Clouwatch alarm

Hi, you indicate the lambda function is not triggered by the alarm, can you please confirm that you have created a security policy to allow CloudWatch to execute that lambda function? There is an example of how to create that security policy in the Lambda action section on the main alarm documentation page. You need to run something that looks like that - it's a one-off configuration, once you've done it, you don't need to do it again.

The below example allows only one alarm (identified by its arn) to execute a specific function (identified by its name). You can adjust to your needs, for example allowing all alarms (and not just one alarm) from a specific account to execute a specific function.

aws lambda add-permission \
--function-name my-function-name \
--statement-id AlarmAction \
--action 'lambda:InvokeFunction' \
--principal lambda.alarms.cloudwatch.amazonaws.com \
--source-account 111122223333 \
--source-arn arn:aws:cloudwatch:us-east-1:111122223333:alarm:alarm-name

Please verify the whether the Lambda execution role has permission to allow cloudwatch to execute the lambda. How to create required permission could be found at https://repost.aws/knowledge-center/lambda-permissions-issues

Possible Lambda Execution scenario failures could be found at the document https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-actions

Could you please confirm that the CloudWatch alarm is indeed transitioning from "OK" to "ALARM." You can check the alarm history in the CloudWatch console or use the AWS CLI to get the alarm history :- "aws cloudwatch describe-alarm-history --alarm-name YourAlarmName" Examine the CloudWatch Logs for your Lambda function to see if there are any error messages or information logged when the function is triggered by the CloudWatch alarm. Clouldwatch ->loggroups-> search for lambda based on your configurations

Also, you could try to set the alarm into ALARM state manually and then check the Lambda logs and find out the reason as to why the invocation is not happening. To change the alarm state, you can use the management console CLI or aws cli. An example of the command is shown below:

aws cloudwatch set-alarm-state --alarm-name "myalarm" --state-value ALARM --state-reason "testing purposes"

I found out the issue. I did not allow cloudWatch to invoke the lambda function. This was the error: 'Failed to execute action "CloudWatch Alarms is not authorized to perform: lambda:InvokeFunction on the resource because no resource-based policy allows the lambda:InvokeFunction action" '. I added the permission by going into lambda -> configuration -> permission -> add permission. This will allow the cloudwatch service to invoke this lambda function.

Hi, I'm encountering a similar issue despite configuring all permissions correctly. When attempting to trigger an action via a CloudWatch alarm in AWS Lambda, I receive the following error message:

Error: Failed to execute action arn:aws:lambda:[region]:[account_id]:function:[function_name]. Received error: "CloudWatch Alarms is not authorized to perform: lambda:InvokeFunction on the resource because no resource-based policy allows the lambda:InvokeFunction action."

The CloudWatch alarms are being programmatically created and dynamically configured within a Lambda function, specifically to monitor CPU utilization and trigger at <10%. Everything seems to work fine: the alarms are created successfully, and the logic is functioning as expected, with the Lambda function set as the action trigger. However, when the alarm reaches the action state, the error appears in CloudWatch logs, and the Lambda function is not triggered.

I have already ensured that all permissions are set correctly. My Lambda function has a resource-based policy issued through the CLI with the appropriate lambda:InvokeFunction permissions.

Has anyone encountered this issue or found a solution? I've come across similar cases but haven't found a clear fix.

Does anyone have suggestions for resolving this issue?

Here’s a json of my current policy:

json
Copy code
{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "AllowCloudWatchAlarmInvocation",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudwatch.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:[region]:[account_id]:function:[function_name]",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:cloudwatch:[region]:[account_id]:alarm:*"
        }
      }
    },
    {
      "Sid": "[other_sid]",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:[region]:[account_id]:function:[function_name]",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:events:[region]:[account_id]:rule/[rule_name]"
        }
      }
    }
  ]
}