CloudWatch Logs, Alarm & Dashboard

aws-cloudwatch

A self-contained CloudWatch observability bundle: a log group (retention + optional CMK encryption), a metric alarm, and a dashboard. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

Out of the box the alarm and the dashboard target the log group itself (AWS/Logs / IncomingLogEvents), so the module stands up with nothing but a name and costs nothing to run. Point alarm_namespace / alarm_metric_name / alarm_dimensions at any real metric (EC2 CPUUtilization, ALB 5XX, a custom namespace, ...) when you wire it to a workload.

Secure / cost-aware defaults:

• Log group is encrypted at rest (AWS-owned key by default; set kms_key_id for a customer-managed key — the key policy must allow logs.<region>.amazonaws.com)
• Retention defaults to 7 days (never use 0 / never-expire unless you accept unbounded log storage cost)
• Alarm treat_missing_data = "notBreaching" avoids false alarms when no data is flowing
• Dashboards are free for the first three per account

Requirements

• Terraform or OpenTofu >= 1.6
• hashicorp/aws >= 6.0, < 7.0

Verification

Static-validated (fmt, validate, tflint). Live apply/destroy testing pending cloud sandbox availability — see catalog status.

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).