arabold / aws-to-slack Goto Github PK

Using transforms require the user to first create a change set before the stack can be launched. This is an extra step that we should get rid of if possible.

I'm not sure if the issue is in my definition of the alarms (CPU utilization goes above a certain threshold for x minutes for a specific instance) or if it's just not possible with this tool but I have tried to use the below input as CloudWatch events in my handler :

{
  "source": [
    "aws.events"
  ]
}

But i'm not getting any results in the slack app. Would appreciate it if someone could point me to what I'm supposed to look for.

Hey Team,

Can you guide me to build the cloud watch events something like SPOT Instance termination events to come in Slack channel?.

Currently, It just works as generic events, but I would like to get bare minimum tags like Instance Name or Instance type and AZ name.

Current notification to Slack.

aws.ec2 (ap-southeast-1 - XXXXXX)
EC2 Instance State-change Notification
version
0
id
e88ed778-8861-7f63-b63c-089cbb569a17
resources
["arn:aws:ec2:ap-southeast-1:XXXX:instance/i-047dd4e31a66a990b"]
detail
{"instance-id":"i-047dd4e31a66a990b","state":"terminated"}```

Desired Notification

aws.ec2 (ap-southeast-1 - XXXXXX)
EC2 Instance State-change Notification
SPOT Instance State change : Name: foo-bar in region az and reason for it ??
Instance ID: i-047dd4e31a66a990b
State Change
STATE → TERMINATED
Region
Asia Pacific (Singapore)

https://docs.aws.amazon.com/codebuild/latest/userguide/sample-build-notifications.html#sample-build-notifications-ref

basic handler here: https://hackernoon.com/monitor-your-aws-codebuilds-via-lambda-and-slack-ae2c621f68f1

Would you accept a PR for this?

I would add a condition so that users can opt out. Something like:

  EnableCodeBuildEvents:
    Type: String
    Description: 'Create cloudwatch rule for codebuild events'
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'true'

and then add something like the event rules defined in https://hackernoon.com/monitor-your-aws-codebuilds-via-lambda-and-slack-ae2c621f68f1

I set this up and get a notification in the slack channel, but no chart is include. the chart was very important to us.

Thanks for this awesome project!

It looks like the CodePipeline parser is set up to parse SNS messages.

I set up CodePipeline events through CloudWatch Events (https://docs.aws.amazon.com/codepipeline/latest/userguide/detect-state-changes-cloudwatch-events.html), not through SNS.

When I have my CloudWatch Event rule trigger the aws-to-slack lambda it just sends the raw message.

Is there another way to do it? It would be great if this could parse Cloudwatch Events for CodePipeline and send nicely formatted Slack notifications.

I'm getting the following errors during creation of the lambda function

Error occurred while GetObject. S3 Error Code: PermanentRedirect. S3 Error Message: The bucket is in this region: us-east-1. Please use this region to retry the request (Service: AWSLambda; Status Code: 400; Error Code: InvalidParameterValueException; Request ID: c95cbacf-968e-11e8-8f09-ff64c1332048)
--

Seems like the code can't be installed in other regions ?

Using a CloudWatch Rule to send CodeCommit changes, I see the below on the Slack Message;

Commit Message
Could not inspect repository. Check logs for stack trace.

And in the CloudWatch Logs for the Function the following:

Failed to inspect branch: { TimeoutError: Socket timed out without establishing a connection at Timeout.connectTimeout

Is this a permissions issue or something else?

HI, I'm getting an issue when trying to create the transforms

Check the following transforms: ["AWS::Serverless-2016-10-31"]
You must use a change set to create this stack because it includes one or more transforms. The change set shows the resources that transforms add to your stack's template. Choose Create Change Set, check the resources that the transforms add, and then choose Execute. Learn more.

Error creating change set: Transform AWS::Serverless-2016-10-31 failed with: Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [Handler] is invalid. 'CodeUri' requires Bucket and Key properties to be specified

I have no clue what to do

Thanks

Would be nice to have a terraform template please?

CodePipeline sends out events as code moves through the various stages. Adding support for CodePipeline compliments any CodeBuild & CodeDeploy support that already exists.

In particular, CodePipeline supports manual approval steps. Having these notifications pushed to Slack is extremely helpful for ensuring that people see the events and can easily (and quickly respond).

Deploying using serverless and nodejs10.x and getting this in the lambda logs:

2019-08-31T12:56:28.141Z cd3c3e52-1260-4878-82bd-18b7b66dfeb7 INFO Error rendering chart: { InvalidParameterValue: The parameter Statistics.member.1 must be a value in the set [ Minimum, Maximum, Average, SampleCount, Sum ]. at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/query.js:50:29) at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20) at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10) at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14) at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10) at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12) at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10 at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9) at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12) at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18) message: 'The parameter Statistics.member.1 must be a value in the set [ Minimum, Maximum, Average, SampleCount, Sum ].', code: 'InvalidParameterValue', time: 2019-08-31T12:56:28.125Z, requestId: 'c7c77eed-a0bc-4714-b2b5-c651316e7e8e', statusCode: 400, retryable: false, retryDelay: 19.789864084998786 }

Any idea what the problem is?

Was thinking it would be nice to get nicely formatted slack notifications for CloudFormation SNS events.

The alarm threshold should be visible in the rendered graph.

Old:

New:

https://console.aws.amazon.com/codesuite/codebuild/projects/[my-project]/build/[my-project:build-id]/?region=[region]

Hello,

I'm getting:

Error rendering chart: TypeError: fromTime.getTime is not a function

when alarm chart is rendered. Metrics/alarm is custom one.

Full anonymized log below:

START RequestId: 5dc60e52-f773-11e7-a45b-17d92e2998bb Version: $LATEST
2018-01-12T08:34:22.073Z 5dc60e52-f773-11e7-a45b-17d92e2998bb Incoming Message:
{
    "Records": [
        {
            "EventSource": "aws:sns",
            "EventVersion": "1.0",
            "EventSubscriptionArn": "arn:aws:sns:eu-west-1:123456789012:test-project-comp-application:22222222-e26c-4414-844f-11111111111",
            "Sns": {
                "Type": "Notification",
                "MessageId": "dddddd-a216-59d2-bbbb-123123123123",
                "TopicArn": "arn:aws:sns:eu-west-1:123456789012:test-project-comp-application",
                "Subject": "ALARM: \"test-project-comp-my-alarm\" in EU (Ireland)",
                "Message": "{\"AlarmName\":\"test-project-comp-my-alarm\",\"AlarmDescription\":\"Application startups logged in test-project\",\"AWSAccountId\":\"123456789012\",\"NewStateValue\":\"ALARM\",\"NewStateReason\":\"Threshold Crossed: 1 datapoint [2.0 (12/01/18 08:33:00)] was greater than or equal to the threshold (1.0).\",\"StateChangeTime\":\"2018-01-12T08:34:12.375+0000\",\"Region\":\"EU (Ireland)\",\"OldStateValue\":\"INSUFFICIENT_DATA\",\"Trigger\":{\"MetricName\":\"comp-my-alarm\",\"Namespace\":\"test-project\",\"StatisticType\":\"Statistic\",\"Statistic\":\"SUM\",\"Unit\":\"None\",\"Dimensions\":[],\"Period\":60,\"EvaluationPeriods\":1,\"ComparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"Threshold\":1.0,\"TreatMissingData\":\"\",\"EvaluateLowSampleCountPercentile\":\"\"}}",
                "Timestamp": "2018-01-12T08:34:12.407Z",
                "SignatureVersion": "1",
                "Signature": "K1OJELJE6lTKYbnW+FoIYe/LYccZG0LYD9/99F0uIeCsRWKpibPtOjkTT0xm45nGy2znQdk5wAD0ru3OjCmWfmI+KinBrhkLp9j6NYaGuFxeQdtAAifyaZSCPNYNLc5Fmjzuu7qjF0PYuzxzGR0iu4NT1FwMzufY9+iWGg3ZWyN5IBf9cFiKncTbDCv4SiQkNoez1bHcqsiK5IZX2r5mI2RvEapiisWi42ChcFweqpRWhmjdM9dbLhCMvaeE/4Xkbf74A/VjifTv/3nH2gugqJor6e7KOJwWtOMl/h35jL2QCf0hDfFCh5tAY40+fgO8S28B5Xt/p2BfMQV8/iZs4A==",
                "SigningCertUrl": "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-22222222222222222222222222222222.pem",
                "UnsubscribeUrl": "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:123456789012:test-project-comp-application:22222222-e26c-4414-844f-11111111111",
                "MessageAttributes": {}
            }
        }
    ]
}

2018-01-12T08:34:24.633Z 5dc60e52-f773-11e7-a45b-17d92e2998bb Error rendering chart: TypeError: fromTime.getTime is not a function
2018-01-12T08:34:24.634Z 5dc60e52-f773-11e7-a45b-17d92e2998bb Sending Message to Slack:
{
    "attachments": [
        {
            "fallback": "test-project-comp-my-alarm state is now ALARM:\nThreshold Crossed: 1 datapoint [2.0 (12/01/18 08:33:00)] was greater than or equal to the threshold (1.0).",
            "color": "danger",
            "author_name": "Amazon CloudWatch Alarm",
            "title": "test-project-comp-my-alarm",
            "text": "Threshold Crossed: 1 datapoint [2.0 (12/01/18 08:33:00)] was greater than or equal to the threshold (1.0).",
            "fields": [
                {
                    "title": "Acount ID",
                    "value": "123456789012",
                    "short": true
                },
                {
                    "title": "Region",
                    "value": "EU (Ireland)",
                    "short": true
                },
                {
                    "title": "Old State",
                    "value": "INSUFFICIENT_DATA",
                    "short": true
                },
                {
                    "title": "New State",
                    "value": "ALARM",
                    "short": true
                }
            ],
            "ts": 1515746052
        }
    ]
}

2018-01-12T08:34:24.634Z 5dc60e52-f773-11e7-a45b-17d92e2998bb Posting to Slack...
2018-01-12T08:34:24.948Z 5dc60e52-f773-11e7-a45b-17d92e2998bb Message posted successfully.

Everything works as expected but it would be even greater to be able to add the commit message itself to the slack card.
Not so much an issue but rather a feature request.

Is this where the codebase is defined ?

Code:
        S3Bucket: !Sub 'aws-to-slack-${AWS::Region}'
        S3Key: release.zip

When launching the template, I do not get the latest version of the code. Has this been updated for all regions ?
If I'm supposed to update the function code some other way, how to proceed ?

So after deploying the template in US-East-1 I created a cloud watch pointed it to the topic pointed the topic to the handler automatic function that was created and added the hook url to the key value on the function but I see no alerts in the slack channel. Not sure what else I am missing to get this at least working than add to the development.

Any advice on how to use IAM role for the execution instead of keys or secret? TIA

I am not sure how I would just have this send out a text message that I can preconfigure?

Is there a variable I should populate?

I want to send a message like "Backup failed" to slack when an alarm is triggered and I have that alarm trigger sns. Nothing fancy needed. How can I use the "Test" feature in Lambda to try this?

Thanks!
Ernie

Hello.. This is great!

Btw, do you have the zipfile for the CF template? It doesn't seems to work on me because I tried to build in a different region.

TIA.

I'd like to get slack notifications from CodeCommit Pull Request events. I got this lambda function setup, and it's working, but it's just posting the event json to slack. Figure just need to add a parser, thinking something similar to the CodeBuild parser. I can try to knock this out...

Helo gentlemen!
I found this project by change on my searches and I'm interested in using it, but when I ran make package I got this:

found 71 vulnerabilities (62 low, 2 moderate, 7 high) in 17893 scanned packages
  run `npm audit fix` to fix 2 of them.
  69 vulnerabilities require semver-major dependency updates.

Any plans to update these dependencies to fix the security vulnerabilities?

Full output:

$ npm audit

                       === npm audit security report ===

# Run  npm install --save-dev [email protected]  to resolve 69 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change

   [[[ snipping long output ]]]

found 71 vulnerabilities (62 low, 2 moderate, 7 high) in 17893 scanned packages
  run `npm audit fix` to fix 2 of them.
  69 vulnerabilities require semver-major dependency updates.

It seems like the footer text is being truncated before the link is parsed, and ends up looking like this for me.

Would you be open to a PR to remove the signin link from this footer?

• Delivery notification
• Bounce notification
• Complaint notification

Currently all environment variables are stored in plain text. That's pretty stupid... We should store it encrypted instead for better security.

Hi I successfully integrated cloudwatch to slack but the problem is metrics graph is not showing in slack. Please help

Getting this error when trying to launch the stack from the S3 template :

The runtime parameter of nodejs6.10 is no longer supported for creating or updating AWS Lambda functions. We recommend you use the new runtime (nodejs8.10) while creating or updating functions. (Service: AWSLambdaInternal; Status Code: 400; Error Code: InvalidParameterValueException; Request ID: 1184b2c9-7840-11e9-a662-eb416f189a16)

@arabold Thank you for creating such an easy-to-read and incredibly useful repo!

I have need of Slack integration on several AWS projects. I will be extending this in 2019 to include:

• Auto-Scaling messages
• ECS deploy messages
• add AWS Console link URLs so message titles become clickable
• extend CloudFormation template with option to create global CloudWatch Alarms for smaller projects

AWS Lambda now supports Node v8.10.

In my other projects my team has really benefited from the easier reasoning/reading that comes with the async/await pattern. BlueBird is a solid and performant library and I think a perfect choice when you created this repo. I think for my purposes, the easier reasoning is worth a couple more hours to re-write the code into native async/await. I'm hoping with the Node-core team committing to the async/await keywords, that the pattern will live longer than any single library might.

Of course this would be a large change for this repo.
Would you be open to a Pull Request this large, or would you prefer I keep my work separate?

https://s3.amazonaws.com/aws-to-slack-us-east-1/release.zip results in the behavior noted in my comment.

I tried building from d9ca09c and uploading that as
@homeyjd suggested.

The build artifact resulted in an error in CloudWatch:

Syntax error in module 'src/index': SyntaxError async processEvent(event) { ^^^^^^^^^^^^ SyntaxError: Unexpected identifier at createScript (vm.js:56:10) at Object.runInThisContext (vm.js:97:10) at Module._compile (module.js:542:28) at Object.Module._extensions..js (module.js:579:10) at Module.load (module.js:487:32) at tryModuleLoad (module.js:446:12) at Function.Module._load (module.js:438:3) at Module.require (module.js:497:17) at require (internal/module.js:20:19) 

@homeyjd, is there a different git commit that I can try? I also want to test building on a different machine just to rule out my build environment.

Resultant local build zip: release.zip

build output
make-package-output.log

[edited for clarity, length and readability]

Time to cut a release? There are 116 commits since the last release, including several new parsers and the async refactor. Feels like maybe it's time, that waiting will just make it harder as the changes build up... 😁 Thanks!

image_url appears to be empty, so obviously no chart is rendered. The role policy assigned to the lambda does allow for cloudwatch:GetMetricStatistics.

2018-08-23T03:49:19.325Z	834ff060-a687-11e8-b54b-f3bd08db589d	Incoming Message:
{
    "Records": [
        {
            "EventSource": "aws:sns",
            "EventVersion": "1.0",
            "EventSubscriptionArn": "arn:aws:sns:us-east-2:**********:**************-rds-threshold-alerts20180815150821831900000005:6aee2bab-c8e0-465f-934c-77b416215e86",
            "Sns": {
                "Type": "Notification",
                "MessageId": "3af0ec97-5293-53a0-acd2-bf6f626d8cf7",
                "TopicArn": "arn:aws:sns:us-east-2:*************:*************-rds-threshold-alerts20180815150821831900000005",
                "Subject": "ALARM: \"**************-master-rds-cpu-utilization-too-high\" in US East (Ohio)",
                "Message": "{\"AlarmName\":\"**************-master-rds-cpu-utilization-too-high\",\"AlarmDescription\":\"Average database CPU utilization over the last 5 minutes exceeded threshold: ***************-master\",\"AWSAccountId\":\"**********\",\"NewStateValue\":\"ALARM\",\"NewStateReason\":\"Threshold Crossed: 1 out of the last 1 datapoints [1.8873761229939232 (23/08/18 03:44:00)] was greater than the threshold (1.0) (minimum 1 datapoint for OK -> ALARM transition).\",\"StateChangeTime\":\"2018-08-23T03:49:18.798+0000\",\"Region\":\"US East (Ohio)\",\"OldStateValue\":\"OK\",\"Trigger\":{\"MetricName\":\"CPUUtilization\",\"Namespace\":\"AWS/RDS\",\"StatisticType\":\"Statistic\",\"Statistic\":\"AVERAGE\",\"Unit\":null,\"Dimensions\":[{\"name\":\"DBInstanceIdentifier\",\"value\":\"************-master\"}],\"Period\":300,\"EvaluationPeriods\":1,\"ComparisonOperator\":\"GreaterThanThreshold\",\"Threshold\":1.0,\"TreatMissingData\":\"- TreatMissingData:                    Ignore\",\"EvaluateLowSampleCountPercentile\":\"\"}}",
                "Timestamp": "2018-08-23T03:49:18.845Z",
                "SignatureVersion": "1",
                "Signature": "*****************+15FcMBh4NJDcl4HFTCPu***********",
                "SigningCertUrl": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-ac565b8b1a6c5d002d285f9598aa1d9b.pem",
                "UnsubscribeUrl": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:***********:*************-rds-threshold-alerts20180815150821831900000005:6aee2bab-c8e0-465f-934c-77b416215e86",
                "MessageAttributes": {}
            }
        }
    ]
}


2018-08-23T03:49:21.608Z	834ff060-a687-11e8-b54b-f3bd08db589d	Sending Message to Slack:
{
    "attachments": [
        {
            "fallback": "**************-master-rds-cpu-utilization-too-high state is now ALARM:\nThreshold Crossed: 1 out of the last 1 datapoints [1.8873761229939232 (23/08/18 03:44:00)] was greater than the threshold (1.0) (minimum 1 datapoint for OK -> ALARM transition).",
            "color": "danger",
            "author_name": "Amazon CloudWatch Alarm",
            "title": "***************-master-rds-cpu-utilization-too-high",
            "text": "Threshold Crossed: 1 out of the last 1 datapoints [1.8873761229939232 (23/08/18 03:44:00)] was greater than the threshold (1.0) (minimum 1 datapoint for OK -> ALARM transition).",
            "fields": [
                {
                    "title": "Acount ID",
                    "value": "****************",
                    "short": true
                },
                {
                    "title": "Region",
                    "value": "US East (Ohio)",
                    "short": true
                },
                {
                    "title": "Old State",
                    "value": "OK",
                    "short": true
                },
                {
                    "title": "New State",
                    "value": "ALARM",
                    "short": true
                }
            ],
            "ts": 1534996158,
            "image_url": ""
        }
    ]
}

Many of the parsers assume the Slack receiver has AWS Console access to the resources mentioned and include back-links into AWS. Even generic SNS messages assume the receiver can view/manage SNS topics.

Sometimes the people at the Slack target don't have any access to the AWS resources generating the events. It would be nice to have the option to either

• have parsers include or omit back-links to AWS (as a per-deployment preference)
• in that parser list have two parsers for the same event with/without links (first selector decides)

I suggest an INCLUDE_AWS_LINKS environment variable that tells that deployment whether or not including back-links is preferred.

Multiple deployments for different targets works fine, and I can set this global preference so that I don't have to fork the code-base for internal/external audiences. I've implemented something like this to test it out, and could extract a PR later if this is a desirable feature.

Many of my alarms are using p99 statistics, and those seem to be causing the chart to fail with an error:

Error rendering chart: { InvalidParameterValue: The parameter Statistics.member.1 must be a value in the set [ Minimum, Maximum, Average, SampleCount, Sum ]

Have you seen https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricWidgetImage.html? Its not in the aws-sdk that comes in Lambda's Node runtime, but I think could be worth considering

This is a feature request:
With the AWS Security Hub aggregating security findings from plethora of AWS tools and external providers it'd be great if you had "AWS Security Hub Findings integration".
Is this on the roadmap/eta?

Hi I love what you have built here and recently set up a codebuild notification pipeline with ease. I was hoping there was a way to support sending messages to different slack hook urls on a per service basis, i.e. send codedeploy messages to a different channel. I could work on writing the code myself or if theres a way to do this already then please advise.

The Makefile includes some echo -e commands to add to the target file. The -e seems to work and the backslashes get interpreted, but also the '-e' is turning up in the output added to the file. Can't explain that. Any idea?

-e # Makefile on Sat Jul  6 13:04:24 DST 2019
STACK_ID=arn:aws:cloudformation:...
-e # Makefile on Sat Jul  6 13:04:26 DST 2019
LAMBDA_NAME=aws-to-slack-ABCDEFGIJK

echo is working as you'd expect on the command line.

$ echo "Foo\nBar"
Foo\nBar
$ echo -e "Foo\nBar"
Foo
Bar

GNU Make 4.1
GNU bash, version 4.4.19(1)-release

We are currently seeing an issue with aws2slack where Lambdas would fail due to timeouts (30s). It seems this is somehow related to memory consumption as it will use all available memory at this point:

`06:26:20REPORT RequestId: 4a1e0e6e-5bd7-4951-b3df-b701d8e5d8a5 Duration: 30030.25 ms Billed Duration: 30000 ms Memory Size: 256 MB Max Memory Used: 256 MB

06:26:20 2019-06-12T06:26:20.256Z 4a1e0e6e-5bd7-4951-b3df-b701d8e5d8a5 Task timed out after 30.03 seconds`

sometimes also this message is logged:

`06:27:34 REPORT RequestId: 4a1e0e6e-5bd7-4951-b3df-b701d8e5d8a5 Duration: 18887.18 ms Billed Duration: 18900 ms Memory Size: 256 MB Max Memory Used: 257 MB

06:27:34 RequestId: 4a1e0e6e-5bd7-4951-b3df-b701d8e5d8a5 Error: Runtime exited with error: signal: killed Runtime.ExitError`

It happens quite often, however in between there are successful calls.

Any idea what could cause the timeout and the high memory consumption?

EDIT: Same input works when running locally...

With the recent announcement about the depreciation of Node.js 8.10, at the end of the year, I tested this using the Nodejs10.x run time, and am receiving the following error when it executes the function:

{ "errorType": "Runtime.ImportModuleError", "errorMessage": "Error: Cannot find module 'lodash'", "trace": [ "Runtime.ImportModuleError: Error: Cannot find module 'lodash'", " at _loadUserApp (/var/runtime/UserFunction.js:100:13)", " at Object.module.exports.load (/var/runtime/UserFunction.js:140:17)", " at Object.<anonymous> (/var/runtime/index.js:45:30)", " at Module._compile (internal/modules/cjs/loader.js:778:30)", " at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)", " at Module.load (internal/modules/cjs/loader.js:653:32)", " at tryModuleLoad (internal/modules/cjs/loader.js:593:12)", " at Function.Module._load (internal/modules/cjs/loader.js:585:3)", " at Function.Module.runMain (internal/modules/cjs/loader.js:831:12)", " at startup (internal/bootstrap/node.js:283:19)" ] }

Just wonder if anyone else is seeing this?

Hi,

the 1.1.x releases had an release.zip already present with the required dependencies in the build directory. Would it be possible to add it to the 1.2.x releases as well?

Thanks.

When trying to launch a template, says access denied to your s3 bucket. Although I can clone, would rather go straight to the source. Thanks.

This is a really nice project and super easy to use. THANKS!!

I have a cloutwatch logs filter and alarm on certain filter expressions. It would be nice to also send the like containing the filter expression to slack along with the metrics.

Should all the notifications for the supported resources come through formatted and coloured? Only, I get all the notifications, but only CloudWatch Alarms (CPU etc) are correctly formatted. All others come through, as what seems to be, the raw json format. I have tried all the supported formats, but can't seem to get them to display nicely.

Example of GuardDuty notifications: