Answers: <p>From what I know of AWS Config there's no way at the moment to directly publish a metric from which you can base an alarm.</p>
  
  <p>If the notification has to come from a Cloudwatch alarm then AWS Config will let you execute Lambda based on rules set up in AWS Config - <a href="http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs-sample.html" rel="nofollow noreferrer">link</a>.</p>
  
  <p>If you want a simpler option AWS Config also lets you publish directly to an SNS topic when your rule is evaluated - <a href="http://docs.aws.amazon.com/config/latest/developerguide/notifications-for-AWS-Config.html" rel="nofollow noreferrer">link</a></p>
  
  <p>Failing this you can also watch for CloudTrail events and then publish a CloudWatch metric which you can base an alarm on. This is fairly in depth though and if the important part is getting the emails to be looked at by a person then your best bet is probably to have AWS Config publish directly to SNS itself.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-11T20:04:48.307Z
Answers: 2017-08-11T20:04:48.307Z
Answers: Briansbum
Body: <p>I have a set of rules in my AWS Config dashboard. And, I want to set a AWS CloudWatch alarm to be triggered whenever Config detects non-compliant resource(s).</p>
  
  <p>[The plan is to link that alarm to an SNS topic for sending out emails to the team for any non-compliant event/resource]</p>
  
  <p>Is there a straightforward way to do that? Or is there a workaround for the same?</p>
  
  <hr>
  
  <p>I went through the available metrics in the Cloudwatch dashboard, but haven't found anything related to AWS Config.</p>
  
Tags: <amazon-cloudwatch>
Title: How to set CloudWatch alarms for non-compliancy in AWS Config rules?
UserDisplayName: Dawny33
ThreadText: # How to set CloudWatch alarms for non-compliancy in AWS Config rules?
  
  (Asked by: username_0 on 2017-07-20)
  
  I have a set of rules in my AWS Config dashboard. And, I want to set a AWS CloudWatch alarm to be triggered whenever Config detects non-compliant resource(s).
  
  [The plan is to link that alarm to an SNS topic for sending out emails to the team for any non-compliant event/resource]
  
  Is there a straightforward way to do that? Or is there a workaround for the same?
  
  ---
  
  I went through the available metrics in the Cloudwatch dashboard, but haven't found anything related to AWS Config.
  
  **Tags:** amazon-cloudwatch
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-08-11. Score: 1
  
  From what I know of AWS Config there's no way at the moment to directly publish a metric from which you can base an alarm.
  
  If the notification has to come from a Cloudwatch alarm then AWS Config will let you execute Lambda based on rules set up in AWS Config - [link](http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs-sample.html).
  
  If you want a simpler option AWS Config also lets you publish directly to an SNS topic when your rule is evaluated - [link](http://docs.aws.amazon.com/config/latest/developerguide/notifications-for-AWS-Config.html)
  
  Failing this you can also watch for CloudTrail events and then publish a CloudWatch metric which you can base an alarm on. This is fairly in depth though and if the important part is getting the emails to be looked at by a person then your best bet is probably to have AWS Config publish directly to SNS itself.
  
  
  ---
  
  