How to Prioritize AWS Health Alerts Using AWS User Notifications

AWS Health events arrive as a single undifferentiated stream. A scheduled maintenance window, a deprecation notice, and a live outage on AWS Direct Connect all show up the same way. Operations teams either treat everything as critical — creating noise that trains people to ignore alerts — or tune so aggressively they miss real incidents. This stack sets up a two-tier filter that separates the two.

Purpose

Route AWS Health events to the right audience at the right urgency level, using AWS User Notifications with no Lambda functions or DynamoDB tables required.

Pre-requisites

• AWS account with access to AWS Health, Amazon EventBridge, and AWS User Notifications
• Email address or Slack/Teams channel for operations team notifications
• CloudFormation deployment permissions
• Target regions identified (e.g., us-east-1,us-west-2)

Steps

1. Download the CloudFormation template

The AWS Architecture Blog provides a ready-to-deploy CloudFormation template (prioritize-aws-health-notifications.yaml). Choose a deployment mode based on your AWS organization structure:

• Linked — single account
• Payer — management account only
• Combined — management + linked accounts
• PayerCombined — full org coverage

2. Deploy the stack

aws cloudformation deploy \
  --template-file prioritize-aws-health-notifications.yaml \
  --stack-name prioritize-aws-health-notifications \
  --parameter-overrides \
  DeploymentMode=Linked \
  NotificationEmail=ops-team@example.com \
  NotificationRegions=us-east-1,us-west-2

3. Confirm email subscription

After deployment, AWS will send a confirmation email to the address specified. You must confirm it before notifications activate.

4. Verify the two-tier routing logic

The template creates two notification paths:

• CRITICAL (issues and scheduled changes): immediate delivery per event. This is the path for live service events, outage notifications, and upcoming maintenance that affects availability.
• INFORMATIONAL (account notifications): batched within 5-minute windows. These are deprecation notices, billing alerts, and account-level updates that don’t require immediate action.

The distinction is the signal: a standalone email means something needs attention now. A batched digest means routine updates reviewable on your schedule.

5. Scope service filtering

By default, the stack monitors all AWS Health events in the configured regions. You can narrow it to specific services — Amazon RDS, AWS Direct Connect, Amazon Connect — by modifying the EventBridge rule in the template. This is recommended for large organizations where org-wide event volume creates its own noise problem.

6. Connect additional channels

AWS User Notifications supports delivery to email, Slack, Microsoft Teams, and the AWS Console mobile app. Add your ops Slack channel or Teams webhook in the User Notifications console after deployment.

The Trap

Skipping service scoping in large accounts. An org-wide deployment without service filtering will receive every Health event across every service in every region — which recreates the original noise problem at higher volume. Spend 10 minutes identifying which services your team actually monitors and filter to those before deploying at scale.

Cited References

• AWS Architecture Blog: Prioritize your AWS Health alerts using AWS User Notifications
• AWS Health documentation
• AWS User Notifications documentation

Source: AWS Architecture Blog

Content created with AI assistance and reviewed for accuracy.