# you can disable an alarm notification by setting the 'to' line to: silent

# AWS CloudWatch metrics are delayed. These alerts use sustained lookups against
# the currently shipped stock profile periods instead of lowering collection
# periods and increasing CloudWatch query cost.

# --- EC2 ---

# AWS recommended: StatusCheckFailed Maximum >= 1, 300s period, 2/2 datapoints.

 template: aws_cloudwatch_ec2_status_check_failed
       on: cloudwatch.ec2.status_check_failed
    class: Availability
     type: Other
component: AWS EC2
   lookup: min -10m unaligned of failed
    units: status
    every: 1m
     crit: $this != nan AND $this >= 1
    delay: down 5m multiplier 1.5 max 1h
  summary: EC2 status check failed on ${label:instance_id}
     info: EC2 instance ${label:instance_id} in ${label:region} has failed AWS status checks.
       to: sysadmin

# AWS recommended: StatusCheckFailed_AttachedEBS Maximum >= 1, 60s period, 10/10 datapoints.
# Current stock profile period is 300s, so this preserves 10 datapoints as a 50m window.

 template: aws_cloudwatch_ec2_attached_ebs_status_check_failed
       on: cloudwatch.ec2.status_check_failed
    class: Availability
     type: Other
component: AWS EC2
   lookup: min -50m unaligned of attached_ebs
    units: status
    every: 1m
     crit: $this != nan AND $this >= 1
    delay: down 5m multiplier 1.5 max 1h
  summary: EC2 attached EBS status check failed on ${label:instance_id}
     info: EC2 instance ${label:instance_id} in ${label:region} has an attached EBS volume failing AWS status checks.
       to: sysadmin

# --- ALB / NLB target health ---

# AWS recommended: ALB UnHealthyHostCount Minimum > 0 for more than one datapoint.

 template: aws_cloudwatch_alb_target_group_unhealthy_hosts
       on: cloudwatch.alb_target_health.unhealthy_hosts
    class: Availability
     type: Other
component: AWS ALB
   lookup: min -10m unaligned of unhealthy
    units: hosts
    every: 1m
     warn: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: ALB target group has unhealthy targets on ${label:load_balancer}/${label:target_group}
     info: ALB target group ${label:target_group} on load balancer ${label:load_balancer} in ${label:region} has sustained unhealthy registered targets.
       to: sysadmin

# AWS recommended: NLB UnHealthyHostCount Minimum > 0.

 template: aws_cloudwatch_nlb_target_group_unhealthy_hosts
       on: cloudwatch.nlb_target_health.unhealthy_hosts
    class: Availability
     type: Other
component: AWS NLB
   lookup: min -10m unaligned of unhealthy
    units: hosts
    every: 1m
     warn: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: NLB target group has unhealthy targets on ${label:load_balancer}/${label:target_group}
     info: NLB target group ${label:target_group} on load balancer ${label:load_balancer} in ${label:region} has sustained unhealthy registered targets.
       to: sysadmin

# --- EBS ---

# AWS recommended: VolumeStalledIOCheck Maximum >= 1, 60s period, 10/10 datapoints.
# This alert binds only when the disabled ebs_stalled_io profile is explicitly selected.

 template: aws_cloudwatch_ebs_stalled_io_check_failed
       on: cloudwatch.ebs_stalled_io.stalled_io_check
    class: Availability
     type: Other
component: AWS EBS
   lookup: min -10m unaligned of stalled
    units: status
    every: 1m
     crit: $this != nan AND $this >= 1
    delay: down 5m multiplier 1.5 max 1h
  summary: EBS volume stalled I/O check failed on ${label:volume_id}
     info: EBS volume ${label:volume_id} in ${label:region} has failed AWS stalled I/O checks.
       to: sysadmin

# --- NAT Gateway ---

# AWS recommended: ErrorPortAllocation Sum > 0, 60s period, 15/15 datapoints.
# The profile stores CloudWatch sums as rates; any sustained non-zero rate means errors occurred.

 template: aws_cloudwatch_nat_gateway_port_allocation_errors
       on: cloudwatch.nat_gateway.errors
    class: Errors
     type: Other
component: AWS NAT Gateway
   lookup: min -15m unaligned of port_allocation
    units: errors/s
    every: 1m
     crit: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: NAT Gateway port allocation errors on ${label:nat_gateway_id}
     info: NAT Gateway ${label:nat_gateway_id} in ${label:region} is reporting source-port allocation failures.
       to: sysadmin

# --- EFS ---

# AWS recommended: PercentIOLimit Average >= 100, 60s period, 15/15 datapoints.

 template: aws_cloudwatch_efs_io_limit_reached
       on: cloudwatch.efs.io_limit
    class: Utilization
     type: Other
component: AWS EFS
   lookup: min -15m unaligned of io_limit
    units: percentage
    every: 1m
     warn: $this != nan AND $this >= 100
    delay: down 5m multiplier 1.5 max 1h
  summary: EFS I/O limit reached on ${label:file_system_id}
     info: EFS file system ${label:file_system_id} in ${label:region} is at its AWS PercentIOLimit threshold.
       to: sysadmin

# AWS recommended: BurstCreditBalance Average <= 0, 60s period, 15/15 datapoints.

 template: aws_cloudwatch_efs_burst_credits_exhausted
       on: cloudwatch.efs.burst_credit
    class: Utilization
     type: Other
component: AWS EFS
   lookup: max -15m unaligned of balance
    units: bytes
    every: 1m
     warn: $this != nan AND $this <= 0
    delay: down 5m multiplier 1.5 max 1h
  summary: EFS burst credits exhausted on ${label:file_system_id}
     info: EFS file system ${label:file_system_id} in ${label:region} has exhausted burst credits.
       to: sysadmin

# --- ECS ---

# AWS recommended: CPUUtilization Average > 80, 60s period, 5/5 datapoints.
# Current stock profile period is 300s, so this preserves 5 datapoints as a 25m window.

 template: aws_cloudwatch_ecs_cpu_utilization
       on: cloudwatch.ecs.utilization
    class: Utilization
     type: Other
component: AWS ECS
   lookup: min -25m unaligned of cpu
    units: percentage
    every: 1m
     warn: $this != nan AND $this > 80
    delay: down 5m multiplier 1.5 max 1h
  summary: ECS service CPU utilization high on ${label:cluster_name}/${label:service_name}
     info: ECS service ${label:service_name} in cluster ${label:cluster_name} (${label:region}) has sustained CPU utilization above the AWS recommended alarm threshold.
       to: sysadmin

# AWS recommended: MemoryUtilization Average > 80, 60s period, 5/5 datapoints.

 template: aws_cloudwatch_ecs_memory_utilization
       on: cloudwatch.ecs.utilization
    class: Utilization
     type: Other
component: AWS ECS
   lookup: min -25m unaligned of memory
    units: percentage
    every: 1m
     warn: $this != nan AND $this > 80
    delay: down 5m multiplier 1.5 max 1h
  summary: ECS service memory utilization high on ${label:cluster_name}/${label:service_name}
     info: ECS service ${label:service_name} in cluster ${label:cluster_name} (${label:region}) has sustained memory utilization above the AWS recommended alarm threshold.
       to: sysadmin

# AWS recommended: EBSFilesystemUtilization Average > 80, 60s period, 5/5 datapoints.

 template: aws_cloudwatch_ecs_ebs_filesystem_utilization
       on: cloudwatch.ecs.ebs_filesystem_utilization
    class: Utilization
     type: Other
component: AWS ECS
   lookup: min -25m unaligned of ebs_filesystem
    units: percentage
    every: 1m
     warn: $this != nan AND $this > 80
    delay: down 5m multiplier 1.5 max 1h
  summary: ECS EBS filesystem utilization high on ${label:cluster_name}/${label:service_name}
     info: ECS service ${label:service_name} in cluster ${label:cluster_name} (${label:region}) has sustained EBS filesystem utilization above the AWS recommended alarm threshold.
       to: sysadmin

# --- OpenSearch ---

# AWS recommended: ClusterStatus.red Maximum >= 1, 1 datapoint.

 template: aws_cloudwatch_opensearch_cluster_status_red
       on: cloudwatch.opensearch.cluster_status
    class: Availability
     type: Other
component: AWS OpenSearch
   lookup: max -5m unaligned of red
    units: status
    every: 1m
     crit: $this != nan AND $this >= 1
    delay: down 5m multiplier 1.5 max 1h
  summary: OpenSearch cluster red on ${label:domain_name}
     info: OpenSearch domain ${label:domain_name} in ${label:region} is reporting red cluster status.
       to: sysadmin

# AWS recommended: ClusterStatus.yellow Maximum >= 1 for sustained datapoints.

 template: aws_cloudwatch_opensearch_cluster_status_yellow
       on: cloudwatch.opensearch.cluster_status
    class: Availability
     type: Other
component: AWS OpenSearch
   lookup: min -15m unaligned of yellow
    units: status
    every: 1m
     warn: $this != nan AND $this >= 1
    delay: down 5m multiplier 1.5 max 1h
  summary: OpenSearch cluster yellow on ${label:domain_name}
     info: OpenSearch domain ${label:domain_name} in ${label:region} is reporting yellow cluster status.
       to: sysadmin

# AWS recommended: ClusterIndexWritesBlocked Maximum >= 1.

 template: aws_cloudwatch_opensearch_index_writes_blocked
       on: cloudwatch.opensearch.index_writes_blocked
    class: Errors
     type: Other
component: AWS OpenSearch
   lookup: max -5m unaligned of blocked
    units: status
    every: 1m
     crit: $this != nan AND $this >= 1
    delay: down 5m multiplier 1.5 max 1h
  summary: OpenSearch index writes blocked on ${label:domain_name}
     info: OpenSearch domain ${label:domain_name} in ${label:region} is blocking index write requests.
       to: sysadmin

# AWS recommended: JVMMemoryPressure Maximum >= 95, 60s period, 3/3 datapoints.

 template: aws_cloudwatch_opensearch_jvm_memory_pressure
       on: cloudwatch.opensearch.jvm_memory_pressure
    class: Utilization
     type: Other
component: AWS OpenSearch
   lookup: min -15m unaligned of pressure
    units: percentage
    every: 1m
     crit: $this != nan AND $this >= 95
    delay: down 5m multiplier 1.5 max 1h
  summary: OpenSearch JVM memory pressure high on ${label:domain_name}
     info: OpenSearch domain ${label:domain_name} in ${label:region} has sustained JVM memory pressure above the AWS recommended alarm threshold.
       to: sysadmin

# AWS recommended: CPUUtilization Maximum >= 80, sustained 15m.

 template: aws_cloudwatch_opensearch_cpu_utilization
       on: cloudwatch.opensearch.cpu
    class: Utilization
     type: Other
component: AWS OpenSearch
   lookup: min -15m unaligned of maximum
    units: percentage
    every: 1m
     warn: $this != nan AND $this >= 80
    delay: down 5m multiplier 1.5 max 1h
  summary: OpenSearch CPU utilization high on ${label:domain_name}
     info: OpenSearch domain ${label:domain_name} in ${label:region} has sustained maximum CPU utilization above the AWS recommended alarm threshold.
       to: sysadmin

# AWS recommended: AutomatedSnapshotFailure Maximum >= 1, 1 datapoint.

 template: aws_cloudwatch_opensearch_automated_snapshot_failure
       on: cloudwatch.opensearch.automated_snapshot_failure
    class: Errors
     type: Other
component: AWS OpenSearch
   lookup: max -5m unaligned of failure
    units: status
    every: 1m
     warn: $this != nan AND $this >= 1
    delay: down 5m multiplier 1.5 max 1h
  summary: OpenSearch automated snapshot failed on ${label:domain_name}
     info: OpenSearch domain ${label:domain_name} in ${label:region} has a failed automated snapshot.
       to: sysadmin

# AWS recommended: OldGenJVMMemoryPressure Maximum >= 80, 60s period, 3/3 datapoints.

 template: aws_cloudwatch_opensearch_old_gen_jvm_memory_pressure
       on: cloudwatch.opensearch.old_gen_jvm_memory_pressure
    class: Utilization
     type: Other
component: AWS OpenSearch
   lookup: min -15m unaligned of pressure
    units: percentage
    every: 1m
     warn: $this != nan AND $this >= 80
    delay: down 5m multiplier 1.5 max 1h
  summary: OpenSearch old-gen JVM memory pressure high on ${label:domain_name}
     info: OpenSearch domain ${label:domain_name} in ${label:region} has sustained old-generation JVM memory pressure above the AWS recommended alarm threshold.
       to: sysadmin

# --- ElastiCache ---

# AWS recommended: EngineCPUUtilization Average > 90, 60s period, 5/5 datapoints.
# Current stock profile period is 300s, so this preserves 5 datapoints as a 25m window.

 template: aws_cloudwatch_elasticache_engine_cpu_utilization
       on: cloudwatch.elasticache.cpu
    class: Utilization
     type: Other
component: AWS ElastiCache
   lookup: min -25m unaligned of engine
    units: percentage
    every: 1m
     warn: $this != nan AND $this > 90
    delay: down 5m multiplier 1.5 max 1h
  summary: ElastiCache engine CPU utilization high on ${label:cache_cluster_id}/${label:cache_node_id}
     info: ElastiCache node ${label:cache_cluster_id}/${label:cache_node_id} in ${label:region} has sustained engine CPU utilization above the AWS recommended alarm threshold.
       to: sysadmin

# --- MSK ---

# Common practice: ActiveControllerCount below 1 indicates no active controller.

 template: aws_cloudwatch_msk_active_controller_missing
       on: cloudwatch.msk_cluster.active_controllers
    class: Availability
     type: Other
component: AWS MSK
   lookup: max -15m unaligned of active
    units: controllers
    every: 1m
     warn: $this != nan AND $this < 1
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK cluster has no active controller on ${label:cluster_name}
     info: MSK cluster ${label:cluster_name} in ${label:region} has had no active controller for a sustained period.
       to: sysadmin

# Common practice: ActiveControllerCount greater than 1 indicates multiple active controllers.

 template: aws_cloudwatch_msk_multiple_active_controllers
       on: cloudwatch.msk_cluster.active_controllers
    class: Availability
     type: Other
component: AWS MSK
   lookup: min -15m unaligned of active
    units: controllers
    every: 1m
     warn: $this != nan AND $this > 1
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK cluster has multiple active controllers on ${label:cluster_name}
     info: MSK cluster ${label:cluster_name} in ${label:region} has had more than one active controller for a sustained period.
       to: sysadmin

# Common practice: OfflinePartitionsCount above 0 means partitions are unavailable.

 template: aws_cloudwatch_msk_offline_partitions
       on: cloudwatch.msk_cluster.offline_partitions
    class: Availability
     type: Other
component: AWS MSK
   lookup: min -15m unaligned of offline
    units: partitions
    every: 1m
     warn: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK cluster has offline partitions on ${label:cluster_name}
     info: MSK cluster ${label:cluster_name} in ${label:region} has had offline partitions for a sustained period.
       to: sysadmin

# AWS best practice: keep broker CpuUser + CpuSystem under 60%.

 template: aws_cloudwatch_msk_cpu_utilization
       on: cloudwatch.msk.cpu
    class: Utilization
     type: Other
component: AWS MSK
   lookup: min -15m unaligned of user,system
    units: percentage
    every: 1m
     warn: $this != nan AND $this > 60
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK broker CPU utilization high on ${label:cluster_name}/${label:broker_id}
     info: MSK broker ${label:broker_id} in cluster ${label:cluster_name} (${label:region}) has sustained CpuUser plus CpuSystem above the AWS best-practice threshold.
       to: sysadmin

# AWS best practice: create an alarm when KafkaDataLogsDiskUsed reaches 85%.

 template: aws_cloudwatch_msk_data_logs_disk_used
       on: cloudwatch.msk.disk_used
    class: Utilization
     type: Other
component: AWS MSK
   lookup: min -15m unaligned of data_logs
    units: percentage
    every: 1m
     warn: $this != nan AND $this >= 85
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK broker data-log disk utilization high on ${label:cluster_name}/${label:broker_id}
     info: MSK broker ${label:broker_id} in cluster ${label:cluster_name} (${label:region}) has sustained data-log disk utilization above the AWS best-practice threshold.
       to: sysadmin

# AWS best practice: alarm when HeapMemoryAfterGC is above 60%.

 template: aws_cloudwatch_msk_heap_memory_after_gc
       on: cloudwatch.msk.heap_memory_after_gc
    class: Utilization
     type: Other
component: AWS MSK
   lookup: min -15m unaligned of used
    units: percentage
    every: 1m
     warn: $this != nan AND $this > 60
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK broker heap memory after GC high on ${label:cluster_name}/${label:broker_id}
     info: MSK broker ${label:broker_id} in cluster ${label:cluster_name} (${label:region}) has sustained heap memory after GC above the AWS best-practice threshold.
       to: sysadmin

# Common practice: Kafka UnderReplicatedPartitions above 0 warrants investigation when sustained.
# MSK rolling operations can temporarily increase under-replicated partitions, so this uses a
# longer window than the other MSK warnings.

 template: aws_cloudwatch_msk_under_replicated_partitions
       on: cloudwatch.msk.partitions
    class: Availability
     type: Other
component: AWS MSK
   lookup: min -30m unaligned of under_replicated
    units: partitions
    every: 1m
     warn: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK broker has sustained under-replicated partitions on ${label:cluster_name}/${label:broker_id}
     info: MSK broker ${label:broker_id} in cluster ${label:cluster_name} (${label:region}) has had under-replicated partitions for a sustained period. This can happen during planned MSK rolling maintenance, but outside expected maintenance it means replicas are not fully caught up.
       to: sysadmin

# Common practice: Kafka UnderMinIsrPartitionCount above 0 means partitions are below configured
# minimum in-sync replicas and may affect availability for producers requiring acks=all.

 template: aws_cloudwatch_msk_under_min_isr_partitions
       on: cloudwatch.msk.under_min_isr
    class: Availability
     type: Other
component: AWS MSK
   lookup: min -15m unaligned of under_min_isr
    units: partitions
    every: 1m
     warn: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: MSK broker has partitions below minimum ISR on ${label:cluster_name}/${label:broker_id}
     info: MSK broker ${label:broker_id} in cluster ${label:cluster_name} (${label:region}) has had partitions below the configured minimum in-sync replica count for a sustained period.
       to: sysadmin

# --- RDS ---

# AWS recommended: ReplicaLag Maximum > 60s, 60s period, 10/10 datapoints.
# Current stock profile period is 300s, so this preserves 10 datapoints as a 50m window.

 template: aws_cloudwatch_rds_replica_lag
       on: cloudwatch.rds.replica_lag
    class: Latency
     type: Other
component: AWS RDS
   lookup: min -50m unaligned of lag
    units: seconds
    every: 1m
     warn: $this != nan AND $this > 60
    delay: down 5m multiplier 1.5 max 1h
  summary: RDS replica lag high on ${label:db_instance_identifier}
     info: RDS instance ${label:db_instance_identifier} in ${label:region} has sustained replica lag above the AWS recommended alarm threshold.
       to: sysadmin

# AWS recommended: MaximumUsedTransactionIDs Average > 1e9, 60s period, 1 datapoint.

 template: aws_cloudwatch_rds_maximum_used_transaction_ids
       on: cloudwatch.rds.maximum_used_transaction_ids
    class: Errors
     type: Other
component: AWS RDS
   lookup: max -5m unaligned of used
    units: transactions
    every: 1m
     crit: $this != nan AND $this > 1000000000
    delay: down 5m multiplier 1.5 max 1h
  summary: RDS transaction ID usage high on ${label:db_instance_identifier}
     info: RDS instance ${label:db_instance_identifier} in ${label:region} is above the AWS recommended transaction ID alarm threshold.
       to: sysadmin

# AWS recommended: EBSByteBalance% Average < 10, 60s period, 3/3 datapoints.

 template: aws_cloudwatch_rds_ebs_byte_balance
       on: cloudwatch.rds.ebs_balance
    class: Utilization
     type: Other
component: AWS RDS
   lookup: max -15m unaligned of byte
    units: percentage
    every: 1m
     warn: $this != nan AND $this < 10
    delay: down 5m multiplier 1.5 max 1h
  summary: RDS EBS byte balance low on ${label:db_instance_identifier}
     info: RDS instance ${label:db_instance_identifier} in ${label:region} has sustained EBS byte balance below the AWS recommended alarm threshold.
       to: sysadmin

# AWS recommended: EBSIOBalance% Average < 10, 60s period, 3/3 datapoints.

 template: aws_cloudwatch_rds_ebs_io_balance
       on: cloudwatch.rds.ebs_balance
    class: Utilization
     type: Other
component: AWS RDS
   lookup: max -15m unaligned of io
    units: percentage
    every: 1m
     warn: $this != nan AND $this < 10
    delay: down 5m multiplier 1.5 max 1h
  summary: RDS EBS I/O balance low on ${label:db_instance_identifier}
     info: RDS instance ${label:db_instance_identifier} in ${label:region} has sustained EBS I/O balance below the AWS recommended alarm threshold.
       to: sysadmin

# --- VPN ---

# AWS recommended: TunnelState Minimum < 1, 300s period, 3/3 datapoints.

 template: aws_cloudwatch_vpn_tunnel_down
       on: cloudwatch.vpn.tunnel_state
    class: Availability
     type: Other
component: AWS Site-to-Site VPN
   lookup: max -15m unaligned of minimum
    units: status
    every: 1m
     crit: $this != nan AND $this < 1
    delay: down 5m multiplier 1.5 max 1h
  summary: VPN tunnel down on ${label:vpn_id}
     info: Site-to-Site VPN ${label:vpn_id} in ${label:region} has one or more tunnels down.
       to: sysadmin

# --- SNS ---

# AWS recommended: NumberOfNotificationsFilteredOut-InvalidAttributes Sum > 0, 60s period, 5/5 datapoints.
# The profile stores CloudWatch sums as rates; any sustained non-zero rate means filtered notifications occurred.

 template: aws_cloudwatch_sns_invalid_notification_attributes
       on: cloudwatch.sns.invalid_notifications
    class: Errors
     type: Other
component: AWS SNS
   lookup: min -25m unaligned of invalid_attributes
    units: notifications/s
    every: 1m
     warn: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: SNS invalid notification attributes on ${label:topic_name}
     info: SNS topic ${label:topic_name} in ${label:region} has sustained notifications filtered out because of invalid attributes.
       to: sysadmin

# AWS recommended: NumberOfNotificationsFilteredOut-InvalidMessageBody Sum > 0, 60s period, 5/5 datapoints.

 template: aws_cloudwatch_sns_invalid_notification_body
       on: cloudwatch.sns.invalid_notifications
    class: Errors
     type: Other
component: AWS SNS
   lookup: min -25m unaligned of invalid_message_body
    units: notifications/s
    every: 1m
     warn: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: SNS invalid notification message body on ${label:topic_name}
     info: SNS topic ${label:topic_name} in ${label:region} has sustained notifications filtered out because of invalid message bodies.
       to: sysadmin

# AWS recommended: NumberOfNotificationsRedrivenToDlq Sum > 0, 60s period, 5/5 datapoints.

 template: aws_cloudwatch_sns_notifications_redriven_to_dlq
       on: cloudwatch.sns.dlq_redrive
    class: Errors
     type: Other
component: AWS SNS
   lookup: min -25m unaligned of redriven
    units: notifications/s
    every: 1m
     crit: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: SNS notifications redriven to DLQ on ${label:topic_name}
     info: SNS topic ${label:topic_name} in ${label:region} has sustained notifications moved to a dead-letter queue.
       to: sysadmin

# AWS recommended: NumberOfNotificationsFailedToRedriveToDlq Sum > 0, 60s period, 5/5 datapoints.

 template: aws_cloudwatch_sns_notifications_failed_to_redrive_to_dlq
       on: cloudwatch.sns.dlq_redrive
    class: Errors
     type: Other
component: AWS SNS
   lookup: min -25m unaligned of failed_redrive
    units: notifications/s
    every: 1m
     crit: $this != nan AND $this > 0
    delay: down 5m multiplier 1.5 max 1h
  summary: SNS notifications failed to redrive to DLQ on ${label:topic_name}
     info: SNS topic ${label:topic_name} in ${label:region} has sustained notifications that could not be moved to a dead-letter queue.
       to: sysadmin
