<p>From what I know of AWS Config there's no way at the moment to directly publish a metric from which you can base an alarm.</p>

<p>If the notification has to come from a Cloudwatch alarm then AWS Config will let you execute Lambda based on rules set up in AWS Config - <a href="http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs-sample.html" rel="nofollow noreferrer">link</a>.</p>

<p>If you want a simpler option AWS Config also lets you publish directly to an SNS topic when your rule is evaluated - <a href="http://docs.aws.amazon.com/config/latest/developerguide/notifications-for-AWS-Config.html" rel="nofollow noreferrer">link</a></p>

<p>Failing this you can also watch for CloudTrail events and then publish a CloudWatch metric which you can base an alarm on. This is fairly in depth though and if the important part is getting the emails to be looked at by a person then your best bet is probably to have AWS Config publish directly to SNS itself.</p>

CC BY-SA 3.0
2017-08-11T20:04:48.307Z
2017-08-11T20:04:48.307Z
Briansbum
<p>I have a set of rules in my AWS Config dashboard. And, I want to set a AWS CloudWatch alarm to be triggered whenever Config detects non-compliant resource(s).</p>

<p>[The plan is to link that alarm to an SNS topic for sending out emails to the team for any non-compliant event/resource]</p>

<p>Is there a straightforward way to do that? Or is there a workaround for the same?</p>

<hr>

<p>I went through the available metrics in the Cloudwatch dashboard, but haven't found anything related to AWS Config.</p>

<amazon-cloudwatch>
How to set CloudWatch alarms for non-compliancy in AWS Config rules?
Dawny33
# How to set CloudWatch alarms for non-compliancy in AWS Config rules?

(Asked by: username_0 on 2017-07-20)

I have a set of rules in my AWS Config dashboard. And, I want to set a AWS CloudWatch alarm to be triggered whenever Config detects non-compliant resource(s).

[The plan is to link that alarm to an SNS topic for sending out emails to the team for any non-compliant event/resource]

Is there a straightforward way to do that? Or is there a workaround for the same?

---

I went through the available metrics in the Cloudwatch dashboard, but haven't found anything related to AWS Config.

**Tags:** amazon-cloudwatch


---

## 1 answers

### Answer by username_1 on 2017-08-11. Score: 1

From what I know of AWS Config there's no way at the moment to directly publish a metric from which you can base an alarm.

If the notification has to come from a Cloudwatch alarm then AWS Config will let you execute Lambda based on rules set up in AWS Config - [link](http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs-sample.html).

If you want a simpler option AWS Config also lets you publish directly to an SNS topic when your rule is evaluated - [link](http://docs.aws.amazon.com/config/latest/developerguide/notifications-for-AWS-Config.html)

Failing this you can also watch for CloudTrail events and then publish a CloudWatch metric which you can base an alarm on. This is fairly in depth though and if the important part is getting the emails to be looked at by a person then your best bet is probably to have AWS Config publish directly to SNS itself.


---

