Export CloudWatch alarms from multiple AWS accounts into CSV

Question

I don't see any option from AWS console to download all Cloudwatch alarms. I have a requirement to download existing CloudWatch alarms from multiple AWS accounts. Any guidance on how to accomplish this activity is much appreciated.

Accepted Answer

Hello.

If you use the AWS CLI, you can create a CSV of CloudWatch alarms using the following command.  
I think all you have to do is run this for each region or each account.  
```
aws --profile your-env cloudwatch describe-alarms | jq -r '.MetricAlarms[] | [.AlarmName, .Namespace, .Dimensions[0].Name, .Dimensions[0].Value, .MetricName, .Statistic, .Period, .Threshold, .ComparisonOperator, .EvaluationPeriods] | @csv'
```

For example, if you want to run it for multiple accounts, you can create an access key for each account and separate profiles.  
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html

Answer

Run on Linux/Cloudshell

1. Configure AWS CLI with a profile in the Management account
2. Install JQ
3. Update the variable to the role you wish to assume in each account
4. Add the regions also to the list where you want to check for alarms

Then run this

```
#!/bin/bash
#User configurable variables
roletoassume="OrganizationAccountAccessRole"
regions='["eu-west-2","eu-west-1"]'
comdtorun="aws cloudwatch describe-alarms | jq -r '.MetricAlarms[] | [.AlarmName, .Namespace, .Dimensions[0].Name, .Dimensions[0].Value, .MetricName, .Statistic, .Period, .Threshold, .ComparisonOperator, .EvaluationPeriods] | @csv'"

accounts=$(aws organizations list-accounts --query "Accounts[*].Id")
masteraccount=$(aws organizations describe-organization |jq .Organization.MasterAccountId | tr -d '"')

echo $masteraccount
echo $regions | jq .[] | tr -d '"'| while read region;
                do
                        echo $region
                        eval $comdtorun
                done

echo $accounts | jq -c .[]| while read i;
do
        account=$(echo $i | tr -d '"')
        if [[ "$account" != "$masteraccount" ]]
        then
                echo $account
                sts=$(aws sts assume-role --role-arn arn:aws:iam::${account}:role/${roletoassume} --role-session-name mysession)
                var=( $(echo $sts | jq '.[] | .AccessKeyId, .SecretAccessKey, .SessionToken') )

export AWS_ACCESS_KEY_ID=$(echo ${var[0]} | tr -d '"')
                export AWS_SECRET_ACCESS_KEY=$(echo ${var[1]} | tr -d '"')
                export AWS_SESSION_TOKEN=$(echo ${var[2]} | tr -d '"')

echo $regions | jq .[] | tr -d '"'| while read region;
                do
                        echo $region
                        eval $comdtorun
                done

unset AWS_ACCESS_KEY_ID
                unset AWS_SECRET_ACCESS_KEY
                unset AWS_SESSION_TOKEN

fi
done
```

Answer

On top of above, you could centrally deploy from aws organisation a lambda function on each of your accounts: https://aws.amazon.com/blogs/architecture/using-devops-automation-to-deploy-lambda-apis-across-accounts-and-environments/ and extract the info as mentioned above.

The would be up to you to either send a report or send all data back to a central queue or topic for consolidation.

Export CloudWatch alarms from multiple AWS accounts into CSV

Relevant content