Hedronite · Ops Lesson · 01-Earth-DevOps / Python · Thu 2026-09-10

CloudWatch alarm census with boto3 — silent alarms and DOP readiness

An alarm without an action is a dashboard that never pages anyone.

Lesson Class: Ops (Python + boto3 + CloudWatch)

Cloud Referent: CloudWatch Alarms

Paired Cert: AWS DOP monitoring

List

DescribeAlarms pages.

WARN

Zero actions.

Region

Empty is not org-wide.

Print the silent alarms first.

An alarm without an action is a dashboard that never pages anyone.

§I — Frame

Python-day Ops walks AWS with boto3. Today the referent is CloudWatch Alarms: list them, flag silent alarms (no actions), and summarize state. This feeds the DOP monitoring seat. It is not PrivateLink (09-07) and not EventBridge rule/target wiring (08-29).

§II — Foundations

Alarm identity. Name + region. Composite alarms nest children; treat them explicitly.
Actions. OK / ALARM / INSUFFICIENT_DATA action ARNs (SNS, Auto Scaling, EC2 actions). Empty lists are the first WARN.
Metric vs metric math. Simple threshold on one metric vs Metrics array expressions. Census should note which shape.

§III — Worked census

import boto3

cw = boto3.client("cloudwatch")
pag = cw.get_paginator("describe_alarms")
rows = []
for page in pag.paginate(AlarmTypes=["MetricAlarm", "CompositeAlarm"]):
    for a in page.get("MetricAlarms", []):
        actions = (a.get("AlarmActions") or []) + (a.get("OKActions") or []) + (a.get("InsufficientDataActions") or [])
        rows.append({
            "name": a["AlarmName"],
            "state": a.get("StateValue"),
            "actions": len(actions),
            "metric": a.get("MetricName") or "math-or-query",
        })
    for a in page.get("CompositeAlarms", []):
        rows.append({
            "name": a["AlarmName"],
            "state": a.get("StateValue"),
            "actions": len(a.get("AlarmActions") or []),
            "metric": "composite",
        })

WARN when actions == 0. Count ALARM vs OK for a heat summary. Do not auto-delete alarms.

§IV — Failure modes

Wrong region. Empty page is not "no alarms in the org."
Composite ignored. Only reading MetricAlarms misses stacks of composites.
Action exists but SNS topic is gone. Census sees an ARN; separate validate pass should GetTopicAttributes later.

§V — Lab-ref note

Python-day Maghrib attaches lab-ref to Cert only. Ops quiz still ships.

§VI — Closing

Print the silent alarms first. DOP care is about actionability, not pretty graphs alone.

Dev
Cert
Go