| name | cloudwatch |
| id | cloudwatch |
| description | Amazon CloudWatch alarm integration — receives alarm state-change notifications via SNS webhooks and creates incidents automatically |
| category | observability |
| connection_check | {"method":"provider_in_preference","provider_key":"cloudwatch"} |
| tools | [] |
| index | CloudWatch — observation-only alarm ingestion via SNS webhook, no CLI tools |
| rca_priority | 30 |
| allowed-tools | |
| metadata | {"author":"aurora","version":"1.0"} |
CloudWatch Integration
Overview
Amazon CloudWatch alarm integration. Aurora receives alarm state-change notifications from CloudWatch via AWS SNS webhooks and creates incidents automatically.
Instructions
IMPORTANT — NO CLI SUPPORT
- Do NOT use
cloud_exec('cloudwatch', ...) — there is no CloudWatch CLI connector.
- You CAN use
cloud_exec('aws', ...) to query CloudWatch metrics and logs via the AWS CLI.
WHAT YOU CAN DO
- Investigate infrastructure: If an alarm references a specific AWS resource (EC2, RDS, Lambda, EKS),
use the AWS cloud provider tool (
cloud_exec with 'aws') to investigate.
CRITICAL RULES
- NEVER call cloud_exec with provider='cloudwatch' — it will fail.
- Use the alert context already available in the conversation.
- For deeper investigation, use the AWS provider tools for the affected resource.
RCA Investigation Workflow (read-only)
During RCA the agent may:
- Query CloudWatch alarms history for the affected account/region
- Cross-reference with EC2, RDS, Lambda, EKS metrics for the affected resource
- Look up related incidents with the same alarm_name
- Check AWS CloudWatch Logs for errors near the alarm fire time
The agent must never write or modify CloudWatch alarms during RCA.
Alarm State Mapping
| CloudWatch State | Aurora Behavior |
|---|
| ALARM | Creates incident — severity high (or critical if "critical" in alarm name) |
| INSUFFICIENT_DATA | No incident created (state recorded only) |
| OK | Resolves matching open incident (no new incident created) |
