# Build CloudWatch alarms in Incident Detection and Response with CloudFormation templates
<a name="idr-create-alarms-with-cfn"></a>

To accelerate onboarding to AWS Incident Detection and Response, and to reduce the effort needed to build alarms, AWS provides you with CloudFormation templates. These templates include optimized alarm settings for commonly onboarded services, such as Application Load Balancer, Network Load Balancer, and Amazon CloudFront.

**Build CloudWatch alarms with CloudFormation templates**

1. Download a template using the provided links:    
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/IDR/latest/userguide/idr-create-alarms-with-cfn.html)

1. Review the downloaded JSON file to make sure that it meets your organization's operation and security processes.

1. Create a CloudFormation stack:
**Note**  
The following steps use the standard CloudFormation stack creation process. For detailed steps, see [Creating a stack on the CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html).

   1. Open the AWS CloudFormation console at [https://console.aws.amazon.com/cloudformation](https://console.aws.amazon.com/cloudformation/).

   1. Choose **Create stack**.

   1. Choose **Template is ready**, and then upload the template file from your local folder.

      The following is an example of the **Create stack** screen.  
![\[Create stack upload template file example\]](http://docs.aws.amazon.com/IDR/latest/userguide/images/create-cfn-stack1.png)

   1. Choose **Next**.

   1. Enter the following required information:
      + **AlarmNameConfig** and **AlarmDescriptionConfig**: Enter a name and description for your alarm.
      + **ThresholdConfig**: Revise the threshold value to meet your application's requirements.
      + **DistributionIDConfig**: Make sure that the distribution ID point to the correct resources in the account that you're creating the CloudFormation stack in.

   1. Choose **Next**.

   1. Review the default values in the **PeriodConfig**, **EvalutionPeriodConfig**, and **DatapointsToAlarmConfig** fields. It's a best practice to use the default values for these fields. You can make adjustments, if needed, to meet your application's requirements.

   1. Optionally enter tags and SNS notification information as needed. It's a best practice to turn on **Termination protection**to prevent accidental deletion of the alarm. To turn on termination protection, select the **Activated** radio button, as shown in the following example:  
![\[Create stack activate termination protection example\]](http://docs.aws.amazon.com/IDR/latest/userguide/images/create-cfn-stack2.png)

   1. Choose **Next**.

   1. Review your stack settings, and then choose **Create stack**.

   1. After you create the stack, you see the alarm listed in the Amazon CloudWatch **Alarm** list, as shown in the following example:  
![\[Example CloudWatch alarm list\]](http://docs.aws.amazon.com/IDR/latest/userguide/images/create-cfn-stack3.png)

1. After you create all of your alarms in the correct account and AWS Region, notify your Technical Account Manager (TAM). The AWS Incident Detection and Response team reviews the status of your new alarms, and then continues your onboarding.