AWS: Trusted Advisor, part 2 — CloudWatch Alarms and Slack notifications
Tags: aws, monitoring, devops, tutorial
Published: 2021-11-30 09:03:26

---
title: AWS: Trusted Advisor, part 2 — CloudWatch Alarms and Slack notifications
published: true
date: 2021-11-29 08:17:33 UTC
tags: aws,monitoring,devops,tutorial
canonical_url: https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/
---

### AWS: Trusted Advisor, part 2 — CloudWatch Alarms and Slack notifications

![](https://cdn-images-1.medium.com/max/290/1*IQXKQuuiBB-kvKYDCUSuiQ.png)

Continuing with the theme of the AWS Trusted Advisor service, let’s see how can we configure notifications about new findings.

The first part: [AWS: Trusted Advisor, part 1 — its features overview](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/).

To have notifications, we can use Trusted Advisor metrics from the CloudWatch, see their list on the [Trusted Advisor metrics and dimensions](https://docs.aws.amazon.com/awssupport/latest/user/cloudwatch-metrics-ta.html#trusted-advisor-metrics-dimensions) page.

Then, CloudWatch will rise alerts, will send them to the AWS Simple Notifications Service (AWS SNS). from there we will get alerts in Opsgenie, and from there they will be forwarded to a Slack channel.

The idea is to be notified quickly once somebody will create for example an AWS Security Group opened to the world.

So, in this post we will configure CloudWatch Alarms, their sending to Slack, and will see how Trusted Advisor refreshes its data, so we can be notified for example daily (or hourly, although there are some limitations, see the [Trusted Advisor refresh checks — frequency of updates](https://rtfm.co.ua/en/?p=27384#Trusted_Advisor_refresh_checks_-_frequency_of_updates) part).

- [Opsgenie configuration](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/#Opsgenie_configuration)
- [AWS Simple Notification Service configuration](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/#AWS_Simple_Notification_Service_configuration)
- [AWS Trusted Advisor: what to monitor?](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/#AWS_Trusted_Advisor_what_to_monitor)
- [CloudWatch Alarms configuration](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/#CloudWatch_Alarms_configuration)
- [Trusted Advisor refresh checks — frequency of updates](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/#Trusted_Advisor_refresh_checks_-_frequency_of_updates)
- [Trusted Advisor — manual refresh](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/#Trusted_Advisor_-_manual_refresh)
- [Alert message in Slack configuration](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/#Alert_message_in_Slack_configuration)

### Opsgenie configuration

In the Opsgenie, let’s create a new CloudWatch integration, that will be used for the Trusted Advisor alerts.

Go to the Opsgenie _Settings > Integrations,_ and find the CloudWatch:

![](https://cdn-images-1.medium.com/max/733/0*G8i0J8cKe1mjeAE8.png)

Let’s name it “_TrustedAdvisor-Security_”:

![](https://cdn-images-1.medium.com/max/656/0*4on2NlknWntWXwEn.png)

Save it, but we will go back here later to configure Slack messages text.

### AWS Simple Notification Service configuration

AWS SNS needs to be configured in the _us-east-1_, N. Virginia, as some CloudWatch metrics are available only here, as it’s the very first (afaik) and oldest of the AWS data centers. так как часть метрик доступна Also, here we will configure CloudWatch Alarms.

Go to the SNS, create a new topic with the _Standart_ type, name it as _opsgenie-trustedadvisor-security-us-east-1-sns_ — seems to be a good idea to include a region and a service name to a SNS topic’s name:

![](https://cdn-images-1.medium.com/max/905/0*X5o7VH-HfSvBZV5y.png)

After the topic is created, add a Subscription:

![](https://cdn-images-1.medium.com/max/798/0*QCHZbB4vdcuSF2Zc.png)

Copy the URL from the Opsgenie integration:

![](https://cdn-images-1.medium.com/max/837/0*gxcKsgIELP4Y2rZh.png)

Go back to the SNS Subscription, specify the _Protocol_ == HTTPS, and insert the URL from Opsgenie:

![](https://cdn-images-1.medium.com/max/762/0*l61zzboq2J0ouOpk.png)

Save it, and let’s go to the CloudWatch.

### AWS Trusted Advisor: what to monitor?

in this example, we will use the _Security Groups — Specific Ports Unrestricted_, but what’s in general?

Go to the [AWS Trusted Advisor check reference](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html), check the list, and choose the most appropriate for you.

As for me, those checks seems to be most interesting:

**Cost optimization** :

- _Amazon RDS Idle DB Instances_
- _Idle Load Balancers_
- _Low Utilization Amazon EC2 Instances_
- _Unassociated Elastic IP Addresses_

**Performance** :

- _High Utilization Amazon EC2 Instances_
- _Amazon EC2 to EBS Throughput Optimization_

**Security** :

- _Security Groups — Specific Ports Unrestricted_
- _Security Groups — Unrestricted Access_
- _Amazon S3 Bucket Permissions_
- _Amazon RDS Security Group Access Risk_
- _ELB Security Groups_
- _Exposed Access Keys_

By doing so, keep in mind that all Trusted Advisor findings are divided into three severity levels: _Green_, _Yellow_, and _Red_.

For the _Security Groups — Specific Ports Unrestricted_ a level is determined by the following criteria (found them only in the Trusted Advisor Dashboard):

![](https://cdn-images-1.medium.com/max/631/0*oi597LxvD1HfYZBj.png)

- Green: Access to port 80, 25, 443, or 465 is unrestricted.
- Red: Access to port 20, 21, 1433, 1434, 3306, 3389, 4333, 5432, or 5500 is unrestricted.
- Yellow: Access to any other port is unrestricted.

For now, let’s use the Red level to be alerted.

### CloudWatch Alarms configuration

Go to the CloudWatch Alarms, create a new alert:

![](https://cdn-images-1.medium.com/max/1024/0*PrS_5unVJfDr2nss.png)

Кликаем _Select metrics_:

![](https://cdn-images-1.medium.com/max/1017/0*HwoXSWrQK54gCw01.png)

Find a necessary Trusted Advisor metric, in this current case it will be the _Security Groups — Specific Ports Unrestricted — RedResources_:

![](https://cdn-images-1.medium.com/max/1024/0*4lVZZWurDlSUcM9B.png)

Set up when to fire this alert: in the Statistic use _Simple Count_:

![](https://cdn-images-1.medium.com/max/1021/0*tAgWxpoQSQxw8FZl.png)

in the _Conditions_ choose _Greater/Equal_ and value of 1, in the _Additional configuration_ set the _Treat missing data as good_:

![](https://cdn-images-1.medium.com/max/792/0*Haea_MnfD0yUYpkl.png)

Next, configure _Actions:_ send a notification to the SNS topic, created above:

![](https://cdn-images-1.medium.com/max/748/0*X0yb8xQhCZOucIPj.png)

Set the alert’s name, optionally a description:

![](https://cdn-images-1.medium.com/max/1024/0*pCQUUbS2MZah2C_p.png)

And let’s go to test it: create a SecurityGroup with the Allow rule from _0.0.0.0/0_ to port 3306, so it must trigger the Red level:

![](https://cdn-images-1.medium.com/max/1024/0*QerXyhmQfiFmdWtK.png)

Save the new Alarm, and wait for the alert… Wait… Wait…

### Trusted Advisor refresh checks — frequency of updates

The reason for alerts not being triggered is how often Trusted Advisor refreshes its data: some checks are updated automatically, some — when you visit its dashboard or via AWS API or AWS CLI.

In our current case, let’s check the documentation of the [Security Groups — Specific Ports Unrestricted](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html#security-groups-specific-ports-unrestricted) check:

![](https://cdn-images-1.medium.com/max/1024/0*OmxyNuOqQ2eBXttX.png)

here we can see nothing about _refresh._ But -you can see the **Check ID**  — we will use it soon to update the check manually.

But for the [Amazon RDS Public Snapshots](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html#amazon-rds-public-snapshots) you can find, that it’s refreshed automatically several times per day, and you can not trigger its update manually:

![](https://cdn-images-1.medium.com/max/1024/0*4K63EAuKODVq9Df6.png)

#### Trusted Advisor — manual refresh

To run a manual refresh, we can:

1. just open the TrustedAdvisor Dashboard and expand the [Security Groups — Specific Ports Unrestricted](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html#security-groups-specific-ports-unrestricted)
2. can use the [RefreshTrustedAdvisorCheck](https://docs.aws.amazon.com/awssupport/latest/APIReference/API_RefreshTrustedAdvisorCheck.html) API call
3. or by using AWS CLI and the [refresh-trusted-advisor-check](https://docs.aws.amazon.com/cli/latest/reference/support/refresh-trusted-advisor-check.html) command

Let’s try with the CLI  -  use the command above, specify the AWS Region as _us-east-1_ (N. Virginia, where we did our alert), and in the `--check-id` set the ID mentioned above (also, you can get an ID by using the [aws support describe-trusted-advisor-checks](https://docs.aws.amazon.com/cli/latest/reference/support/describe-trusted-advisor-checks.html) command):

```
$ aws --region us-east-1 support refresh-trusted-advisor-check --check-id HCP4007jGY
{
  “status”: {
    “checkId”: “HCP4007jGY”,
    “status”: “enqueued”,
    “millisUntilNextRefreshable”: 3599991
  }
}
```

The _enqueued_ status means that the refresh request is accepted, and you’ll see the results in a few minutes.

if the status the field has the "_success_" value - then it was refreshed recently, and you have to wait for the `millisUntilNextRefreshable` (3599990 ms == 60 minutes).

Eventually, we’ve got the alert in our Opsgenie:

![](https://cdn-images-1.medium.com/max/1024/0*9u8uvZg8x7mW0EHL.png)

And a message in a Slack channel:

![](https://cdn-images-1.medium.com/max/630/0*OEYS_DGTp1qqbaLw.png)

### Alert message in Slack configuration

The text in the message above is useless now — we only see it was triggered.

Let’s add some info there — go to the Slack integration settings, click on the _Advanced_:

![](https://cdn-images-1.medium.com/max/1024/0*v03xF1ZtopXmnvK7.png)

And set the data you’d like to see there. For example, I’ve added two links — to the documentation, and Trusted Advisor’s dashboard:

![](https://cdn-images-1.medium.com/max/1024/0*wPeKkwWIDM0e0_4Z.png)

Run the check again:

![](https://cdn-images-1.medium.com/max/619/0*2AFRJRC_FT3o7bV6.png)

Done.

_Originally published at_ [_RTFM: Linux, DevOps, and system administration_](https://rtfm.co.ua/en/aws-trusted-advisor-part-2-cloudwatch-alarms-and-slack-notifications/)_._

* * *