CloudWatch metric alarm has actions enabled

Check ID: cloudwatch_alarm_actions_enabled
Provider: AWS
Service: cloudwatch
Severity: HIGH
Categories: resilience
Resource type: AwsCloudWatchAlarm

What this check verifies

CloudWatch metric alarms are evaluated for alarm actions activation (actions_enabled: true), enabling state changes to invoke configured notifications or automated responses.

Risk

With alarm actions disabled, state changes neither notify nor remediate. Incidents can persist unnoticed, enabling unauthorized activity, configuration drift, or capacity exhaustion. Visibility drops, MTTR rises, and confidentiality, integrity, and availability are all at greater risk.

Recommendation

Enable actions_enabled on critical alarms and attach least-privilege actions (SNS, automation) for ALARM and recovery states. Use redundant targets, regularly test notifications, and integrate with incident response. Apply defense in depth with complementary detections to ensure timely, reliable alerting.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudwatch enable-alarm-actions —alarm-names <alarm-name>

resource "aws_cloudwatch_metric_alarm" "<example_resource_name>" {
  alarm_name          = "<example_resource_name>"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "<example_metric_name>"
  namespace           = "<example_metric_namespace>"
  period              = 60
  statistic           = "Average"
  threshold           = 1

  actions_enabled = true  # FIX: activates alarm actions so the check passes
}

Resources:
  <example_resource_name>:
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: true  # FIX: activates alarm actions so the check passes
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      MetricName: <example_metric_name>
      Namespace: <example_metric_namespace>
      Period: 60
      Statistic: Average
      Threshold: 1

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_alarm_actions_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudWatch alarm has actions for the ALARM state Metric filter and alarm exist for Network ACL changes

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires