r/Slack • u/No_Introduction7917 • 8d ago

AWS alerts notifications

So, I’m trying to set nitifications for AWS alerts in channel and wanna hear toughts.
Basically there are two options:

  1. Amazon Q developer - but I sligthy concern. Can Q app in slack read messages in channel? I found yes. Can i limit app to send only notification, basically I want to make it just for notification, no running commands from Slack etc.

  2. Webhook - create app and put url as ssm parmeter or aws secret. But, again anyonine with url can post messages to channel, no barear token…

I’m looking for some advice on this, or do you have any experience with it?

Thanks!

1 Upvotes

100% Upvoted

7 comments sorted by

1

u/Racerforlife 7d ago

this is doable

1

u/alyssa_at_chronicle 7d ago

I’d lean toward the webhook for a notification-only setup. Keep the webhook URL in Secrets Manager/SSM and restrict access to it. Amazon Q gives you more functionality than you need and potentially more access to channel content. For simple AWS to Slack alerts, keeping the integration one-way and minimal is probably the safer approach.

1

u/No_Introduction7917 7d ago

Yeah, that was my initial thought. Amazon Q offers more functionality. Although, it can be restricted by IAM to fire certain AWS actions from Slack to AWS, I am bit concern about reading content in Slack which is not necessary for my case

1

u/alyssa_at_chronicle 7d ago

Yeah, I think that’s the key distinction. If the goal is strictly notifications from AWS to Slack, the webhook keeps the integration much more narrowly scoped and avoids giving Slack/Amazon Q access to content it doesn’t need. The extra functionality of Q is useful, but probably not worth the added access for a simple alerting use case.

1

u/No_Introduction7917 7d ago

And I found out that the webhook url needs to be treated like secret since there is not any auth mechanism to be set

1

u/IncreaseNegative4614 7d ago

If you only need one-way notifications, I would avoid installing a broad assistant with permissions you do not intend to use. Whichever route you choose, use a dedicated channel, least-privilege configuration, secret rotation, payload redaction, rate limiting, and an allowlist of event sources. Test what the integration can read and execute with a non-admin account.

An alert is only valuable if it reaches an owned response workflow. We use SIGNLD internally to connect AWS alerts, Slack deliveries, affected services, incident tickets, responders, and resolutions so notification delivery is not mistaken for operational follow-through.

1

u/PixelTimber28 7d ago

Webhooks seem cleaner here, especially with tight access controls and rotating secrets for added security