Export CloudWatch alarms from multiple AWS accounts into CSV

0

I don't see any option from AWS console to download all Cloudwatch alarms. I have a requirement to download existing CloudWatch alarms from multiple AWS accounts. Any guidance on how to accomplish this activity is much appreciated.

Sathya
asked 5 months ago527 views
3 Answers
0
Accepted Answer

Hello.

If you use the AWS CLI, you can create a CSV of CloudWatch alarms using the following command.
I think all you have to do is run this for each region or each account.

aws --profile your-env cloudwatch describe-alarms | jq -r '.MetricAlarms[] | [.AlarmName, .Namespace, .Dimensions[0].Name, .Dimensions[0].Value, .MetricName, .Statistic, .Period, .Threshold, .ComparisonOperator, .EvaluationPeriods] | @csv'

For example, if you want to run it for multiple accounts, you can create an access key for each account and separate profiles.
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html

profile picture
EXPERT
answered 5 months ago
profile picture
EXPERT
reviewed 5 months ago
profile pictureAWS
EXPERT
reviewed 5 months ago
  • Thank you. It helped me to pull out CloudWatch Alarms with limited information within AWS account. We have more than 100+ AWS accounts within Landing zone and we would need your assistance to run the script and pull CloudWatch Alarms from all the AWS accounts.

  • Do you have a common role in all the accounts you could use? If so I’d be happy to knock a script up.

  • If you manage your accounts with AWS Organizations, how about using StackSets to create an IAM role for the switch role in each account? If you can set this up, I think you can solve the problem by creating a shell script that loops the command I shared using a for statement. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html

  • @Gary Mclean, I do have a common role in all the aws accounts.

  • @Sathya code added in a new answer.. Enjoy

0

Run on Linux/Cloudshell

  1. Configure AWS CLI with a profile in the Management account
  2. Install JQ
  3. Update the variable to the role you wish to assume in each account
  4. Add the regions also to the list where you want to check for alarms

Then run this

#!/bin/bash
#User configurable variables
roletoassume="OrganizationAccountAccessRole"
regions='["eu-west-2","eu-west-1"]'
comdtorun="aws cloudwatch describe-alarms | jq -r '.MetricAlarms[] | [.AlarmName, .Namespace, .Dimensions[0].Name, .Dimensions[0].Value, .MetricName, .Statistic, .Period, .Threshold, .ComparisonOperator, .EvaluationPeriods] | @csv'"

accounts=$(aws organizations list-accounts --query "Accounts[*].Id")
masteraccount=$(aws organizations describe-organization |jq .Organization.MasterAccountId | tr -d '"')

echo $masteraccount
echo $regions | jq .[] | tr -d '"'| while read region;
                do
                        echo $region
                        eval $comdtorun
                done

echo $accounts | jq -c .[]| while read i;
do
        account=$(echo $i | tr -d '"')
        if [[ "$account" != "$masteraccount" ]]
        then
                echo $account
                sts=$(aws sts assume-role --role-arn arn:aws:iam::${account}:role/${roletoassume} --role-session-name mysession)
                var=( $(echo $sts | jq '.[] | .AccessKeyId, .SecretAccessKey, .SessionToken') )

                export AWS_ACCESS_KEY_ID=$(echo ${var[0]} | tr -d '"')
                export AWS_SECRET_ACCESS_KEY=$(echo ${var[1]} | tr -d '"')
                export AWS_SESSION_TOKEN=$(echo ${var[2]} | tr -d '"')

                echo $regions | jq .[] | tr -d '"'| while read region;
                do
                        echo $region
                        eval $comdtorun
                done

                unset AWS_ACCESS_KEY_ID
                unset AWS_SECRET_ACCESS_KEY
                unset AWS_SESSION_TOKEN

        fi
done
profile picture
EXPERT
answered 5 months ago
  • Thanks Gary!

0

On top of above, you could centrally deploy from aws organisation a lambda function on each of your accounts: https://aws.amazon.com/blogs/architecture/using-devops-automation-to-deploy-lambda-apis-across-accounts-and-environments/ and extract the info as mentioned above.

The would be up to you to either send a report or send all data back to a central queue or topic for consolidation.

profile picture
EXPERT
answered 5 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions