CloudWatch alarm deletion protection

Prevents the deletion of critical CloudWatch alarms, ensuring that monitoring alerts are not accidentally removed.

Policy description

What this SCP does

This Service Control Policy (SCP) prevents the deletion of critical CloudWatch alarms, ensuring that monitoring alerts are not accidentally removed. This maintains your ability to detect and respond to operational events.

By blocking the deletion of CloudWatch alarms across the organization, this policy safeguards your monitoring infrastructure, ensuring that important alerts remain in place to notify you of potential issues and security incidents, even if a user accidentally attempts to remove them.

Validation strategy

How to test this SCP works

To validate this SCP, try to create and then delete a CloudWatch alarm.

Valid test: Create a new CloudWatch alarm (should succeed)
Invalid test: Attempt to delete the CloudWatch alarm (should be denied)

We expect the alarm creation to succeed, but deletion attempts to be denied with an AccessDenied error. This confirms that the SCP is preventing the removal of CloudWatch alarms, protecting your monitoring setup.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyCloudWatchAlarmDeletion", "Effect": "Deny", "Action": [ "cloudwatch:DeleteAlarms" ], "Resource": "*" } ] }

# Create a test alarm aws cloudwatch put-metric-alarm \ --alarm-name test-protected-alarm \ --metric-name CPUUtilization \ --namespace AWS/EC2 \ --statistic Average \ --period 300 \ --threshold 80 \ --comparison-operator GreaterThanThreshold \ --evaluation-periods 2 # Try to delete the alarm (this should be denied) aws cloudwatch delete-alarms --alarm-names test-protected-alarm

import boto3 # Initialize CloudWatch client cloudwatch_client = boto3.client('cloudwatch') # Create a test alarm try: cloudwatch_client.put_metric_alarm( AlarmName='test-protected-alarm', MetricName='CPUUtilization', Namespace='AWS/EC2', Statistic='Average', Period=300, Threshold=80, ComparisonOperator='GreaterThanThreshold', EvaluationPeriods=2 ) print("Created test CloudWatch alarm") # Try to delete the alarm (this should be denied) try: cloudwatch_client.delete_alarms(AlarmNames=['test-protected-alarm']) print("WARNING: Successfully deleted alarm - SCP is NOT restricting as expected") except Exception as e: print(f"Expected error if SCP is working: {e}") except Exception as e: print(f"Error creating test alarm: {e}")