Skip to main content

Aws/cloudwatch

@swamp/aws/cloudwatchv2026.10.31.1· AGPL-3.0-or-later· 1d agoBEHAVIORS
01README

AWS CLOUDWATCH infrastructure models

02Release Notes
  • Updated: access_grant, domain_access_grant_for_organization, domain_for_organization, omni_dashboard
03Behaviors18
access_grant.tsv2026.10.31.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringA name that identifies the access grant.
DomainIdstringThe ID of the domain the grant belongs to.
SpaceIdstringThe space this grant applies to. Domain-scoped grants are returned by ListDomainAccessGrantsForOrganization instead.
Principal?objectThe type of principal receiving the grant.
PermissionenumThe permission granted.
ScopedActions?arrayGroups of actions allowed by the grant, each with the resource scopes and conditions that limit those actions.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch AccessGrant
fn get(identifier: string)
Get a CloudWatch AccessGrant
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch AccessGrant
fn delete(identifier: string)
Delete a CloudWatch AccessGrant
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch AccessGrant
fn sync()
Sync CloudWatch AccessGrant state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch AccessGrant resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch AccessGrant resource state
access_profile.tsv2026.10.24.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
SpaceIdstringThe unique identifier of the space the access profile belongs to.
NamestringThe name of the access profile.
Description?stringThe description of the access profile.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch AccessProfile
fn get(identifier: string)
Get a CloudWatch AccessProfile
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch AccessProfile
fn update()
Update a CloudWatch AccessProfile
fn delete(identifier: string)
Delete a CloudWatch AccessProfile
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch AccessProfile
fn sync()
Sync CloudWatch AccessProfile state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch AccessProfile resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch AccessProfile resource state
alarm.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ThresholdMetricId?stringIn an alarm based on an anomaly detection model, this is the ID of the ANOMALY_DETECTION_BAND function used as the threshold for the alarm.
ComparisonOperator?stringThe arithmetic operation to use when comparing the specified statistic and threshold. The specified statistic value is used as the first operand.
EvaluationPeriods?numberThe number of periods over which data is compared to the specified threshold. If you are setting an alarm that requires that a number of consecutive data points be breaching to trigger the alarm, this value specifies that number. If you are setting an "M out of N" alarm, this value is the N, and DatapointsToAlarm is the M. For more information, see [Evaluating an Alarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarm-evaluation) in the *User Guide*.
Unit?stringThe unit of the metric associated with the alarm. Specify this only if you are creating an alarm based on a single metric. Do not specify this if you are specifying a Metrics array. You can specify the following values: Seconds, Microseconds, Milliseconds, Bytes, Kilobytes, Megabytes, Gigabytes, Terabytes, Bits, Kilobits, Megabits, Gigabits, Terabits, Percent, Count, Bytes/Second, Kilobytes/Second, Megabytes/Second, Gigabytes/Second, Terabytes/Second, Bits/Second, Kilobits/Second, Megabits/Second, Gigabits/Second, Terabits/Second, Count/Second, or None.
OKActions?arrayThe actions to execute when this alarm transitions to the OK state from any other state. Each action is specified as an Amazon Resource Name (ARN).
MetricName?stringThe name of the metric associated with the alarm. This is required for an alarm based on a metric. For an alarm based on a math expression, you use Metrics instead and you can't specify MetricName.
ActionsEnabled?booleanIndicates whether actions should be executed during any changes to the alarm state. The default is TRUE.
Metrics?arrayAn array that enables you to create an alarm based on the result of a metric math expression. Each item in the array either retrieves a metric or performs a math expression. If you specify the Metrics parameter, you cannot specify MetricName, Dimensions, Period, Namespace, Statistic, ExtendedStatistic, or Unit.
AlarmName?stringThe name of the alarm. If you don't specify a name, CFN generates a unique physical ID and uses that ID for the alarm name. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
Statistic?stringThe statistic for the metric associated with the alarm, other than percentile. For percentile statistics, use ExtendedStatistic. For an alarm based on a metric, you must specify either Statistic or ExtendedStatistic but not both. For an alarm based on a math expression, you can't specify Statistic. Instead, you use Metrics.
WarmUpConfiguration?objectThe length of the warm-up period, in minutes. After you create or update the alarm, the alarm stays in INSUFFICIENT_DATA for this duration. During this time, the alarm does not perform alarm actions. You can change this value at any time, including after the warm-up period ends. If you change it after the warm-up period ends, the new value does not restart the warm-up period.
EvaluationWindow?objectA wall clock window, which aligns the evaluated range to fixed clock boundaries that match the alarm's period, such as the top of the hour, midnight, or the start of the calendar week.
InsufficientDataActions?arrayThe actions to execute when this alarm transitions to the INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN).
EvaluationInterval?numberThe frequency, in seconds, at which the alarm is evaluated.
DatapointsToAlarm?numberThe number of datapoints that must be breaching to trigger the alarm. This is used only if you are setting an "M out of N" alarm. In that case, this value is the M, and the value that you set for EvaluationPeriods is the N value. For more information, see [Evaluating an Alarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarm-evaluation) in the *User Guide*. If you omit this parameter, CW uses the same value here that you set for EvaluationPeriods, and the alarm goes to alarm state if that many consecutive periods are breaching.
Tags?arrayA list of key-value pairs to associate with the alarm. You can associate as many as 50 tags with an alarm. To be able to associate tags with the alarm when you create the alarm, you must have the cloudwatch:TagResource permission. Tags can help you organize and categorize your resources. You can also use them to scope user permissions by granting a user permission to access or change only resources with certain tag values.
Threshold?numberThe value to compare with the specified statistic.
EvaluateLowSampleCountPercentile?stringUsed only for alarms based on percentiles. If ignore, the alarm state does not change during periods with too few data points to be statistically significant. If evaluate or this parameter is not used, the alarm is always evaluated and possibly changes state no matter how many data points are available.
ExtendedStatistic?stringThe percentile statistic for the metric associated with the alarm. Specify a value between p0.0 and p100. For an alarm based on a metric, you must specify either Statistic or ExtendedStatistic but not both. For an alarm based on a math expression, you can't specify ExtendedStatistic. Instead, you use Metrics.
TreatMissingData?stringSets how this alarm is to handle missing data points. Valid values are breaching, notBreaching, ignore, and missing. For more information, see [Configuring How Alarms Treat Missing Data](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data) in the *Amazon User Guide*. If you omit this parameter, the default behavior of missing is used.
Dimensions?arrayThe dimensions for the metric associated with the alarm. For an alarm based on a math expression, you can't specify Dimensions. Instead, you use Metrics.
Period?numberThe period, in seconds, over which the statistic is applied. This is required for an alarm based on a metric. Valid values are 10, 20, 30, 60, and any multiple of 60. For an alarm based on a math expression, you can't specify Period, and instead you use the Metrics parameter. *Minimum:* 10
EvaluationCriteria?objectThe PromQL criteria for the alarm evaluation.
Namespace?stringThe namespace of the metric associated with the alarm. This is required for an alarm based on a metric. For an alarm based on a math expression, you can't specify Namespace and you use Metrics instead. For a list of namespaces for metrics from AWS services, see [Services That Publish Metrics.](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html)
AlarmActions?arrayThe list of actions to execute when this alarm transitions into an ALARM state from any other state. Specify each action as an Amazon Resource Name (ARN). For more information about creating alarms and the actions that you can specify, see [PutMetricAlarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html) in the *API Reference*.
AlarmDescription?stringThe description of the alarm.
ActionConfiguration?objectWhether the alarm's tags are included in its action notifications and state-change events.
fn create()
Create a CloudWatch Alarm
fn get(identifier: string)
Get a CloudWatch Alarm
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Alarm
fn update()
Update a CloudWatch Alarm
fn delete(identifier: string)
Delete a CloudWatch Alarm
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Alarm
fn sync()
Sync CloudWatch Alarm state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch Alarm resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch Alarm resource state
alarm_mute_rule.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name?stringThe name of the AlarmMuteRule
Description?stringThe description of the AlarmMuteRule
Rule?objectThe expression of the schedule
MuteTargets?objectThe alarm names to be mute by the AlarmMuteRule
StartDate?stringThe date, with the same timezone offset as "ScheduleTimezone", after which the alarm mute rule will become active.
ExpireDate?stringThe date, with the same timezone offset as "ScheduleTimezone" after which the alarm mute rule will be expired.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch AlarmMuteRule
fn get(identifier: string)
Get a CloudWatch AlarmMuteRule
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch AlarmMuteRule
fn update()
Update a CloudWatch AlarmMuteRule
fn delete(identifier: string)
Delete a CloudWatch AlarmMuteRule
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch AlarmMuteRule
fn sync()
Sync CloudWatch AlarmMuteRule state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch AlarmMuteRule resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch AlarmMuteRule resource state
composite_alarm.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AlarmName?stringThe name of the Composite Alarm
AlarmRulestringExpression which aggregates the state of other Alarms (Metric or Composite Alarms)
AlarmDescription?stringThe description of the alarm
ActionsEnabled?booleanIndicates whether actions should be executed during any changes to the alarm state. The default is TRUE.
OKActions?arrayThe actions to execute when this alarm transitions to the OK state from any other state. Each action is specified as an Amazon Resource Name (ARN).
AlarmActions?arrayThe list of actions to execute when this alarm transitions into an ALARM state from any other state. Specify each action as an Amazon Resource Name (ARN).
InsufficientDataActions?arrayThe actions to execute when this alarm transitions to the INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN).
ActionsSuppressor?stringActions will be suppressed if the suppressor alarm is in the ALARM state. ActionsSuppressor can be an AlarmName or an Amazon Resource Name (ARN) from an existing alarm.
ActionsSuppressorWaitPeriod?numberActions will be suppressed if ExtensionPeriod is active. The length of time that actions are suppressed is in seconds.
ActionsSuppressorExtensionPeriod?numberActions will be suppressed if WaitPeriod is active. The length of time that actions are suppressed is in seconds.
ActionConfiguration?objectWhether the alarm's tags are included in its action notifications and state-change events.
Tags?arrayA list of key-value pairs to associate with the composite alarm. You can associate as many as 50 tags with an alarm.
fn create()
Create a CloudWatch CompositeAlarm
fn get(identifier: string)
Get a CloudWatch CompositeAlarm
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch CompositeAlarm
fn update()
Update a CloudWatch CompositeAlarm
fn delete(identifier: string)
Delete a CloudWatch CompositeAlarm
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch CompositeAlarm
fn sync()
Sync CloudWatch CompositeAlarm state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch CompositeAlarm resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch CompositeAlarm resource state
dashboard.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DashboardName?stringThe name of the dashboard. The name must be between 1 and 255 characters. If you do not specify a name, one will be generated automatically.
DashboardBodystringThe detailed information about the dashboard in JSON format, including the widgets to include and their location on the dashboard
Tags?arrayA list of key-value pairs to associate with the cloudwatch dashboard. You can associate up to 50 tags with a dashboard
fn create()
Create a CloudWatch Dashboard
fn get(identifier: string)
Get a CloudWatch Dashboard
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Dashboard
fn update()
Update a CloudWatch Dashboard
fn delete(identifier: string)
Delete a CloudWatch Dashboard
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Dashboard
fn sync()
Sync CloudWatch Dashboard state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch Dashboard resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch Dashboard resource state
domain.tsv2026.10.28.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringA name that identifies the domain.
IdentityProvidersarrayThe identity providers configured for the domain.
IdentityProviderConfiguration?objectIdentity Center configuration. Required when identityProviders includes IDC.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch Domain
fn get(identifier: string)
Get a CloudWatch Domain
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Domain
fn update()
Update a CloudWatch Domain
fn delete(identifier: string)
Delete a CloudWatch Domain
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Domain
fn sync()
Sync CloudWatch Domain state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch Domain resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch Domain resource state
domain_access_grant_for_organization.tsv2026.10.31.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringA name that identifies the access grant.
DomainIdstringThe ID of the organization domain the grant belongs to.
Principal?objectThe type of principal the grant is issued to.
PermissionenumThe permission granted.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch DomainAccessGrantForOrganization
fn get(identifier: string)
Get a CloudWatch DomainAccessGrantForOrganization
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch DomainAccessGrantForOrganization
fn delete(identifier: string)
Delete a CloudWatch DomainAccessGrantForOrganization
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch DomainAccessGrantForOrganization
fn sync()
Sync CloudWatch DomainAccessGrantForOrganization state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch DomainAccessGrantForOrganization resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch DomainAccessGrantForOrganization resource state
domain_for_organization.tsv2026.10.31.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringA name that identifies the organization domain.
IdentityProvidersarrayThe identity providers configured for the organization domain.
IdentityProviderConfiguration?objectIdentity Center configuration. Required when identityProviders includes IDC.
DomainAccessRoleArnstringThe ARN of the customer-provided IAM role in the management account used for domain access.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch DomainForOrganization
fn get(identifier: string)
Get a CloudWatch DomainForOrganization
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch DomainForOrganization
fn update()
Update a CloudWatch DomainForOrganization
fn delete(identifier: string)
Delete a CloudWatch DomainForOrganization
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch DomainForOrganization
fn sync()
Sync CloudWatch DomainForOrganization state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch DomainForOrganization resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch DomainForOrganization resource state
insight_rule.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
RuleNamestring
RuleStateenum
RuleBodystring
ApplyOnTransformedLogs?boolean
Tags?array
fn create()
Create a CloudWatch InsightRule
fn get(identifier: string)
Get a CloudWatch InsightRule
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch InsightRule
fn update()
Update a CloudWatch InsightRule
fn delete(identifier: string)
Delete a CloudWatch InsightRule
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch InsightRule
fn sync()
Sync CloudWatch InsightRule state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch InsightRule resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch InsightRule resource state
integration.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
IntegrationTypeenumThe type of integration. Immutable after creation.
NamestringThe customer-supplied name of the integration. Unique per account.
RoleArn?stringIAM role ARN the integration assumes. Required for AWS_INTEGRATION (a valid, service-assumable IAM role ARN). Not used by AWS_CONFIG_SLREC or EXTERNAL_AGENT.
IntegrationAttributes?recordType-specific configuration attributes (max 50 entries). EXTERNAL_AGENT requires 'catalogId'. On update, supplied attributes merge into the existing map; omitting a key does not remove it.
Credential?objectAPI-key credential material that can be rotated in place on update.
Tags?arrayTags associated with the integration.
fn create()
Create a CloudWatch Integration
fn get(identifier: string)
Get a CloudWatch Integration
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Integration
fn update()
Update a CloudWatch Integration
fn delete(identifier: string)
Delete a CloudWatch Integration
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Integration
fn sync()
Sync CloudWatch Integration state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch Integration resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch Integration resource state
log_alarm.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AlarmName?stringThe name of the log alarm.
AlarmDescription?stringThe description of the log alarm.
ActionsEnabled?booleanIndicates whether actions should be executed during any changes to the alarm state. The default is TRUE.
OKActions?arrayThe actions to execute when this alarm transitions to the OK state from any other state.
AlarmActions?arrayThe list of actions to execute when this alarm transitions into an ALARM state from any other state.
InsufficientDataActions?arrayThe actions to execute when this alarm transitions to the INSUFFICIENT_DATA state from any other state.
ThresholdnumberThe value to compare against the results of the scheduled query evaluation.
ComparisonOperatorstringThe arithmetic operation to use when comparing the specified threshold and the query results. Valid values are GreaterThanOrEqualToThreshold, GreaterThanThreshold, LessThanThreshold, and LessThanOrEqualToThreshold.
QueryResultsToEvaluatenumberThe number of query results over which data is compared to the specified threshold.
QueryResultsToAlarmnumberThe number of query results that must be breaching to trigger the alarm.
TreatMissingData?stringSets how this alarm is to handle missing data points. Valid values are breaching, notBreaching, ignore, and missing.
ScheduledQueryConfiguration?objectThe query string to execute against the specified log groups.
WarmUpConfiguration?objectThe length of the warm-up period, in minutes. For this duration after you create or update the alarm, the alarm stays in INSUFFICIENT_DATA and doesn't perform alarm actions. Valid values range from 1 to 2,880 minutes (2 days). You can change this value while the alarm is still in its warm-up period. Changes have no effect after the warm-up period ends.
ActionLogLineCount?numberThe number of log lines to include in alarm notifications. Valid values are 0 to 50.
ActionLogLineRoleArn?stringThe ARN of the IAM role that grants CloudWatch permissions to fetch log lines for alarm notifications. Required when ActionLogLineCount is greater than 0.
Tags?arrayA list of key-value pairs to associate with the log alarm.
ActionConfiguration?objectWhether the alarm's tags are included in its action notifications and state-change events.
fn create()
Create a CloudWatch LogAlarm
fn get(identifier: string)
Get a CloudWatch LogAlarm
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch LogAlarm
fn update()
Update a CloudWatch LogAlarm
fn delete(identifier: string)
Delete a CloudWatch LogAlarm
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch LogAlarm
fn sync()
Sync CloudWatch LogAlarm state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch LogAlarm resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch LogAlarm resource state
metric_stream.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ExcludeFilters?arrayDefine which metrics will be not streamed. Metrics matched by multiple instances of MetricStreamFilter are joined with an OR operation by default. If both IncludeFilters and ExcludeFilters are omitted, all metrics in the account will be streamed. IncludeFilters and ExcludeFilters are mutually exclusive. Default to null.
FirehoseArn?stringThe ARN of the Kinesis Firehose where to stream the data.
IncludeFilters?arrayDefine which metrics will be streamed. Metrics matched by multiple instances of MetricStreamFilter are joined with an OR operation by default. If both IncludeFilters and ExcludeFilters are omitted, all metrics in the account will be streamed. IncludeFilters and ExcludeFilters are mutually exclusive. Default to null.
Name?stringName of the metric stream.
RoleArn?stringThe ARN of the role that provides access to the Kinesis Firehose.
OutputFormat?stringThe output format of the data streamed to the Kinesis Firehose.
StatisticsConfigurations?arrayBy default, a metric stream always sends the MAX, MIN, SUM, and SAMPLECOUNT statistics for each metric that is streamed. You can use this parameter to have the metric stream also send additional statistics in the stream. This array can have up to 100 members.
Tags?arrayA set of tags to assign to the delivery stream.
IncludeLinkedAccountsMetrics?booleanIf you are creating a metric stream in a monitoring account, specify true to include metrics from source accounts that are linked to this monitoring account, in the metric stream. The default is false.
fn create()
Create a CloudWatch MetricStream
fn get(identifier: string)
Get a CloudWatch MetricStream
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch MetricStream
fn update()
Update a CloudWatch MetricStream
fn delete(identifier: string)
Delete a CloudWatch MetricStream
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch MetricStream
fn sync()
Sync CloudWatch MetricStream state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch MetricStream resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch MetricStream resource state
omni_dashboard.tsv2026.10.31.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
SpaceIdstringThe unique ID of the space to create the dashboard in.
NamestringA name that identifies the dashboard.
BodystringThe dashboard definition.
Description?stringAn optional description of the dashboard.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch OmniDashboard
fn get(identifier: string)
Get a CloudWatch OmniDashboard
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch OmniDashboard
fn update()
Update a CloudWatch OmniDashboard
fn delete(identifier: string)
Delete a CloudWatch OmniDashboard
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch OmniDashboard
fn sync()
Sync CloudWatch OmniDashboard state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch OmniDashboard resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch OmniDashboard resource state
otel_enrichment.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
IncludeFilters?arrayScopes enrichment to a subset of the account's telemetry. Absent or empty means all namespaces are in scope. Present means only these are. The service enforces a combined cap of 100 selectors across IncludeFilters and ExcludeFilters, and rejects more than one selector for the same namespace within a direction.
ExcludeFilters?arrayRemoves metrics from the include set. Absent or empty means nothing is removed. Evaluated after IncludeFilters, so ExcludeFilters always wins.
fn create()
Create a CloudWatch OTelEnrichment
fn get(identifier: string)
Get a CloudWatch OTelEnrichment
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch OTelEnrichment
fn update()
Update a CloudWatch OTelEnrichment
fn delete(identifier: string)
Delete a CloudWatch OTelEnrichment
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch OTelEnrichment
fn sync()
Sync CloudWatch OTelEnrichment state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch OTelEnrichment resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch OTelEnrichment resource state
resource_metrics_configuration.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ResourceArnstringThe Amazon Resource Name (ARN) of the resource for which the detailed monitoring metrics configuration is managed.
MetricSelections?arrayThe metric selections that define which metrics are enabled for detailed monitoring on the resource.
fn create()
Create a CloudWatch ResourceMetricsConfiguration
fn get(identifier: string)
Get a CloudWatch ResourceMetricsConfiguration
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch ResourceMetricsConfiguration
fn update()
Update a CloudWatch ResourceMetricsConfiguration
fn delete(identifier: string)
Delete a CloudWatch ResourceMetricsConfiguration
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch ResourceMetricsConfiguration
fn sync()
Sync CloudWatch ResourceMetricsConfiguration state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch ResourceMetricsConfiguration resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch ResourceMetricsConfiguration resource state
space.tsv2026.10.27.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the space.
DomainIdstringThe identifier of the domain the space belongs to.
DataAccessRoleArnstringThe Amazon Resource Name (ARN) of the IAM role the space uses to access observability data.
AgentCoreEvaluationRoleArn?stringThe Amazon Resource Name (ARN) of the IAM role used for AgentCore evaluation.
EncryptionConfiguration?objectWhether the space is encrypted with an AWS owned key or a customer managed key.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a CloudWatch Space
fn get(identifier: string)
Get a CloudWatch Space
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Space
fn update()
Update a CloudWatch Space
fn delete(identifier: string)
Delete a CloudWatch Space
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch Space
fn sync()
Sync CloudWatch Space state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch Space resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch Space resource state
view.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name?stringThe name of the view. Must begin with the "view." prefix followed by lowercase alphanumeric characters, hyphens, and underscores. View names must be unique within the account and region. If not specified, a name is generated.
DefinitionstringThe SQL query that defines the view.
Description?stringA description of the view.
Tags?arrayAn array of key-value pairs to apply to the view.
fn create()
Create a CloudWatch View
fn get(identifier: string)
Get a CloudWatch View
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch View
fn update()
Update a CloudWatch View
fn delete(identifier: string)
Delete a CloudWatch View
ArgumentTypeDescription
identifierstringThe primary identifier of the CloudWatch View
fn sync()
Sync CloudWatch View state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudWatch View resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudWatch View resource state
04Previous Versions19
2026.10.30.1AGPL-3.0-or-later
  • Updated: access_grant, domain_access_grant_for_organization
2026.10.29.1AGPL-3.0-or-later
  • Added: access_grant
2026.10.28.1AGPL-3.0-or-later
  • Added: domain
2026.10.27.1AGPL-3.0-or-later
  • Added: domain_access_grant_for_organization, space
2026.10.25.1AGPL-3.0-or-later
2026.10.24.1AGPL-3.0-or-later
  • Added: access_profile, domain_for_organization, omni_dashboard
2026.10.23.1AGPL-3.0-or-later
  • Updated: alarm, alarm_mute_rule, composite_alarm, dashboard, insight_rule, integration, log_alarm, metric_stream, otel_enrichment, resource_metrics_configuration, view
2026.10.16.1AGPL-3.0-or-later
  • Updated: alarm, composite_alarm, log_alarm

Added 1, removed 11 behaviors

2026.10.14.1AGPL-3.0-or-later(was none)

Removed 1 behaviors

2026.10.13.1
  • Updated: alarm, alarm_mute_rule, anomaly_detector, composite_alarm, dashboard, insight_rule, integration, log_alarm, metric_stream, otel_enrichment, resource_metrics_configuration, view

Added 1 behaviors

2026.10.08.1
  • Updated: composite_alarm, log_alarm, otel_enrichment
2026.10.07.1
  • Added: anomaly_detector

Added 1 behaviors

2026.10.06.1
2026.10.04.1
2026.10.03.1
  • Added: resource_metrics_configuration

Added 1 behaviors

2026.10.02.1
  • Updated: alarm
2026.10.01.1
2026.09.30.1
  • Added: view

Added 1 behaviors

2026.09.29.1
05Stats
A
100 / 100
Downloads
68
Archive size
3.6 MB
Verified by Swamp
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Docs keep secrets in a vault1/1earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
06Platforms
07Labels