Aws/alarm Investigation
CloudWatch alarm investigation and triage model.
Enriches CloudWatch alarms with metric activity, SNS subscription data, state-change history, and a verdict classifying each alarm as one of: healthy, stale, silent, noisy, orphaned, or unknown.
Authentication
Uses the AWS SDK default credential chain. Supply credentials through AWS
SSO or a named profile (--global-arg profile=<name>), or an attached IAM
role (instance profile, ECS task role). No credentials are stored in swamp.
Required IAM Permissions
{
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarms",
"cloudwatch:DescribeAlarmHistory",
"cloudwatch:GetMetricStatistics",
"sns:ListSubscriptionsByTopic"
],
"Resource": "*"
}Methods
investigate
Deep-dive enrichment for a single alarm by name. Fetches metric activity for
the last 24 hours, state-change history for the last 7 days, and SNS topic
subscription counts. Assigns a verdict and writes one alarm_detail resource.
swamp model method run <name> investigate alarmName="MyAlarm"triage
Fan-out enrichment across all (or filtered) alarms in the account. Writes one
alarm_detail resource per alarm plus a triage_summary resource with
aggregate verdict and state counts.
swamp model method run <name> triage
swamp model method run <name> triage stateFilter=ALARM limit=50Verdict Classifications
| Verdict | Condition |
|---|---|
| orphaned | INSUFFICIENT_DATA for > 365 days |
| silent | In ALARM with no alarm actions configured |
| stale | In ALARM for > 180 days |
| noisy | > 5 state changes in the last 7 days |
| healthy | OK, has actions, and has recent metric data points |
| unknown | None of the above patterns matched |
2026.10.21.1
Changed: Documentation only: the README and registry description no longer list environment
variables or a static shared-credentials file as a way to supply AWS
credentials. They now recommend AWS SSO or a named profile
(aws sso login --profile <name>, then --global-arg profile=<name>), or an
IAM role attached to where swamp runs. Credential resolution is unchanged: the
model still uses the AWS SDK default credential chain when profile is unset.
Upgrade note: No code, schema, or behavioral changes. The model version moves to 2026.10.21.1 with an identity upgrade.
Resources
2026.10.14.1
Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.
Upgrade note: Metadata only. No code, schema, or behavioral changes.
2026.09.24.1
Changed: Bump @aws-sdk/* 3.1133.0 → 3.1139.0 (3 packages)
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
2026.09.24.1
Changed: Bump @aws-sdk/* 3.1133.0 → 3.1139.0 (3 packages)
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
2026.09.17.1
Changed: Bump @aws-sdk/* 3.1131.0 → 3.1133.0 (3 packages)
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.14.1
Changed: Bump @aws-sdk/* 3.1126.0 → 3.1131.0 (3 packages)
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (3 packages)
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.14.1
Changed: Bump @aws-sdk/* 3.1126.0 → 3.1131.0 (3 packages)
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (3 packages)
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (3 packages)
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.25.1
Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.
updated labels
2026.08.24.1
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.23.1
Changed: Documentation only — no code changes. Documented the previously
undocumented profile global arg for SSO/fromIni auth. Added a
## Troubleshooting section covering enrichAlarm's per-alarm degrade to
verdict: "unknown", the silent empty sns_topics catch in resolveSnsTopics,
getRecentMetricStats's silent null return for composite/anomaly-detection
alarms, and the unpaginated 100-record cap on noisy-alarm counts.
2026.08.21.1
Changed: DescribeAlarms and DescribeAlarmHistory failures now name the
operation, the alarm name (or state filter, for triage), and region instead
of propagating the raw AWS SDK exception. Previously a throttling or
permissions error surfaced with no indication of which alarm or call was
responsible.
investigate's alarmName argument now rejects an empty string before any
API call is made, instead of sending an empty AlarmNames filter to
CloudWatch and reporting a generic "alarm not found".
2026.08.20.1
Changed: Bump @aws-sdk/* 3.1111.0 → 3.1114.0 (3 packages)
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned