title: How to set alarm in metric filter using CloudFormation
body: <p><strong>How to create alarm for metric filter and connect SNS topic.</strong></p>
  <p>My task is:</p>
  <ol>
  <li>Create SNS topic and email subscription</li>
  <li>Create CloudWatch log group</li>
  <li>Create metric filter for that CloudWatch log group and create alarm and connect SNS topic</li>
  </ol>
  <pre class="lang-yaml prettyprint-override"><code>AWSTemplateFormatVersion: &quot;2010-09-09&quot;
  #Parameters:
   #EmailAddress:
    #Type: String
    #Description: The email address to use for alarm notifications.
  
  Resources:
   # Create SNS and email subscription
   MySNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
      - Endpoint: &quot;abcd@abc.com&quot;
        Protocol: email
     
   # Create CloudWatch log group
   snstopic: 
    Type: AWS::Logs::LogGroup
    DependsOn: MySNSTopic
    Properties: 
      RetentionInDays: 7
    
   # Create metric filter
   UnauthorizedApiCalls: 
    Type: AWS::Logs::MetricFilter
    DependsOn: snstopic
    Properties: 
      LogGroupName: 
        Ref: &quot;snstopic&quot;
      FilterPattern: '{($.errorCode=&quot;*UnauthorizedOperation&quot;) || ($.errorCode=&quot;AccessDenied*&quot;)}'
      MetricTransformations: 
        - MetricValue: &quot;1&quot;
          MetricNamespace: &quot;unauthorized-api-calls&quot;
          MetricName: &quot;LogMetrics&quot;
    
   # Create alarm
   UnauthorizedApiCallsAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn: UnauthorizedApiCalls
    Properties:
      AlarmName: UnauthorizedApiCallsAlarm
      AlarmActions: !Ref snstopic
      MetricName: UnauthorizedApiCalls
      Namespace: LogMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '5'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: breaching
  </code></pre>