CloudWatch alarm has actions for the ALARM state

Check ID: cloudwatch_alarm_actions_alarm_state_configured
Provider: AWS
Service: cloudwatch
Severity: HIGH
Categories: resilience
Resource type: AwsCloudWatchAlarm

What this check verifies

Amazon CloudWatch metric alarms are evaluated for actions configured for the ALARM state. The finding flags alarms that have no action to execute when their monitored metric crosses its threshold.

Risk

Without an ALARM action, threshold breaches trigger no notification or automated response. This delays detection and containment, risking:

Availability: prolonged outages or missed scale-out
Integrity/confidentiality: unchecked anomalies enabling tampering or data loss

Recommendation

Assign at least one ALARM-state action per alarm (e.g., notify via SNS or run automated remediation with Lambda/SSM). Keep actions enabled, apply least privilege to targets, and regularly test. For critical metrics, add redundant paths (EventBridge) for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudwatch put-metric-alarm —alarm-name <alarm-name> —metric-name <metric-name> —namespace <namespace> —statistic <statistic> —period <period-seconds> —evaluation-periods <evaluation-periods> —threshold <threshold> —comparison-operator <comparison-operator> —alarm-actions <action-arn>

# Terraform: add an ALARM action to a metric alarm
resource "aws_cloudwatch_metric_alarm" "<example_resource_name>" {
  alarm_name          = "<example_resource_name>"
  metric_name         = "<metric-name>"
  namespace           = "<namespace>"
  statistic           = "Average"
  period              = 60
  evaluation_periods  = 1
  threshold           = 1
  comparison_operator = "GreaterThanThreshold"
  alarm_actions       = ["<action-arn>"] # CRITICAL: ensures an action is configured for ALARM state
}

# CloudFormation: add an ALARM action to a metric alarm
Resources:
  <example_resource_name>:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: <example_resource_name>
      MetricName: <metric-name>
      Namespace: <namespace>
      Statistic: Average
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - <action-arn>  # CRITICAL: adds an action for ALARM state so the check passes

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_alarm_actions_alarm_state_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

No privilege escalation activity in CloudTrail CloudWatch metric alarm has actions enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires