace
  - CPUUtilization

  # Custom
  - RequestCount
  - ErrorCount
  - SuccessCount
  - Latency
  - ResponseSize
  - QueueSize
  - ProcessingTime

Nested Stack References

Cross-Stack Import

# Import from network stack
Parameters:
  NetworkStackName:
    Type: String
    Description: Network stack name

Resources:
  # Import VPC ID
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !ImportValue
        !Sub "${NetworkStackName}-VPCId"
      GroupDescription: Security group for monitoring

# Import log group name
LogGroupName:
  Fn::ImportValue:
    !Sub "${MonitoringStackName}-LogGroupName"

Condition Functions

Intrinsic Functions

Conditions:
  IsProduction: !Equals [!Ref Environment, production]
  IsStaging: !Equals [!Ref Environment, staging]
  EnableAnomaly: !Not [!Equals [!Ref Environment, dev]]
  CreateAlarms: !Or [!Equals [!Ref Environment, staging], !Equals [!Ref Environment, production]]

Resources:
  ProdAlarm:
    Condition: IsProduction
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: prod-errors
      MetricName: Errors
      Namespace: MyApp
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 3
      Threshold: 1
      ComparisonOperator: GreaterThanThreshold

Best Practices Summary

Alarm Configuration

Log Retention

Dashboard Design

• Use 6-hour default time range for operational dashboards
• Group related metrics in widgets
• Add threshold annotations for critical values
• Use alarm status widgets for quick health check
• Limit widgets per dashboard for performance