AWS. Cloudwatch trigger Rule on Alarm state change - amazon-web-services

Question

I have an issue to trigger Cloudwatch Rule on CloudWatch Alarm State Change. This is an Event pattern for a Rule. It doesn't send a message to SNS of state change.
{
"detail-type": [
"CloudWatch Alarm State Change"
],
"resources": [
!Sub "arn:aws:cloudwatch:${AWS:Region}:${AWS:AccountId}:alarm:Admin dead"
],
"source": [
"aws.cloudwatch"
],
"detail": {
"state": [
"ALARM"
]
}
}
The Alarm itself works properly and send a message to SNS in parallel. Also if I will remove this part:
"detail": {
"state": [
"ALARM"
]
}
then the Rule works properly for each state change. But I need only on it's changed to "In alarm" (as it's displayed in UI).
Thanks for any advise

Answer 1

A good way to debug this would be to remove the "detail" part, and subscribe to the SNS topic with email or a lambda function or similar to see the actual alarm event content.
Looks like your rule for "detail" is missing "value" parameter, the following rule works:
{
"source": [
"aws.cloudwatch"
],
"detail-type": [
"CloudWatch Alarm State Change"
],
"detail": {
"state": {
"value": [
"ALARM"
]
}
}
}
According to this, an example event looks like:
{
"version": "0",
"id": "2dde0eb1-528b-d2d5-9ca6-6d590caf2329",
"detail-type": "CloudWatch Alarm State Change",
"source": "aws.cloudwatch",
"account": "123456789012",
"time": "2019-10-02T17:20:48Z",
"region": "us-east-1",
"resources": [
"arn:aws:cloudwatch:us-east-1:123456789012:alarm:TotalNetworkTrafficTooHigh"
],
"detail": {
"alarmName": "TotalNetworkTrafficTooHigh",
"configuration": {
"description": "Goes into alarm if total network traffic exceeds 10Kb",
"metrics": [...]
},
"previousState": {
"reason": "Unchecked: Initial alarm creation",
"timestamp": "2019-10-02T17:20:03.642+0000",
"value": "INSUFFICIENT_DATA"
},
"state": {
"reason": "Threshold Crossed: 1 out of the last 1 datapoints [45628.0 (02/10/19 17:10:00)] was greater than the threshold (10000.0) (minimum 1 datapoint for OK -> ALARM transition).",
"reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-02T17:20:48.551+0000\",\"startDate\":\"2019-10-02T17:10:00.000+0000\",\"period\":300,\"recentDatapoints\":[45628.0],\"threshold\":10000.0}",
"timestamp": "2019-10-02T17:20:48.554+0000",
"value": "ALARM"
}
}
}

Answer 2

below trick worked for me.I wanted to fetch all the alerts are in alarm state by cloud watch rule.
{
"source": [
"aws.cloudwatch"
],
"detail-type": [
"CloudWatch Alarm State Change"
],
"detail": {
"state": {
"value": [
"ALARM"
]
}
}
}