Setting Up CloudWatch Alarms for Lambda Function Errors

Quick Answer

The reason a metric filter has to come first is that CloudWatch alarms can only be built on top of a metric, and a Lambda function's log output is just unstructured text sitting in a CloudWatch Logs group until something extracts a countable value from it. A metric filter is exactly that extraction step: it scans incoming log events for a pattern, in this case occurrences of the string ERROR, and converts matches into a numeric CloudWatch metric that increments every time the pattern appears. Once that metric exists, a standard CloudWatch alarm can be attached to it with a threshold, so the moment error occurrences exceed whatever count the security engineer defines, the alarm state changes and can trigger a notification. This two-step relationship, extract a metric from logs, then alarm on the metric, is the standard way to turn free-text log data into an actionable, threshold-based alert without modifying the underlying application code or introducing a separate monitoring tool. Whenever a scenario describes wanting to alert based on specific text or error patterns appearing in a log group, and there is no metric filter already in place, expect the correct first step to be creating that metric filter before an alarm can be attached to anything, since an alarm always needs a metric to watch and a metric filter is how you generate one from raw log text.