CloudWatch

Route CloudWatch alarm state changes through an EventBridge API destination to Corelayer. This preset expects the complete EventBridge event; an SNS notification uses a different payload and cannot be sent directly to this endpoint.

Prerequisites

You need permission to add webhooks in Corelayer and deploy AWS resources in the account and Region containing your alarms. The template creates EventBridge resources, an SQS queue, and a named IAM role. The template connects to a public HTTPS endpoint. For a private Corelayer deployment, configure private API connectivity in EventBridge before sending events.

Setup

1. Create a source

In Corelayer, open Webhooks and click Add Webhook. Set Webhook type to CloudWatch alarms, enter a Source name, and click Create Webhook. Copy the Webhook URL, Webhook token, and CloudFormation snippet. The token is shown once, so store it before clicking Done.

2. Deploy the EventBridge resources

Save the template below as corelayer-cloudwatch.yaml. Replace <YOUR_WEBHOOK_URL> and <YOUR_WEBHOOK_TOKEN> with the values from Corelayer. If you copied the snippet from Corelayer, the URL is already filled in; you still need to replace the token placeholder. Deploy the stack in the same account and Region as the alarms. Acknowledge the named IAM resources when creating the stack, or use CAPABILITY_NAMED_IAM with the CloudFormation CLI. AWS documents the required IAM acknowledgement. The default rule forwards all alarm state changes in that Region. To select specific alarms, add a detail.alarmName filter to EventPattern before deploying. For another copy of the stack, change the explicit resource names, including the IAM role name, to avoid collisions.

AWSTemplateFormatVersion: "2010-09-09"
Description: Deliver CloudWatch alarm state changes to Corelayer

Resources:
  CorelayerWebhookConnection:
    Type: AWS::Events::Connection
    Properties:
      Name: corelayer-alert-webhook
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: Authorization
          ApiKeyValue: "Bearer <YOUR_WEBHOOK_TOKEN>"

  CorelayerWebhookDestination:
    Type: AWS::Events::ApiDestination
    Properties:
      Name: corelayer-alert-webhook
      ConnectionArn: !GetAtt CorelayerWebhookConnection.Arn
      InvocationEndpoint: <YOUR_WEBHOOK_URL>
      HttpMethod: POST
      InvocationRateLimitPerSecond: 10

  CorelayerWebhookDeadLetterQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: corelayer-alert-webhook-dlq
      MessageRetentionPeriod: 1209600

  CorelayerWebhookDeadLetterQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref CorelayerWebhookDeadLetterQueue
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sqs:SendMessage
            Resource: !GetAtt CorelayerWebhookDeadLetterQueue.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt CorelayerAlarmStateChangeRule.Arn

  CorelayerWebhookRuleRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: corelayer-alert-webhook-rule-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: invoke-corelayer-webhook
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: events:InvokeApiDestination
                Resource: !GetAtt CorelayerWebhookDestination.Arn

  CorelayerAlarmStateChangeRule:
    Type: AWS::Events::Rule
    Properties:
      Name: corelayer-alarm-state-change
      EventPattern:
        source:
          - aws.cloudwatch
        detail-type:
          - "CloudWatch Alarm State Change"
      Targets:
        - Id: corelayer-webhook
          Arn: !GetAtt CorelayerWebhookDestination.Arn
          RoleArn: !GetAtt CorelayerWebhookRuleRole.Arn
          RetryPolicy:
            MaximumRetryAttempts: 5
            MaximumEventAgeInSeconds: 3600
          DeadLetterConfig:
            Arn: !GetAtt CorelayerWebhookDeadLetterQueue.Arn

The connection sends Authorization: Bearer <YOUR_WEBHOOK_TOKEN>. The rule forwards the full event without an input transformer. Its role permits events:InvokeApiDestination on this destination, and the queue policy permits this rule to send failed deliveries to the dead-letter queue. Creating the first API destination connection may also require permission to create the EventBridge service-linked role. EventBridge uses that role to manage the connection secret in Secrets Manager. See API destination permissions.

3. Check an alarm transition

When an alarm next changes to ALARM, check the EventBridge rule’s monitoring metrics and look for the resulting investigation in Corelayer. A successful API call confirms delivery, not completion of the investigation. If delivery fails, inspect the dead-letter queue and its message error attributes. The template allows up to five retries within one hour and retains queued failures for 14 days. AWS explains dead-letter queue errors and permissions.

How alerts are handled

ALARM starts an investigation. OK records a resolution without closing the Corelayer issue. Other states, including INSUFFICIENT_DATA, are recorded without investigation. Keep the complete CloudWatch alarm event. Corelayer reads the alarm name, state, reason, and available metric details from its detail object. See Manage sources to change or remove this source.

Troubleshooting

The rule does not match: Check its AWS account, Region, event pattern, and whether the alarm changed state after the rule was created.
Authentication fails: Check the connection’s API key name is Authorization and its value contains Bearer followed by the Corelayer token.
The target cannot be invoked: Check the destination URL and the rule role’s events:InvokeApiDestination permission. For private endpoints, check the connection’s network configuration.
No investigation starts: Confirm the event has detail.state.value set to ALARM and was delivered without an input transformer or SNS envelope.

Need help? Contact support.

Get Started

Anomaly Detection

Organization Memory

Security & Privacy

Integrations

Webhooks

Developer Tools

Prerequisites

Setup

1. Create a source

2. Deploy the EventBridge resources

3. Check an alarm transition

How alerts are handled

Troubleshooting

​Prerequisites

​Setup

​1. Create a source

​2. Deploy the EventBridge resources

​3. Check an alarm transition

​How alerts are handled

​Troubleshooting

Prerequisites

Setup

1. Create a source

2. Deploy the EventBridge resources

3. Check an alarm transition

How alerts are handled

Troubleshooting