No CloudWatch Alarms For Critical Resources
stack-no-cloudwatch-alarms
What this rule checks
Detects stacks containing critical resources (Lambda, ECS, RDS) with no CloudWatch Alarms defined to monitor them.
How to fix it
- 1Add CloudWatch Alarms on key metrics (Lambda errors, ECS task failures, RDS connections)
CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.
Affected resource types
AWS::Lambda::FunctionAWS::ECS::ServiceAWS::RDS::DBInstanceAWS::RDS::DBClusterAWS::CloudWatch::AlarmIntentional? Suppress this finding
Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss stack-no-cloudwatch-alarms and the reason is kept in the report, not silently hidden.
In .cdk-insights.json:
{
"ignoreRules": [
{ "id": "stack-no-cloudwatch-alarms", "reason": "Why this is intentional" }
]
}Or inline in your CDK code:
Validations.of(scope).acknowledge({
id: 'cdk-insights::stack-no-cloudwatch-alarms',
reason: 'Why this is intentional',
});Use the rule ID stack-no-cloudwatch-alarms shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →
Catch this in your stack
$ npx cdk-insights scanCDK Insights runs this and 144+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.