> ## Documentation Index > Fetch the complete documentation index at: https://docs.corelayer.com/llms.txt > Use this file to discover all available pages before exploring further. # CloudWatch > Send CloudWatch alarm state changes to Corelayer through EventBridge. Route CloudWatch alarm state changes through an EventBridge API destination to Corelayer. This preset expects the complete EventBridge event; an SNS notification uses a different payload and cannot be sent directly to this endpoint. ## Prerequisites You need permission to add webhooks in Corelayer and deploy AWS resources in the account and Region containing your alarms. The template creates EventBridge resources, an SQS queue, and a named IAM role. The template connects to a public HTTPS endpoint. For a private Corelayer deployment, configure [private API connectivity in EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-target-connection-create.html) before sending events. ## Setup ### 1. Create a source In Corelayer, open **Webhooks** and click **Add Webhook**. Set **Webhook type** to **CloudWatch alarms**, enter a **Source name**, and click **Create Webhook**. Copy the **Webhook URL**, **Webhook token**, and CloudFormation snippet. The token is shown once, so store it before clicking **Done**. ### 2. Deploy the EventBridge resources Save the template below as `corelayer-cloudwatch.yaml`. Replace `` and `` with the values from Corelayer. If you copied the snippet from Corelayer, the URL is already filled in; you still need to replace the token placeholder. Deploy the stack in the same account and Region as the alarms. Acknowledge the named IAM resources when creating the stack, or use `CAPABILITY_NAMED_IAM` with the CloudFormation CLI. AWS documents the [required IAM acknowledgement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html). The default rule forwards **all alarm state changes in that Region**. To select specific alarms, add a `detail.alarmName` filter to `EventPattern` before deploying. For another copy of the stack, change the explicit resource names, including the IAM role name, to avoid collisions. ```yaml theme={null} AWSTemplateFormatVersion: "2010-09-09" Description: Deliver CloudWatch alarm state changes to Corelayer Resources: CorelayerWebhookConnection: Type: AWS::Events::Connection Properties: Name: corelayer-alert-webhook AuthorizationType: API_KEY AuthParameters: ApiKeyAuthParameters: ApiKeyName: Authorization ApiKeyValue: "Bearer " CorelayerWebhookDestination: Type: AWS::Events::ApiDestination Properties: Name: corelayer-alert-webhook ConnectionArn: !GetAtt CorelayerWebhookConnection.Arn InvocationEndpoint: HttpMethod: POST InvocationRateLimitPerSecond: 10 CorelayerWebhookDeadLetterQueue: Type: AWS::SQS::Queue Properties: QueueName: corelayer-alert-webhook-dlq MessageRetentionPeriod: 1209600 CorelayerWebhookDeadLetterQueuePolicy: Type: AWS::SQS::QueuePolicy Properties: Queues: - !Ref CorelayerWebhookDeadLetterQueue PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: events.amazonaws.com Action: sqs:SendMessage Resource: !GetAtt CorelayerWebhookDeadLetterQueue.Arn Condition: ArnEquals: aws:SourceArn: !GetAtt CorelayerAlarmStateChangeRule.Arn CorelayerWebhookRuleRole: Type: AWS::IAM::Role Properties: RoleName: corelayer-alert-webhook-rule-role AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: events.amazonaws.com Action: sts:AssumeRole Policies: - PolicyName: invoke-corelayer-webhook PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: events:InvokeApiDestination Resource: !GetAtt CorelayerWebhookDestination.Arn CorelayerAlarmStateChangeRule: Type: AWS::Events::Rule Properties: Name: corelayer-alarm-state-change EventPattern: source: - aws.cloudwatch detail-type: - "CloudWatch Alarm State Change" Targets: - Id: corelayer-webhook Arn: !GetAtt CorelayerWebhookDestination.Arn RoleArn: !GetAtt CorelayerWebhookRuleRole.Arn RetryPolicy: MaximumRetryAttempts: 5 MaximumEventAgeInSeconds: 3600 DeadLetterConfig: Arn: !GetAtt CorelayerWebhookDeadLetterQueue.Arn ``` The connection sends `Authorization: Bearer `. The rule forwards the full event without an input transformer. Its role permits `events:InvokeApiDestination` on this destination, and the queue policy permits this rule to send failed deliveries to the dead-letter queue. Creating the first API destination connection may also require permission to create the EventBridge service-linked role. EventBridge uses that role to manage the connection secret in Secrets Manager. See [API destination permissions](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-api-destinations.html). ### 3. Check an alarm transition When an alarm next changes to `ALARM`, check the EventBridge rule's monitoring metrics and look for the resulting investigation in Corelayer. A successful API call confirms delivery, not completion of the investigation. If delivery fails, inspect the dead-letter queue and its message error attributes. The template allows up to five retries within one hour and retains queued failures for 14 days. AWS explains [dead-letter queue errors and permissions](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-rule-dlq.html). ## How alerts are handled `ALARM` starts an investigation. `OK` records a resolution without closing the Corelayer issue. Other states, including `INSUFFICIENT_DATA`, are recorded without investigation. Keep the complete [CloudWatch alarm event](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.html). Corelayer reads the alarm name, state, reason, and available metric details from its `detail` object. See [Manage sources](/webhooks/overview#manage-sources) to change or remove this source. ## Troubleshooting * **The rule does not match:** Check its AWS account, Region, event pattern, and whether the alarm changed state after the rule was created. * **Authentication fails:** Check the connection's API key name is `Authorization` and its value contains `Bearer ` followed by the Corelayer token. * **The target cannot be invoked:** Check the destination URL and the rule role's `events:InvokeApiDestination` permission. For private endpoints, check the connection's network configuration. * **No investigation starts:** Confirm the event has `detail.state.value` set to `ALARM` and was delivered without an input transformer or SNS envelope. Need help? [Contact support](mailto:support@corelayer.com). ## Related topics - [AWS Integration: CloudWatch, RDS, and S3](/integrations/aws.md) - [Custom alerts](/webhooks/custom.md) - [Overview](/webhooks/overview.md)