Find CloudWatch Alarms With No Actions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadAlarms",
      "Effect": "Allow",
      "Action": "cloudwatch:DescribeAlarms",
      "Resource": "*"
    },
    {
      "Sid": "CheckAlarmTopics",
      "Effect": "Allow",
      "Action": "sns:GetTopicAttributes",
      "Resource": "arn:aws:sns:*:123456789012:*"
    },
    {
      "Sid": "DeleteOnlyWithApply",
      "Effect": "Allow",
      "Action": "cloudwatch:DeleteAlarms",
      "Resource": "arn:aws:cloudwatch:*:123456789012:alarm:*"
    }
  ]
}

// find-cloudwatch-alarms-without-actions.ts
// Lists metric, composite and log alarms that can never notify anyone: no actions at all, actions
// switched off (ActionsEnabled = false), or every action pointing at an SNS topic that no longer exists.
// Alarms used as children of a composite alarm are reported but never deleted.
// Report only by default. --apply --names a,b deletes only the named alarms, and only if they are flagged.
// Usage: npx tsx find-cloudwatch-alarms-without-actions.ts [--regions us-east-1,eu-west-1]
//        [--names alarm-a,alarm-b [--apply]]
import {
  CloudWatchClient,
  DeleteAlarmsCommand,
  paginateDescribeAlarms,
  type MetricAlarm,
} from "@aws-sdk/client-cloudwatch";
import { SNSClient, GetTopicAttributesCommand, NotFoundException } from "@aws-sdk/client-sns";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const list = (v: string | undefined): string[] => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
const regions = list(flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1");
const toDelete = new Set(list(flag("--names")));
const apply = args.includes("--apply");

// us-east-1 list prices per alarm per month (AWS Price List, September 2026). Other Regions can differ.
const PRICE = { standardMetric: 0.1, highResMetric: 0.3, composite: 0.5, logAlarm: 0.1 };

type Kind = "metric" | "composite" | "log";
type Problem = "no actions" | "actions disabled" | "all targets deleted";
interface Row {
  Region: string;
  Alarm: string;
  Kind: Kind;
  State: string;
  Problem: Problem;
  ChildOf: string;
  PerMonth: string;
}

const errorText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

/** Estimated monthly list price of one alarm (before the 10-alarm-metric free tier). */
function metricAlarmPrice(a: MetricAlarm): string {
  const queries = a.Metrics ?? [];
  if (queries.some((q) => /SELECT\s/i.test(q.Expression ?? ""))) return "per metric analyzed";
  const metricCount = queries.length === 0 ? 1 : queries.filter((q) => q.MetricStat).length;
  const bands = a.ThresholdMetricId ? 2 : 0; // anomaly detection adds upper and lower band metrics
  const periods = [a.Period, ...queries.map((q) => q.MetricStat?.Period ?? q.Period)].filter((p): p is number => p !== undefined);
  const highRes = periods.some((p) => p < 60);
  const perMetric = highRes ? PRICE.highResMetric : PRICE.standardMetric;
  return `$${((metricCount + bands) * perMetric).toFixed(2)}`;
}

/** Names referenced in composite alarm rules: ALARM(x), OK("x"), INSUFFICIENT_DATA(arn). */
function childrenOf(rule: string): string[] {
  const names: string[] = [];
  for (const m of rule.matchAll(/\b(?:ALARM|OK|INSUFFICIENT_DATA)\(\s*("?)(.+?)\1\s*\)/g)) {
    const ref = m[2].trim();
    names.push(ref.startsWith("arn:") ? ref.slice(ref.lastIndexOf(":alarm:") + 7) : ref);
  }
  return names;
}

// ---- SNS: does each topic an alarm points at still exist? ----
const topicCache = new Map<string, "exists" | "deleted" | "unknown">();
async function topicState(arn: string): Promise<"exists" | "deleted" | "unknown"> {
  const cached = topicCache.get(arn);
  if (cached) return cached;
  const region = arn.split(":")[3];
  let state: "exists" | "deleted" | "unknown" = "unknown";
  try {
    await new SNSClient({ region }).send(new GetTopicAttributesCommand({ TopicArn: arn }));
    state = "exists";
  } catch (err) {
    state = err instanceof NotFoundException ? "deleted" : "unknown"; // e.g. no access to another account's topic
  }
  topicCache.set(arn, state);
  return state;
}

async function problemWith(enabled: boolean | undefined, actions: string[]): Promise<Problem | undefined> {
  if (actions.length === 0) return "no actions";
  if (enabled === false) return "actions disabled";
  const topics = actions.filter((a) => a.startsWith("arn:aws:sns:"));
  if (topics.length !== actions.length) return undefined; // Lambda, EC2, Auto Scaling, SSM targets: not checked
  const states = await Promise.all(topics.map(topicState));
  return states.every((s) => s === "deleted") ? "all targets deleted" : undefined;
}

async function scanRegion(region: string): Promise<Row[]> {
  const cw = new CloudWatchClient({ region });
  const rows: Row[] = [];
  const parents = new Map<string, string[]>(); // child alarm name -> composite alarms that use it
  const pending: { name: string; kind: Kind; state: string; problem: Problem; price: string }[] = [];

  const pages = paginateDescribeAlarms(
    { client: cw, pageSize: 100 },
    { AlarmTypes: ["MetricAlarm", "CompositeAlarm", "LogAlarm"] },
  );
  for await (const page of pages) {
    for (const c of page.CompositeAlarms ?? []) {
      for (const child of childrenOf(c.AlarmRule ?? "")) parents.set(child, [...(parents.get(child) ?? []), c.AlarmName ?? ""]);
      const actions = [...(c.AlarmActions ?? []), ...(c.OKActions ?? []), ...(c.InsufficientDataActions ?? [])];
      const problem = await problemWith(c.ActionsEnabled, actions);
      if (problem) pending.push({ name: c.AlarmName ?? "", kind: "composite", state: c.StateValue ?? "", problem, price: `$${PRICE.composite.toFixed(2)}` });
    }
    for (const m of page.MetricAlarms ?? []) {
      const actions = [...(m.AlarmActions ?? []), ...(m.OKActions ?? []), ...(m.InsufficientDataActions ?? [])];
      const problem = await problemWith(m.ActionsEnabled, actions);
      if (problem) pending.push({ name: m.AlarmName ?? "", kind: "metric", state: m.StateValue ?? "", problem, price: metricAlarmPrice(m) });
    }
    for (const l of page.LogAlarms ?? []) {
      const actions = [...(l.AlarmActions ?? []), ...(l.OKActions ?? []), ...(l.InsufficientDataActions ?? [])];
      const problem = await problemWith(l.ActionsEnabled, actions);
      if (problem) pending.push({ name: l.AlarmName ?? "", kind: "log", state: l.StateValue ?? "", problem, price: `$${PRICE.logAlarm.toFixed(2)} + queries` });
    }
  }
  for (const p of pending) {
    rows.push({
      Region: region,
      Alarm: p.name,
      Kind: p.kind,
      State: p.state,
      Problem: p.problem,
      ChildOf: (parents.get(p.name) ?? []).join(", "),
      PerMonth: p.price,
    });
  }
  return rows;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of regions) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${errorText(err)}`);
    }
  }
  if (rows.length === 0) {
    console.log(`Every alarm in ${regions.join(", ")} has at least one enabled action with a live target.`);
    return;
  }
  const order: Record<Problem, number> = { "all targets deleted": 0, "actions disabled": 1, "no actions": 2 };
  rows.sort((a, b) => order[a.Problem] - order[b.Problem] || a.Alarm.localeCompare(b.Alarm));
  console.table(rows);
  const standalone = rows.filter((r) => !r.ChildOf);
  console.log(`${rows.length} alarms can't notify anyone; ${standalone.length} are not used by a composite alarm.`);

  if (toDelete.size === 0) return;
  for (const name of toDelete) {
    const row = rows.find((r) => r.Alarm === name);
    if (!row) {
      console.log(`skip ${name}: not flagged in this report`);
      continue;
    }
    if (row.ChildOf) {
      console.log(`skip ${name}: used by composite alarm ${row.ChildOf}`);
      continue;
    }
    if (!apply) {
      console.log(`would delete ${row.Kind} alarm ${name} in ${row.Region} (re-run with --apply)`);
      continue;
    }
    try {
      // One name per call: a DeleteAlarms call may hold only one composite alarm, and log alarms can't be batch deleted.
      await new CloudWatchClient({ region: row.Region }).send(new DeleteAlarmsCommand({ AlarmNames: [name] }));
      console.log(`deleted ${name} in ${row.Region}`);
    } catch (err) {
      console.error(`delete ${name}: ${errorText(err)}`);
    }
  }
}

main().catch((err) => {
  console.error(errorText(err));
  process.exit(1);
});

npm install @aws-sdk/client-cloudwatch @aws-sdk/client-sns
npm install --save-dev tsx typescript @types/node

# Report for two Regions
AWS_PROFILE=readonly npx tsx find-cloudwatch-alarms-without-actions.ts --regions us-east-1,eu-west-1

# Preview, then delete two alarms
AWS_PROFILE=readonly npx tsx find-cloudwatch-alarms-without-actions.ts --names checkout-latency-p99,old-migration-watch
AWS_PROFILE=ops-admin npx tsx find-cloudwatch-alarms-without-actions.ts --names checkout-latency-p99,old-migration-watch --apply

┌─────────┬─────────────┬───────────────────────────┬─────────────┬─────────────────────┬───────────────────────┬───────────────────────┬───────────────────┐
│ (index) │ Region      │ Alarm                     │ Kind        │ State               │ Problem               │ ChildOf               │ PerMonth          │
├─────────┼─────────────┼───────────────────────────┼─────────────┼─────────────────────┼───────────────────────┼───────────────────────┼───────────────────┤
│ 0       │ 'us-east-1' │ 'checkout-latency-p99'    │ 'metric'    │ 'OK'                │ 'all targets deleted' │ ''                    │ '$0.30'           │
│ 1       │ 'us-east-1' │ 'db-cpu-high'             │ 'metric'    │ 'OK'                │ 'actions disabled'    │ ''                    │ '$0.10'           │
│ 2       │ 'us-east-1' │ 'auth-failed-logins'      │ 'log'       │ 'OK'                │ 'no actions'          │ ''                    │ '$0.10 + queries' │
│ 3       │ 'us-east-1' │ 'db-connections-high'     │ 'metric'    │ 'OK'                │ 'no actions'          │ 'db-health'           │ '$0.10'           │
│ 4       │ 'us-east-1' │ 'old-migration-watch'     │ 'composite' │ 'OK'                │ 'no actions'          │ ''                    │ '$0.50'           │
│ 5       │ 'us-east-1' │ 'orders-queue-depth'      │ 'metric'    │ 'ALARM'             │ 'no actions'          │ 'old-migration-watch' │ '$0.10'           │
│ 6       │ 'us-east-1' │ 'payments-errors-anomaly' │ 'metric'    │ 'INSUFFICIENT_DATA' │ 'no actions'          │ ''                    │ '$0.30'           │
└─────────┴─────────────┴───────────────────────────┴─────────────┴─────────────────────┴───────────────────────┴───────────────────────┴───────────────────┘
7 alarms can't notify anyone; 5 are not used by a composite alarm.
would delete metric alarm checkout-latency-p99 in us-east-1 (re-run with --apply)
skip db-connections-high: used by composite alarm db-health