A CloudWatch Alarm that triggers when changes are made to large size EC2 Instances.

 
Source
Custom
Items
2
Size
1.6 KB
Missing Parameters
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  CloudWatchAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmName: large_ec2_changes
      AlarmDescription: >-
        A CloudWatch Alarm that triggers when changes are made to large size EC2
        Instances.
      MetricName: EC2LargeInstanceEventCount
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: '300'
      EvaluationPeriods: '1'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - ''
      TreatMissingData: notBreaching
  MetricFilter:
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      LogGroupName: ''
      FilterPattern: >-
        { (($.eventName = RunInstances) || ($.eventName = RebootInstances) ||
        ($.eventName = StartInstances) || ($.eventName = StopInstances) ||
        ($.eventName = TerminateInstances)) &&
        (($.requestParameters.instanceType = *.32xlarge) ||
        ($.requestParameters.instanceType = *.24xlarge) ||
        ($.requestParameters.instanceType = *.18xlarge) ||
        ($.requestParameters.instanceType = *.16xlarge) ||
        ($.requestParameters.instanceType = *.12xlarge) ||
        ($.requestParameters.instanceType = *.10xlarge) ||
        ($.requestParameters.instanceType = *.9xlarge) ||
        ($.requestParameters.instanceType = *.8xlarge) ||
        ($.requestParameters.instanceType = *.4xlarge)) }
      MetricTransformations:
        - MetricValue: '1'
          MetricNamespace: CloudTrailMetrics
          MetricName: EC2LargeInstanceEventCount
Parameters: {}
Metadata: {}
Conditions: {}

Customize Cf Template

Alarm Configuration


Metric Filter Configuration


* Required field