Is it possible to use cloudwatch describe-alarms-for-metric to describe cross-accounts alarms?

[MarcosDanielTorres]

Hello everyone, I'm facing the following issue:
I have a monitoring account where I would like to describe all the alarms associated with a specific metric. But that metric comes from a different AWS account, the alarm was created in the monitoring account but not the metric. So when I use describe-alarm-for-metric from the monitoring account it doesn't find anything. I can see the metric from the AWS Console but I'm guessing the cli only finds it if it was originally created in that account. At the moment I have no way of specifying where the metric originated.

[uldyssian-sh]

describe-alarms-for-metric only matches alarms by the metric identity that CloudWatch stores on the alarm:
Namespace, MetricName, Dimensions (exact key/value set), and optionally the metric’s AccountId when it is a cross-account metric.

In a cross-account monitoring setup, you can see the metric in the console because it is being shared/linked, but your CLI call will return nothing if the metric identity you provide does not exactly match what the alarm references.

For cross-account metrics, you must include the metric’s source account in the request (AccountId), otherwise CloudWatch searches only “local account” metrics.

Use the newer metric identifier form and specify AccountId (and make sure Dimensions match exactly):

aws cloudwatch describe-alarms-for-metric
--namespace "AWS/..."
--metric-name "..."
--dimensions Name=...,Value=...
--account-id <SOURCE_ACCOUNT_ID>
--region

If your CLI version does not support --account-id on this command, then you cannot query by source account with describe-alarms-for-metric in that version. In that case, use one of these reliable alternatives:

Use describe-alarms and filter client-side by the alarm’s metric definition:

aws cloudwatch describe-alarms
--query "MetricAlarms[?MetricName=='...']"

Or, if you know the alarm name prefix, use:

aws cloudwatch describe-alarms --alarm-name-prefix "..."

Summary:

Yes, it is possible, but only if you provide the exact metric identity the alarm was created with, and for cross-account metrics that includes the source AccountId. If your CLI build lacks the --account-id parameter for this API, use describe-alarms and filter by the alarm’s metric fields instead.

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊