Notifications
The Notifications page lets you configure where AWS Cloud Governance sends alerts when a threat is detected, when a containment action fires, or when a block is lifted. Notifications are delivered via Amazon SNS, which can fan out to email, SMS, HTTP endpoints, Lambda functions, and more.
In the app: /notifications
Notification Rules
Each notification rule has three components:
- Trigger — what event fires the notification: a detection of a specific severity, a specific action type (contain, remediate), or a rollback.
- Filter — optional additional filters: specific detection, specific AWS account, or specific principal.
- Destination — the SNS topic ARN to publish to.
SNS Integration
Enter the ARN of an SNS topic in the same AWS region as your AWS Cloud Governance stack. The Lambda execution role must have sns:Publish permission on that topic. AWS Cloud Governance publishes a structured JSON payload containing the finding type, severity, actor, resource, timestamp, and the action that was taken.
Email Notifications
To receive email alerts, create an SNS topic and subscribe your email address to it. AWS will send a confirmation email — click the confirmation link before notifications will be delivered. Once confirmed, every matching event published to that topic will arrive as a plain-text email.
Webhook / HTTP Notifications
To send alerts to Slack, PagerDuty, or any HTTP endpoint, subscribe the endpoint to your SNS topic. For Slack, use the SNS → Lambda → Slack pattern: a small Lambda function formats the SNS message and posts it to a Slack Incoming Webhook URL.
Unblock Notifications
When an entity is manually unblocked (via the Actions page), an optional notification can be sent to the same destinations as the original block alert. Enable this if your SOC process requires an auditable record of every block/unblock cycle delivered to a ticketing system.
Testing Notifications
After configuring a rule, trigger a test notification by publishing a test message directly to the SNS topic from the AWS Console (SNS → Topics → Publish message). This verifies the subscription is active and the destination is reachable before a real detection occurs.
💡 Tip
Use SNS → Lambda for rich notification workflows: create a Jira ticket per Critical finding, post to a Slack channel with formatted blocks, or trigger a PagerDuty incident. The SNS payload from AWS Cloud Governance includes all the context needed to build these integrations.
⚠️ Warning
SNS topics must be in the same AWS region as your AWS Cloud Governance stack. Cross-region SNS publishing requires additional IAM configuration and is not supported by default.
ℹ️ Note
SNS deliveries are best-effort. For guaranteed delivery (especially for critical detections), consider subscribing an SQS queue to the SNS topic and processing from the queue with retry logic.