Repository navigation
feat(cloudformation): Add DevOps Agent alarm investigations template - #38
Open
LorenzoBoccaccia wants to merge 1 commit into
Open
LorenzoBoccaccia wants to merge 1 commit into
LorenzoBoccaccia wants to merge 1 commit into
Conversation
LorenzoBoccaccia
force-pushed
the
add-alarm-investigations-cfn
branch
from
August 18, 2026 09:08
d636396 to
6189121
Compare
yprikhodko
reviewed
Aug 18, 2026
LorenzoBoccaccia
force-pushed
the
add-alarm-investigations-cfn
branch
2 times, most recently
from
August 19, 2026 07:51
90b32a0 to
9239bc0
Compare
LorenzoBoccaccia
force-pushed
the
add-alarm-investigations-cfn
branch
3 times, most recently
from
September 10, 2026 14:12
a301d6c to
c43418b
Compare
LorenzoBoccaccia
force-pushed
the
add-alarm-investigations-cfn
branch
from
September 30, 2026 12:45
c43418b to
2a01a9c
Compare
LorenzoBoccaccia
force-pushed
the
add-alarm-investigations-cfn
branch
from
October 8, 2026 13:46
2a01a9c to
edfa7cd
Compare
Forward a list of CloudWatch alarms to a DevOps Agent generic webhook so each alarm opens an investigation. An EventBridge rule scoped to the alarm ARNs matches ALARM state changes, an input transformer builds the incident payload titled with the alarm name, and an API destination POSTs it through an API key connection, so the key is stored once per stack. No Lambda function is involved. Move devops-agent-skill-policies.yaml into its own directory and give it a README so each template is self-documenting, update the links that referenced the old path, and describe both templates in llms.txt.
LorenzoBoccaccia
force-pushed
the
add-alarm-investigations-cfn
branch
from
October 21, 2026 12:38
edfa7cd to
28a5728
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
cloudformation/devops-agent-alarm-investigations/, a template that forwardsCloudWatch alarms to an AWS DevOps Agent generic webhook so each alarm opens an
investigation. Also moves the skill-policies template into its own directory with a
README, and updates the links to it.
The template has no code. One stack serves a list of alarm ARNs:
CloudWatch Alarm State ChangetoALARMfor those ARNs.Authorization: Bearer <key>. The key is stored once per stack.events:InvokeApiDestinationon that destination only.incidentIdis the EventBridge event id, which stays the same across retries, soredeliveries are deduplicated. The template uses an API key rather than HMAC because
EventBridge connections cannot sign each request; HMAC would need a signing Lambda.
Type of change
Testing
Not a skill, so the skill evaluation tool does not apply.
validate-templatepasses: 5 parameters,CAPABILITY_IAM.ALARM.AWS/EventsshowedTriggeredRules 1,SuccessfulInvocationAttempts 1,FailedInvocations 0. The Agent Space received anINVESTIGATIONtask carrying the alarm ARN, with the EventBridge event id as itsreference.referenceId.alarm named
quote"back\slash'apos. The message was valid JSON and the title and ARNcame through unchanged.
DevOpsAgentAlarmIntegrationTag: with a value it tags the rule and role; left empty,the tag value is the stack name.
Known behaviour, documented in the README: an alarm that already appears in an earlier
incident is attached to it as
LINKED, even if that incident is closed, instead ofopening a new investigation. This comes from DevOps Agent correlation, not the template.