AWS CloudWatch

CloudWatch Alarms can notify OpsFusion through Amazon EventBridge. Route alarm state changes to an EventBridge rule, target an API destination pointed at OpsFusion, and use an Input Transformer to reshape the event into OpsFusion’s alert format — no Lambda function required for basic field mapping.

Use EventBridge, not SNS

The classic CloudWatch Alarm → SNS → HTTPS subscription path delivers a fixed, double-wrapped JSON envelope that can’t be templated. EventBridge’s Input Transformer is what makes a customizable payload possible.

See API Overview for authentication and finding your Account ID/Team ID.

Configure the Webhook in EventBridge

1. In CloudWatch, confirm your alarm publishes state changes to EventBridge (this is on by default for most alarms — CloudWatch emits aws.cloudwatch events automatically).
2. In Amazon EventBridge, create a Connection and an API Destination pointing at https://api.opsfusion.cloud/v1/account/YOUR_ACCOUNT_ID/push/alert, with an Authorization header set to your OpsFusion API key.
3. Create an EventBridge Rule matching aws.cloudwatch alarm state-change events, with the API destination as its target.
4. On the same rule, open “Configure input” → “Input Transformer” and define:
   • An Input Path — JSONPath expressions pulling values out of the event, e.g. {"alarmName": "$.detail.alarmName", "reason": "$.detail.state.reason"}
   • An Input Template — the JSON body sent to OpsFusion, using those variables as placeholders.
5. Repeat with a second rule matching only the OK state, if you want CloudWatch to auto-resolve alerts in OpsFusion (see below).

EventBridge Pipes doesn’t help here either

EventBridge Pipes’ input transformer uses the identical JSONPath-substitution syntax as the classic Rule Input Transformer above — no conditional or ternary logic in either. (JSONata with real conditional expressions exists in AWS Step Functions, a different service, not EventBridge.) If you need status computed from a single rule instead of two, a small Lambda between EventBridge and the API destination is the only way to get real branching logic.

Payload Template

Input Template for the rule matching ALARM state:

{
  "teamId": YOUR_TEAM_ID,
  "title": "<alarmName>",
  "description": "<reason>",
  "severity": 1,
  "status": 1
}

Input Template for the rule matching OK state: identical, with "status": 3.

EventBridge’s Input Transformer only maps and substitutes values — there’s no arithmetic, string comparison, or conditional logic available, so <state> (which resolves to the literal string "ALARM" or "OK") can’t be converted into OpsFusion’s integer status inline. Hardcoding status per rule, matched on alarm state in the rule’s event pattern, is the reliable approach; the same applies to severity, which has no CloudWatch-native equivalent to map from at all.

Field Mapping

OpsFusion field	CloudWatch source
teamId	Hardcoded per rule (or per alarm, via a tag-based Input Path)
title	$.detail.alarmName
description	$.detail.state.reason
severity	Hardcoded per rule (1-3, based on alarm importance)
status	Hardcoded per rule (1 for the ALARM-matching rule, 3 for the OK-matching rule)
labels	Optional — additional Input Path fields (e.g. $.detail.region)

Troubleshooting

• Nothing arrives at OpsFusion: confirm the alarm is actually configured to emit EventBridge events (not just SNS) and that the rule’s event pattern matches aws.cloudwatch.
• Alerts never resolve in OpsFusion: confirm you created the second rule matching OK state with status: 3 — a single rule matching only ALARM will never send a resolution.
• Input Transformer fails silently: JSONPath in the Input Path only supports simple field extraction — no string manipulation, math, or conditionals. If you need those, add a small Lambda between EventBridge and the API destination instead.
• 403 from OpsFusion: verify the API Destination’s Connection has the Authorization header set to a valid, non-expired API key.

Support

For integration support:

• Email: support@opsfusion.cloud
• See Send Alerts for the full API reference