# CloudWatch Synthetics Canary Checklist (July 2026)

## Before you create a canary

- [ ] Critical user journey named (e.g. login, checkout, health API)
- [ ] Success criteria defined (HTTP 200 + body assert, or screenshot step)
- [ ] Frequency chosen (1–5 min for Tier-1; 15 min for Tier-2)
- [ ] Alarm pages only if runbook + owner exist ([monitoring vs alerting](../observability/monitoring-vs-alerting-checklist.md))
- [ ] Linked to Application Signals SLO for the same journey

## Runtime / networking

- [ ] Runtime version pinned (confirm current Synthetics runtimes in AWS docs)
- [ ] If target is private: VPC config with correct subnets, security groups, and DNS
- [ ] Outbound to CloudWatch endpoints allowed from canary ENIs
- [ ] Secrets in Secrets Manager / SSM — not hardcoded in script

## Cost levers

| Lever | Effect |
| --- | --- |
| Frequency | Dominant cost driver — 1 min ≫ 5 min |
| Concurrent canaries | Multiply runs |
| Artifact S3 retention | Screenshots/HAR storage |
| Failed-run retries | Extra executions |

Rough worksheet: `runs/month ≈ (43,200 / interval_minutes) × canary_count` (30.0-day month). Confirm current per-canary-run price on [CloudWatch pricing](https://aws.amazon.com/cloudwatch/pricing/).

## Sample alarm sketch (conceptual)

```json
{
  "AlarmName": "synthetics-checkout-failed",
  "Namespace": "CloudWatchSynthetics",
  "MetricName": "SuccessPercent",
  "Dimensions": [{ "Name": "CanaryName", "Value": "checkout-prod" }],
  "Statistic": "Average",
  "Period": 300,
  "EvaluationPeriods": 2,
  "Threshold": 90,
  "ComparisonOperator": "LessThanThreshold",
  "TreatMissingData": "breaching",
  "AlarmActions": ["arn:aws:sns:REGION:ACCOUNT:oncall-pages"]
}
```

Pin exact metric names/dimensions from your canary’s CloudWatch console — blueprints differ by runtime.

## Do not confuse with

- **Deploy canary** (CodeDeploy / ECS progressive delivery) — different concept
- **Application Signals Service Events** — exception snapshots after deploys, not synthetic probes