# CloudWatch
AWS Systems Manager Automation provides predefined runbooks for Amazon CloudWatch. For more information about runbooks, see [Working with runbooks](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-documents.html). For information about how to view runbook content, see [View runbook content](automation-runbook-reference.md#view-automation-json).
**Topics**
+ [`AWS-ConfigureCloudWatchOnEC2Instance`](automation-aws-configurecloudwatchonec2instance.md)
+ [`AWS-EnableCWAlarm`](enable-cw-alarm.md)
+ [`AWSSupport-TroubleshootCloudWatchAgent`](automation-aws-troubleshootcloudwatchagent.md)
+ [`AWSSupport-TroubleshootCloudWatchAlarm`](automation-awssupport-troubleshoot-cloudwatchalarm.md)
# `AWS-ConfigureCloudWatchOnEC2Instance`
**Description**
Enable or disable Amazon CloudWatch detailed monitoring on managed instances.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWS-ConfigureCloudWatchOnEC2Instance)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Linux, macOS, Windows
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Optional) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses the permissions of the user that starts this runbook.
+ InstanceId
Type: String
Description: (Required) The ID of the Amazon EC2 instance on which you want to enable CloudWatch monitoring.
+ properties
Type: String
Description: (Optional) This parameter is not supported. It is listed here for backwards compatibility.
+ status
Valid values: Enabled \$1 Disabled
Description: (Optional) Specifies whether to enable or disable CloudWatch.
Default: Enabled
**Document Steps**
configureCloudWatch - Configures CloudWatch on the Amazon EC2 instance with the given status.
**Outputs**
This automation has no output.
# `AWS-EnableCWAlarm`
**Description**
The `AWS-EnableCWAlarm` runbook creates Amazon CloudWatch (CloudWatch) alarms for AWS resources in your AWS account that do not already have one. CloudWatch alarms are created for the following AWS resources:
+ Amazon Elastic Compute Cloud (Amazon EC2) instances
+ Amazon Elastic Block Store (Amazon EBS) volumes
+ Amazon Simple Storage Service (Amazon S3) buckets
+ Amazon Relational Database Service (Amazon RDS) clusters
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWS-EnableCWAlarm)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Linux, macOS, Windows
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Optional) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses the permissions of the user that starts this runbook.
+ ComparisonOperator
Type: String
Valid values: GreaterThanOrEqualToThreshold \$1 GreaterThanThreshold \$1 GreaterThanUpperThreshold \$1 LessThanLowerOrGreaterThanUpperThreshol \$1 LessThanLowerThreshold \$1 LessThanOrEqualToThreshold \$1 LessThanThreshold
Description: (Required) The arithmetic operation to use when comparing the specified statistic and threshold.
+ MetricName
Type: String
Description: (Required) The name for the metric associated with the alarm.
+ Period
Type: Integer
Valid values: 10 \$1 30 \$1 60 \$1 A multiple of 60
Description: (Required) The period, in seconds, over which the statistic is applied.
+ ResourceARNs
Type: StringList
Description: (Required) A comma separated list of ARNs of the resources to create a CloudWatch alarm for
+ Statistic
Type: String
Valid values: Average \$1 Maximum \$1 Minimum \$1 SampleCount \$1 Sum
Description: (Required) The statistic for the metric associated with the alarm.
+ Threshold
Type: Integer
Description: (Required) The value to compare with the specified statistic.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `cloudwatch:PutMetricAlarm`
**Document Steps**
+ `aws:executeScript` - Creates a CloudWatch alarm according to the values specified in the runbook parameters for the resources you specify in the `ResourceARNs` parameter .
**Outputs**
EnableCWAlarm.FailedResources: A maplist of resource ARNs for which a CloudWatch alarm was not created and the reason for the failure.
EnableCWAlarm.SuccessfulResources: A list of resource ARNs for which a CloudWatch alarm was successfully created.
# `AWSSupport-TroubleshootCloudWatchAgent`
**Description**
The **AWSSupport-TroubleshootCloudWatchAgent** runbook automates troubleshooting the Amazon CloudWatch Agent on your Amazon Elastic Compute Cloud (Amazon EC2) instances. The runbook performs this troubleshooting through a series of basic, and (optional) extended checks.
The basic checks include the following:
+ Check for an AWS Identity and Access Management (IAM) instance profile
+ Verify if the necessary Amazon CloudWatch Agent IAM permissions are attached to the Amazon EC2 instance
The extended checks are only performed if the Amazon EC2 instance ID provided is an Systems Manager managed instance. These extended checks include the following:
+ Check the status of the Amazon CloudWatch Agent on the instance
+ Analyze the logs of the Amazon CloudWatch Agent for common issues and relevant troubleshooting steps
+ Zip the relevant logs and configuration files on the Amazon EC2 instance and optionally upload them to an Amazon Simple Storage Service (Amazon S3) bucket of your choosing
+ Perform a connectivity check between the instance and the required endpoints
**Important**
When the `RunVpcReachabilityAnalyzer` parameter is set to `true`, this runbook will determine if there is a need to call the child runbook, `AWSSupport-AnalyzeAWSEndpointReachabilityFromEC2`. The child runbook uses VPC Reachability Analyzer which has an associated cost. For more information on pricing, refer to the [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/) documentation.
**Important**
This runbook only checks your IAM instance profile role for the necessary permissions. If you instead rely on credentials defined in a `.aws/credentials` file, the results of the `verifyIamPermissions` step may be inaccurate.
**How does it work?**
The runbook performs the following steps:
+ **getInstanceProfile**: Verifies if the provided Amazon EC2 instance has an IAM instance profile attached.
+ **verifyIamPermissions**: Checks the instance profile associated with the instance to determine if the necessary IAM permissions are applied.
+ **getInstanceInformation**: Checks if the instance has an active Systems Manager agent, and fetches the OS type of the instance.
+ **getAgentStatus**: Checks the status of the Amazon CloudWatch Agent on the instance (extended check).
+ **analyzeLogs/analyzeLogsWindows**: Analyzes and outputs findings of Amazon CloudWatch Agent logs based on the OS type.
+ **collectLogs/collectLogsWindows**: Bundles and outputs the relevant Amazon CloudWatch Agent troubleshooting files based on the OS type.
+ **checkEndpointReachability/checkEndpointReachabilityWindows**: Checks if the instance can reach the required endpoints based on the OS type.
+ **analyzeAwsEndpointReachabilityFromEC2**: Calls the child automation runbook to check the reachability of the selected instance to the required endpoints (if enabled).
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSSupport-TroubleshootCloudWatchAgent)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
/
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ ec2:DescribeInstances
+ iam:GetInstanceProfile
+ iam:GetRole
+ iam:ListAttachedRolePolicies
+ iam:ListRolePolicies
+ iam:GetRolePolicy
+ iam:GetPolicy
+ iam:GetPolicyVersion
+ iam:SimulatePrincipalPolicy
+ ssm:DescribeInstanceInformation
+ ssm:SendCommand
+ ssm:GetCommandInvocation
+ ssm:DescribeInstanceAssociationsStatus
+ ssm:StartAutomationExecution
Example Policy:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"iam:GetInstanceProfile",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:GetRolePolicy",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:SimulatePrincipalPolicy",
"ssm:DescribeInstanceInformation",
"ssm:SendCommand",
"ssm:GetCommandInvocation",
"ssm:DescribeInstanceAssociationsStatus",
"ssm:StartAutomationExecution"
],
"Resource": "*"
}
]
}
```
**Instructions**
Follow these steps to configure the automation:
1. Navigate to [https://console.aws.amazon.com/systems-manager/documents/AWSSupport-TroubleshootCloudWatchAgent/description](https://console.aws.amazon.com/systems-manager/documents/AWSSupport-TroubleshootCloudWatchAgent/description) in Systems Manager under Documents.
1. Select **Execute automation.**
1. For the input parameters, enter the following:
+ **AutomationAssumeRole (Optional):**
+ Description: (Optional) The ARN of the IAM role that allows Systems Manager Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses the permissions of the user that starts this runbook.
+ Type: `AWS::IAM::Role::Arn`
+ **InstanceId (Required):**
+ Description: (Required) The ID of the Amazon EC2 instance you want to troubleshoot the Amazon CloudWatch Agent on.
+ Type: `AWS::EC2::Instance::Id`
+ Allow Pattern: `^i-[0-9a-f]{8,17}$`
+ **S3UploadBucket (Optional):**
+ Description: (Optional) The name of an Amazon S3 bucket to upload the collected Amazon CloudWatch Agent logs. The Amazon EC2 instance profile must have correct permissions to upload files to this bucket. This also requires the target Amazon EC2 instance to be an Systems Manager managed instance.
+ Type: `AWS::S3::Bucket::Name`
+ Allow Pattern: `^$|^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$`
+ Default: `""`
+ **S3BucketOwnerAccountId (Optional):**
+ Description: (Optional) The AWS Account Number that owns the Amazon S3 bucket where you want to upload the Amazon CloudWatch Agent logs. If you do not modify this parameter, the runbooks uses the AWS account ID of the user or role in which the Automation runs.
+ Type: `String`
+ Allow Pattern: `^\\{\\{ global:ACCOUNT_ID \\}\\}$|^[0-9]{12}$`
+ Default: `{{ global:ACCOUNT_ID }}`
+ **CheckEC2Endpoint (Optional):**
+ Description: (Optional) Specify `true` if your agent configuration uses the option `append_dimensions` to append Amazon EC2 metric dimensions to the metrics collected by the agent. When `append_dimensions` is used, the Amazon CloudWatch Agent requires connectivity to the Amazon EC2 API endpoint, so an additional connectivity tests will be performed via the extended checks.
+ Type: `String`
+ Allowed Values: `[true, false]`
+ Default: `false`
+ **RunVpcReachabilityAnalyzer (Optional):**
+ Description: (Optional) Specify `true` to run the `AWSSupport-AnalyzeAWSEndpointReachabilityFromEC2` child automation if a network issue is determined by the extended checks, or if the instance ID specified is not a managed instance.
+ Type: `Boolean`
+ Default: `false`
+ **RetainVpcReachabilityAnalysis (Optional):**
+ Description: (Optional) Only relevant if `RunVpcReachabilityAnalyzer` is `true`. Specify `true` to retain the network insight path and related analyses created by VPC Reachability Analyzer. By default, those resources are deleted after successful analysis.
+ Type: `Boolean`
+ Default: `false`
1. Select **Execute**.
1. The automation initiates.
1. The document performs the following steps:
+ **getInstanceProfile**:
Verifies if the provided Amazon EC2 instance has an IAM instance profile attached.
+ **branchOnInstanceProfileStatus**:
Branches the automation to check for necessary instance profile permissions if the instance profile is attached to the instance.
+ **verifyIamPermissions**:
Checks the instance profile associated with the instance to determine if the necessary IAM permissions are applied.
+ **getInstanceInformation**:
Checks if the instance has an active Systems Manager agent, and fetches the OS type of the instance.
+ **branchOnManagedInstance**:
Branches the automation to perform extended checks if the instance is managed.
+ **getAgentStatus**:
Checks the status of the Amazon CloudWatch Agent on the instance.
+ **branchOnInstanceOsType**:
Branches the automation to run a specific log collection/analysis command based on the OS.
+ **analyzeLogs/analyzeLogsWindows**:
Analyzes and outputs findings of Amazon CloudWatch Agent logs based on the OS type.
+ **collectLogs/collectLogsWindows**:
Bundles and outputs the relevant Amazon CloudWatch Agent troubleshooting files based on the OS type.
+ **checkEndpointReachability/checkEndpointReachabilityWindows**:
Checks if the instance can reach the required endpoints based on the OS type.
+ **branchOnRunVpcReachabilityAnalyzer**:
Branches the automation to run VPC reachability analysis if enabled and network issues are detected.
+ **generateEndpoints**:
Generates an endpoint to check from the extended check failures and the value of `CheckEC2Endpoint`.
+ **analyzeAwsEndpointReachabilityFromEC2**:
Calls the automation runbook, `AWSSupport-AnalyzeAWSEndpointReachabilityFromEC2` to check the reachability of the selected instance to the required endpoints.
+ **outputFindings**:
Outputs results of the automation execution steps.
1. After completion, review the **Outputs** section for the detailed results of the execution.
**References**
Systems Manager Automation
+ [Run this Automation (console)](https://console.aws.amazon.com/systems-manager/documents/AWSSupport-TroubleshootCloudWatchAgent/description)
+ [Run an automation](https://docs.aws.amazon.com//systems-manager/latest/userguide/automation-working-executing.html)
+ [Setting up an Automation](https://docs.aws.amazon.com//systems-manager/latest/userguide/automation-setup.html)
+ [Support Automation Workflows](https://aws.amazon.com/premiumsupport/technology/saw/)
# `AWSSupport-TroubleshootCloudWatchAlarm`
**Description**
The `AWSSupport-TroubleshootCloudWatchAlarm` runbook helps identify and troubleshoot issues with misconfigured or problematic Amazon CloudWatch (CloudWatch) Alarms. It leverages public AWS APIs and known alarm evaluation logic to detect delayed or missing datapoints in the monitored metrics, which can lead to missed or delayed alarm actions. This runbook provides a structured approach to investigate and resolve Amazon CloudWatch (CloudWatch) Alarm-related problems.
**How does it work?**
The runbook `AWSSupport-TroubleshootCloudWatchAlarm` performs the following steps:
+ Verifies the Amazon CloudWatch (CloudWatch) alarm details and the value of the `AlarmTriggerTimestamp` parameter to check if it's within 2,592,000 seconds (30 days).
+ Checks if an alarm is based on a Metric or Metric Math or is an Anomaly Detector Alarm.
+ Checks if an alarm is in insufficient data sate.
+ Checks if the metric(s) used in the alarm matches with `ListMetrics` value.
+ Verifies if a metric was missing datapoint(s) at a given timestamp.
+ Gets the most recent history for a given timestamp.
+ Checks if an alarm did not trigger due to a delayed or missed metric(s).
+ Checks if an alarm's enabled action(s) was/were delivered.
+ Generates a troubleshooting report combining all diagnostic results.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSSupport-TroubleshootCloudWatchAlarm)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Linux, macOS, Windows
**Parameters**
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `cloudwatch:DescribeAlarms`
+ `cloudwatch:DescribeAlarmHistory`
+ `cloudwatch:DescribeAnomalyDetectors`
+ `cloudwatch:GetMetricData`
+ `cloudwatch:GetMetricStatistics`
+ `cloudwatch:ListMetrics`
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarms",
"cloudwatch:DescribeAlarmHistory",
"cloudwatch:DescribeAnomalyDetectors",
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics"
],
"Resource": "*"
}
]
}
```
------
**Instructions**
Follow these steps to configure the automation:
1. Navigate to [https://console.aws.amazon.com/systems-manager/documents/AWSSupport-TroubleshootCloudWatchAlarm/description](https://console.aws.amazon.com/systems-manager/documents/AWSSupport-TroubleshootCloudWatchAlarm/description) in Systems Manager under Documents.
1. Select Execute automation.
1. For the input parameters, enter the following:
+ **AutomationAssumeRole (Optional):**
+ Type: `String`
+ Description: (Optional) The Amazon Resource Name (ARN) of the AWS AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses the permissions of the user who starts this runbook.
+ **CloudWatchMetricAlarmName (Required):**
+ Type: `String`
+ Description: (Required) The name of the Amazon CloudWatch (CloudWatch) metric Alarm to troubleshoot.
+ Allowed Pattern: `^[a-zA-Z0-9.:;,\\-_&() ]{1,255}$`
+ **AlarmTriggerTimestamp (Required):**
+ Type: `String`
+ Description: (Required) The UTC timestamp when the Alarm issue occurred. This information is crucial for troubleshooting the issue and understanding the context in which it happened. The timestamp value should be a time within the last 30 days from today and in the format `YYYY-MM-DDTHH:mm:ssZ`. Example: `2024-10-29T09:04:00Z`
+ Allowed Pattern: `^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})Z$`
1. Select Execute.
1. The automation initiates.
1. The document performs the following steps:
+ **`VerifyRunbookInputs`**
Verifies the Amazon CloudWatch (CloudWatch) alarm details and the value of the `AlarmTriggerTimestamp` parameter to check if it's within 2,592,000 seconds (30 days).
+ **`UpdateSSMDocumentInputChecksVariable`**
Updates the variable `SSMDocumentInputChecks` with value `SSMDocumentInputChecks` from `VerifyRunbookInputs` step.
+ **`BranchOnAlarmIsVerified`**
Branches on Runbook's inputs verification `AlarmTriggerTimestamp` and `CloudWatchAlarmName`.
+ **`CheckMetricAlarmType`**
Checks if an alarm is based on a Metric or Metric Math or is an Anomaly Detector Alarm.
+ **`CheckAlarmInInsufficientDataState`**
Checks if an alarm is in insufficient data sate.
+ **`UpdateInsufficientDataChecksVariable`**
Updates the variable `InsufficientDataChecks` with value `InsufficientDataChecks` from `CheckAlarmInInsufficientDataState` step.
+ **`BranchOnAlarmHasInsufficientData`**
Branches on the `AlarmHasInsufficientData` value from `CheckAlarmInInsufficientDataState` step, the default step is `CheckMetricMismatch`.
+ **`CheckMetricMismatch`**
Checks if the metric(s) used in the alarm matches with `ListMetrics` value.
+ **`UpdateMetricMismatchChecksVariable`**
Updates the variable `MetricMismatchChecks` with value `MetricMismatchChecks` from `CheckMetricMismatch` step.
+ **`BranchOnMetricsMatched`**
Branches on the `MetricsMatched` value from `CheckMetricMismatch` step, the default step is `CheckMissingDatapoint`.
+ **`CheckMissingDatapoint`**
Verifies if a metric was missing datapoint(s) at a given timestamp.
+ **`UpdateMetricMissingDatapointsChecksVariable`**
Updates the variable `MetricMissingDatapointsChecks` with value `MetricMissingDatapointsChecks` from `CheckMissingDatapoint` step.
+ **`BranchOnMetricMissingDatapoint`**
Branches on the `MetricMissingDatapoint` value from `CheckMissingDatapoint` step, the default step is `GetAlarmHistoryDetails`.
+ **`GetAlarmHistoryDetails`**
Gets the most recent history for a given timestamp.
+ **`UpdateAlarmHistoryChecksVariable`**
Updates the variable `AlarmHistoryChecks` with value `AlarmHistoryChecks` from `GetAlarmHistoryDetails` step.
+ **`BranchOnAlarmHistoryFound`**
Branches on the `AlarmHistoryFound` value from `GetAlarmHistoryDetails` step, the default step is `CheckDelayedMetric`.
+ **`CheckDelayedMetric`**
Checks if an alarm did not trigger due to a delayed or missed metric(s).
+ **`UpdateDelayedMetricChecksVariable`**
Updates the variable `DelayedMetricChecks` with value `DelayedMetricChecks` from `CheckDelayedMetric` step.
+ **`BranchOnMetricDelayedAndDatapointsMeetThreshold`**
Branches on the `MetricDelayed` and `DatapointsMeetThreshold` values from `CheckDelayedMetric` step, the default step is `GenerateReport`.
+ **`CheckActionDelivered`**
Checks if an alarm's enabled action(s) was/were delivered.
+ **`UpdateActionDeliveredChecksVariable`**
Updates the variable `ActionDeliveredChecks` with output `ActionDeliveredChecks` from `CheckActionDelivered` step.
+ **`GenerateReport`**
Compiles the output of the previous steps and outputs a report.
1. After the execution completes, review the Outputs section for the detailed results of the execution:
+ **GenerateReport.Report**
A report of the provided Amazon CloudWatch (CloudWatch) metric Alarm.
```
------------------------------------------------------------------------------------------
| AWS CloudWatch Alarm Troubleshooting Results |
------------------------------------------------------------------------------------------
| Alarm Name - Demo-Alarm |
| Timestamp - 2025-03-04T06:31:00Z |
------------------------------------------------------------------------------------------
| ✅ No Issue(s) Found |
------------------------------------------------------------------------------------------
==========================================================================================
1. Validating SSM Document input parameters:
==========================================================================================
✅ [PASSED]: Found a metric alarm with name Demo-Alarm
==========================================================================================
2. Checking alarm's data state:
==========================================================================================
✅ [PASSED]: The alarm is not in INSUFFICIENT_DATA state, alarm's state is: ALARM
==========================================================================================
3. Checking if the alarm experienced metric mismatches:
==========================================================================================
✅ [PASSED]: Metric matches with the configured metric for Alarm.
==========================================================================================
4. Checking if the alarm's metric(s) experienced missing datapoint(s):
==========================================================================================
✅ [PASSED]: Metric has datapoints
==========================================================================================
5. Retrieving alarm's history for timestamp 2025-03-04T06:31:00Z:
==========================================================================================
✅ [PASSED]: Found most recent alarm history item for the provided timestamp: '2025-03-04T06:31:00Z'
==========================================================================================
6. Checking if the alarm experienced metric delays or the alarm's datapoint(s) did not meet the configured threshold:
==========================================================================================
✅ [PASSED]: CloudWatch alarm did not experience any delayed metric
==========================================================================================
7. Checking if the alarm has actions enabled and if action(s) were delivered:
==========================================================================================
✅ [PASSED]: Successfully executed action arn:aws:sns:us-east-1:12345678910:Demo_Alarms_Topic
------------------------------------------------------------------------------------------
✅ All the checks have passed for CloudWatch alarm, Demo-Alarm, the alarm's configuration is correct.
```
**References**
Systems Manager Automation
+ [Run this Automation (console)](https://console.aws.amazon.com/systems-manager/documents/AWSSupport-TroubleshootCloudWatchAlarm/description)
+ [Run an automation](https://docs.aws.amazon.com//systems-manager/latest/userguide/automation-working-executing.html)
+ [Setting up an Automation](https://docs.aws.amazon.com//systems-manager/latest/userguide/automation-setup.html)
+ [Support Automation Workflows landing page](https://aws.amazon.com/premiumsupport/technology/saw/)