Monitor application logs with CloudWatch Logs Insights queries and auto-remediate via AWS Lambda and AWS Systems Manager when error thresholds are breached
Amazon CloudWatch Log Alarm runs a CloudWatch Logs Insights query on a schedule to count ERROR messages in application logs.
When the error count exceeds the threshold (5 errors in 5 minutes), the alarm transitions to ALARM state and publishes to Amazon SNS.
Amazon SNS triggers an AWS Lambda function that sends a remediation command via AWS Systems Manager RunCommand to restart the application service on tagged Amazon EC2 instances.
< Back to all patterns
Clone repo
git clone https://github.com/aws-samples/serverless-patterns/cd serverless-patterns/cloudwatch-log-alarm-lambda-remediation-cdkDeploy
<code>cd cloudwatch-log-alarm-lambda-remediation-cdk/cdk</code><code>npm install</code><code>npx cdk deploy</code>Testing
Write ERROR log messages to the monitored log group to trigger the alarm.
Wait 5 minutes for the scheduled query to evaluate.
Check alarm state transitions to ALARM.
Verify AWS Lambda remediation function was invoked via Amazon CloudWatch Logs.
Cleanup
npx cdk destroyCreated by:
