AWS CloudWatch

AWS CloudWatch alarms reach Exhale through an SNS HTTPS subscription. Each tenant gets a unique HTTPS URL token. Exhale scrubs the nested alarm payload, upserts a Pulse (source=aws_cloudwatch), and runs triage when NewStateValue is ALARM.

See Incoming integrations for how CloudWatch fits alongside PagerDuty, New Relic, and Manual webhook.

OpenAPI: POST /webhooks/aws-cloudwatch (header token) and POST /webhooks/aws-cloudwatch/{token}.

---

Endpoint

After Connect in Connections → Integrations → Observability & alerts → AWS CloudWatch:

Preferred (keeps tokens out of proxy access logs):

POST https://exhale.kolstromsystems.com/webhooks/aws-cloudwatch

Send header X-Exhale-Webhook-Token: {token}.

Path form (also supported):

POST https://exhale.kolstromsystems.com/webhooks/aws-cloudwatch/{token}

Design partners may substitute https://exhale-staging.kolstromsystems.com as the host.

• token — opaque URL segment; this token authenticates the delivery.
• Response: 202 Accepted with pulse_id, status, created, and message for alarm notifications.

Unknown tokens return 404. Disabled or expired-trial tenants return 403.

---

Customer setup

1. Sign in as admin → Connections → Integrations → AWS CloudWatch.
2. Click Connect AWS CloudWatch and copy the webhook URL.
3. In AWS, create an SNS topic and an HTTPS subscription pointing at the Exhale URL.
4. Confirm the subscription manually by opening the SubscribeURL from the SNS SubscriptionConfirmation email/payload in a browser (or GET that URL). Exhale acks the confirmation with 202 and does not create a Pulse — and does not auto-confirm SubscribeURL.
5. Route CloudWatch alarms to that SNS topic.
6. Send test alert creates a synthetic ALARM pulse and marks the integration configured.

Rotate webhook token invalidates the previous URL immediately — update SNS and re-confirm after rotating.

---

SNS + payload shape

SNS Type	Behavior
SubscriptionConfirmation	Ack only — open SubscribeURL yourself; no Pulse
Notification	Nested CloudWatch JSON in Message → Pulse
UnsubscribeConfirmation	Ack only; no Pulse

Alarm field	Required	Notes
AlarmName	Yes	External id (optionally :{Region}:{AccountId})
NewStateValue	No	ALARM, OK, …

Lifecycle mapping

CloudWatch state	Pulse status
ALARM	Received → triage
OK	Resolved

Example

TOKEN="your-url-token"
curl -i -X POST "https://exhale.kolstromsystems.com/webhooks/aws-cloudwatch/${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"Type":"Notification","Message":"{\"AlarmName\":\"HighCPU\",\"NewStateValue\":\"ALARM\"}"}'

---

Related

Full detail (SNS confirmation, fixtures, security): AWS CloudWatch webhooks in the repository wiki. Planning track: Observability ingest v2.