I’m trying to get the AWS Cloudwatch alarms for SES set up with Global Event Rules. I’ve set up the v2 subscription in SNS per the doc but I can’t get to the “Details” content. I’d like to key off the AlarmName for the alert and the “AlarmArn” for the dedup_key. I can see the details in what appears to be a parsed JSON output in the Incident details, What is the proper syntax to get to the keys? I’ve tried “Message.AlarmName” and “body.AlsarmName” but both seem to be ignored. For now I’m using ‘contains’ in the Subject but that is not as flexible as being able to utilize the json directly.
Worst case is we have implement event transformation but it seems like I should be able to do this without going to that extreme…especially considering that there is a Cloudwatch Integration that seems to mostly work but can’t get that to work with v2; ie, I never see an alert come in to grab the subscription key.
It’s probably worth noting that the dedup_key is critical as the observed behavior is multiple regional alerts override eack other but a single clear resolves the alert for all.
Note: I’ve looked at the docs but I may not be looking in the right place. Happy to be directed to something specific.