CloudWatch alarm fires.
Runframe incident exists.
Point an SNS subscription at your Runframe webhook URL. Every CloudWatch alarm becomes a structured incident with alarm context attached. No AWS credentials shared.
How it works
Three steps. Nothing to install.
Copy your webhook URL
Open the service you want to monitor in Runframe. Copy the webhook endpoint from service settings. One URL per service.
Create an SNS subscription
In the AWS console, create an SNS topic or use an existing one. Add an HTTPS subscription pointing to your Runframe webhook URL. Runframe confirms the subscription automatically.
Point CloudWatch alarms at the topic
Configure your CloudWatch alarms to publish to that SNS topic. When an alarm transitions to ALARM state, SNS delivers the payload to Runframe and an incident is created.
What the integration does
Runframe uses everything CloudWatch sends through SNS.
Severity from your service default
CloudWatch does not have a native severity field. Runframe uses your service default severity, or falls back to SEV2. You can also pass severity via SNS MessageAttributes if you want per-alarm control.
Service correlation
Each Runframe service has its own webhook URL. When an alarm fires, Runframe pages the on-call team for that service. No routing rules to maintain.
Full alarm context attached
Alarm name, description, region, account ID, metric namespace, and trigger details are captured on the incident. Responders see exactly what fired without switching to the AWS console.
Auto-resolve on OK
When a CloudWatch alarm returns to OK state, SNS delivers a recovery notification. Runframe resolves the corresponding incident and logs the recovery on the timeline.
What gets mapped
CloudWatch alarm states map to Runframe incident actions.
Alarm name, description, region, account ID, and metric details are attached to the incident as context. OK events automatically resolve the open incident.
Frequently asked questions
Connect CloudWatch in under 5 minutes.
Free plan available. No credit card required.