EBS volume detatch notification

Posted: | Updated: | Tags: aws cloud til storage

EBS sends events to CloudWatch when creating, deleting or attaching a volume, but not on detachment. However, CloudTrail is able to list detachments, the command below lists the last 25 detachments.

aws cloudtrail lookup-events \
--max-results 25 \
--lookup-attributes AttributeKey=EventName,AttributeValue=DetachVolume

Setting up noticiations is then possible with CloudWatch alarms for CloudTrail. The steps are summarized below:

  1. Ensure that a trail is created with a log group.
  2. Create a metric filter with the Filter pattern { $.eventName = "DetachVolume" } in CloudWatch.
  3. Create an alarm in CloudWatch with threshold 1 and the appropriate Action.

Related ramblings