Alerting Adapter

The alerting adapter is the runtime half of AtfObservability: a subscriber Lambda that receives SNS alert messages and posts them to Slack or Teams. It is deployed for you when you configure a provider; you rarely touch it directly, but understanding it explains the observability security posture.

How it reads its webhook

The adapter reads its provider webhook URL from an SSM SecureString at runtime — never from synth, never from an environment variable, never in plaintext. This keeps the webhook out of the synthesised template and out of the function’s env, and grants the function least-privilege access to exactly that one parameter.

Fail-fast and graceful-degrade

• Synth — if no provider is configured, AtfObservability fails fast at synth rather than deploying a dead adapter.
• Runtime — if the secret is missing at runtime, the adapter degrades gracefully rather than crashing the alert path.

Budget alerts reuse it

Because AtfBudget defaults to reusing the observability alert topic, budget threshold breaches flow through the same adapter into the same channel.

Where to go next

• Observability & Alerting for the full picture.
• AtfObservability for the construct that deploys this adapter.