Turn CloudWatch alarms into Linear tickets

Every 15 minutes on a cron, sweep Amazon CloudWatch for any alarm that is currently in the ALARM state and turn each new one into a Linear issue in my engineering team, using a Google Sheets tab as the dedupe ledger so the same alarm never becomes two tickets.

Start the run by calling Amazon CloudWatch Describe Alarms with a state filter of ALARM to pull every alarm that is currently firing. For each alarm returned, capture the alarm ARN, alarm name, the metric or expression it is watching, its dimensions, the comparison operator and threshold, the current state reason, and the timestamp it entered the ALARM state.

Before doing anything with an alarm, open the Google Sheets ledger tab and check whether its ARN already appears in the ARN column. If it does, that alarm has already been ticketed on a previous run, so skip it. Only alarms not already in the ledger are candidates for a new ticket.

For each candidate alarm, call CloudWatch Describe Alarm History for that alarm scoped to the last hour or so, filtered to StateUpdate items, and read the sequence of state transitions. Use that history to make two judgement calls before writing a ticket.

First, flap suppression: if the alarm has flipped between OK and ALARM more than a couple of times in the last few minutes, or if it briefly self-resolved back to OK inside the last few minutes and has only just re-entered ALARM, treat it as a transient blip and do not open a ticket this cycle. The goal is that on-call is never paged for something that already fixed itself while the run was starting.

Second, priority: decide the Linear priority based on how long the alarm has been continuously in ALARM according to the state history. Something firing for under 15 minutes with a clean history is Low or Medium; an alarm that has been red continuously for 30+ minutes is High; an alarm red for over an hour with no self-recovery is Urgent. If the history looks flappy but the alarm is still firing, choose Medium and mention the flap pattern in the ticket so someone can tune the threshold.

Then call Linear Create Issue in my engineering team. The title should be the CloudWatch alarm name. The description should include the alarm ARN, the metric namespace and name, the full list of dimensions, the comparison operator and threshold value, the current state reason string from CloudWatch, when it first entered ALARM, and a short human summary of the last few state transitions from the history so the on-call engineer can start investigating without opening the AWS console. Set the priority you chose above.

Immediately after the ticket is created, call Google Sheets Append Values on the ledger tab and add a new row with three columns: the alarm ARN, the current timestamp in ISO 8601, and the URL of the Linear issue that was just created. This is what makes the next 15-minute run treat this alarm as already handled.

If Describe Alarms returns no firing alarms, or every firing alarm is either already in the ledger or classified as a flap, the run should exit quietly without opening any tickets or writing anything to the sheet.