Skip to main content
emisar

AWS CloudWatch operations

v0.1.13

Metric + alarm + log group + log stream + log query introspection. Read-only. Auth via AWS_PROFILE.

7 allowed by default
Pack ID
aws-cloudwatch
Vendor
emisar
OS
linux
Actions
7
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
aws

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install aws-cloudwatch --hash sha256:24f1e69d67d9872fac0ea88516656d50537ba54342c3a32d57022abd98a100f7

Setup

Drives the aws CLI on the runner host. It resolves credentials and region from its own environment or ~/.aws config — the runner only forwards the variables you allowlist in inherit_env .

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • AWS_PROFILE

    Named profile in ~/.aws/config and ~/.aws/credentials . Omit to use the default profile or static-key/instance-role auth.

  • AWS_REGION required

    Region to query; CloudWatch is regional, so calls fail without it.

  • AWS_ACCESS_KEY_ID

    Static access key. Use instead of a profile; pair with AWS_SECRET_ACCESS_KEY .

  • AWS_SECRET_ACCESS_KEY

    Secret for AWS_ACCESS_KEY_ID .

  • AWS_SESSION_TOKEN

    Session token for temporary (STS) credentials.

Notes

  • An EC2 instance role or ECS task role needs no key at all and is the shape to prefer; a static pair is minted from the IAM users console → the user → Security credentials → Create access key.
  • Alternative to env keys: an ~/.aws/credentials profile (read from disk, no inherit_env entry) or, on EC2/ECS, the instance/task role from instance metadata (no credentials needed at all).
  • Principal needs read access to CloudWatch and Logs (e.g. cloudwatch:DescribeAlarms / GetMetricStatistics / ListMetrics and logs:DescribeLogGroups / DescribeLogStreams / GetLogEvents / FilterLogEvents).

Verify it works

Runs cw.describe_alarms, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify aws-cloudwatch

Install and configure a pack walks through the whole sequence on a host.

Actions 7 total

View on GitHub
  • cw.alarms_in_alarm exec low Low — read-only or trivially reversible

    aws cloudwatch describe-alarms --state-value ALARM

    List only currently-firing alarms.

    View source on GitHub
  • cw.describe_alarms exec low Low — read-only or trivially reversible

    aws cloudwatch describe-alarms

    List all CloudWatch alarms with state + threshold.

    View source on GitHub
  • cw.get_metric_statistics script low Low — read-only or trivially reversible

    aws cloudwatch get-metric-statistics

    Get Average and Maximum for one metric over a trailing window ending now, by default the last hour at 5-minute periods. The window reaches 455 days, CloudWatch's retention: 1-minute points exist for 15 days, 5-minute points for 63 days, and hourly points after that, so an older window needs a matching period. One call returns at most 1440 data points, so window / period must fit. Dimensions select one series (Name=InstanceId,Value=i-…); without them CloudWatch returns only data published without dimensions.

    View source on GitHub
  • cw.list_metrics exec low Low — read-only or trivially reversible

    aws cloudwatch list-metrics --namespace

    List all metrics in one namespace.

    View source on GitHub
  • cw.log_groups exec low Low — read-only or trivially reversible

    aws logs describe-log-groups

    List all CloudWatch log groups.

    View source on GitHub
  • cw.log_streams exec low Low — read-only or trivially reversible

    aws logs describe-log-streams

    List streams for one log group, sorted by last event time.

    View source on GitHub
  • cw.log_tail exec medium Medium — changes state, easily reversible

    aws logs tail

    Tail recent log events for one log group (no follow).

    View source on GitHub
← Back to registry
Pack reference  Publish your own