Iām trying to get the AWS Cloudwatch alarms for SES set up with Global Event Rules. Iāve set up the v2 subscription in SNS per the doc but I canāt get to the āDetailsā content. Iād like to key off the AlarmName for the alert and the āAlarmArnā for the dedup_key. I can see the details in what appears to be a parsed JSON output in the Incident details, What is the proper syntax to get to the keys? Iāve tried āMessage.AlarmNameā and ābody.AlsarmNameā but both seem to be ignored. For now Iām using ācontainsā in the Subject but that is not as flexible as being able to utilize the json directly.
Worst case is we have implement event transformation but it seems like I should be able to do this without going to that extremeā¦especially considering that there is a Cloudwatch Integration that seems to mostly work but canāt get that to work with v2; ie, I never see an alert come in to grab the subscription key.
Itās probably worth noting that the dedup_key is critical as the observed behavior is multiple regional alerts override eack other but a single clear resolves the alert for all.
Note: Iāve looked at the docs but I may not be looking in the right place. Happy to be directed to something specific.