AWS CloudWatch + Datadog
Connect AWS CloudWatch and Datadog for Full-Stack Observability
Automate monitoring workflows between AWS CloudWatch and Datadog to eliminate blind spots and speed up incident response.
Why integrate AWS CloudWatch and Datadog?
AWS CloudWatch and Datadog are two of the most widely used monitoring platforms in cloud infrastructure, and teams that rely on both often struggle to correlate metrics, logs, and alerts across each system by hand. By integrating AWS CloudWatch with Datadog through tray.ai, engineering and DevOps teams can unify telemetry data, synchronize alerting pipelines, and build automated remediation workflows without writing custom glue code. Whether you're centralizing multi-cloud visibility or tightening on-call escalations, connecting these two platforms gives you a single pane of glass across your entire observability stack.
Automate & integrate AWS CloudWatch & Datadog
Use case
Sync CloudWatch Alarms to Datadog as Monitor Alerts
When an AWS CloudWatch alarm transitions to an ALARM state — elevated CPU utilization on an EC2 instance or a Lambda error rate spike, for example — tray.ai automatically creates or updates a corresponding monitor alert in Datadog. Your Datadog incident timeline reflects the full picture of AWS infrastructure health in real time. On-call engineers no longer need to check both consoles simultaneously during an active incident.
Use case
Forward CloudWatch Log Insights to Datadog Log Management
Automatically export filtered CloudWatch Logs Insights query results or log group events into Datadog's Log Management platform for enriched analysis, correlation, and long-term retention. tray.ai triggers on new log events matching specific patterns and pushes structured log entries to Datadog with custom tags and metadata attached. This connects AWS-native log storage directly to Datadog's log parsing and alerting engine.
Use case
Trigger Datadog Incidents from CloudWatch Composite Alarms
AWS CloudWatch Composite Alarms evaluate multiple underlying alarms to represent the overall health of a complex service, making them ideal triggers for Datadog incident creation. With tray.ai, a Composite Alarm breach can automatically open a Datadog incident, populate it with the contributing alarm details, assign it to the relevant service team, and post a notification to your Slack channel. No critical infrastructure event gets missed.
Use case
Push CloudWatch Custom Metrics to Datadog for Unified Dashboards
Teams that track business or application-level metrics via CloudWatch custom namespaces can use tray.ai to periodically push those metric data points into Datadog, enabling side-by-side visualization alongside APM traces, infrastructure metrics, and third-party service data. This is especially useful for teams who use CloudWatch for AWS-specific KPIs like SQS queue depth or DynamoDB consumed capacity but want all metrics in a single Datadog dashboard. Scheduled tray.ai workflows poll CloudWatch at defined intervals and submit metric payloads to the Datadog Metrics API.
Use case
Auto-Resolve Datadog Monitors When CloudWatch Alarms Clear
When a CloudWatch alarm returns to an OK state, tray.ai automatically sends a recovery signal to the corresponding Datadog monitor, resolving the active alert and annotating the incident timeline with the clearance timestamp. This two-way sync prevents stale open alerts in Datadog that can desensitize on-call engineers and distort incident metrics like MTTR. Keeping both systems in sync reduces noise and improves the reliability of your alerting data.
Use case
Enrich Datadog Events with CloudWatch Anomaly Detection Findings
AWS CloudWatch Anomaly Detection uses machine learning to flag unusual metric behavior. tray.ai captures those anomaly findings and forwards them as enriched events to Datadog's event stream, letting teams correlate CloudWatch anomaly windows with deployment markers, APM traces, and RUM sessions inside Datadog to quickly identify root cause. The workflow can also automatically add Datadog tags corresponding to the anomalous CloudWatch metric dimension for rapid filtering.
Use case
Notify and Escalate CloudWatch Budget Alerts via Datadog
AWS CloudWatch can work alongside AWS Budgets to emit alarms when cloud spend approaches defined thresholds. tray.ai routes those cost alerts into Datadog as events or monitor notifications tied to infrastructure ownership tags. FinOps and platform engineering teams can then track cost anomalies in the same Datadog dashboards they use for performance monitoring — one operational console for both reliability and cost governance. The workflow can also trigger automated Datadog runbook links to guide engineers through cost investigation steps.
Get started with AWS CloudWatch & Datadog integration today
AWS CloudWatch & Datadog Challenges
What challenges are there when working with AWS CloudWatch & Datadog and how will using Tray.ai help?
Challenge
Handling High-Volume CloudWatch Metric and Log Throughput
AWS CloudWatch can emit thousands of metric data points and log events per minute across large infrastructure footprints. Naive polling approaches to Datadog sync are inefficient, costly, and prone to data gaps or API rate limit errors on the Datadog side.
How Tray.ai Can Help:
tray.ai workflows support configurable batching, pagination, and scheduled polling intervals that respect both the CloudWatch GetMetricData API quotas and the Datadog Metrics API rate limits. Built-in retry logic and error handling ensure no data points are silently dropped during high-throughput sync windows.
Challenge
Mapping CloudWatch Alarm Severities to Datadog Priority Levels
CloudWatch alarms use a simple OK/ALARM/INSUFFICIENT_DATA state model, while Datadog monitors support a richer P1-P5 priority scale and warn/critical threshold tiers. Without careful mapping logic, integrations can misclassify low-severity CloudWatch alarms as critical Datadog incidents — or miss critical AWS events entirely.
How Tray.ai Can Help:
tray.ai's visual workflow builder lets teams define custom conditional branching logic that maps CloudWatch alarm metadata — threshold values, namespace, or alarm description tags — to the appropriate Datadog monitor priority and notification channel, so severity is represented accurately without manual intervention.
Challenge
Maintaining Two-Way State Consistency Between Both Platforms
When alerts are resolved, muted, or acknowledged in one platform, teams expect the other to reflect that change promptly. Without two-way sync, Datadog can show open alerts for AWS issues that resolved hours ago, undermining on-call trust in the alerting system and inflating MTTR statistics.
How Tray.ai Can Help:
tray.ai supports event-driven workflows in both directions — listening for CloudWatch alarm OK transitions to resolve Datadog monitors, and optionally consuming Datadog webhooks to annotate CloudWatch dashboards with acknowledgment and mute events. Both platforms stay in sync throughout the full incident lifecycle.
Challenge
Enriching Sparse CloudWatch Events with Actionable Context
Raw CloudWatch alarm notifications often contain only metric names and numeric threshold values. There's none of the human-readable context — service owner, runbook links, impacted customer segments — that on-call engineers need to triage quickly inside Datadog. Forwarding bare CloudWatch payloads without enrichment slows incident response.
How Tray.ai Can Help:
tray.ai workflows can look up additional context before forwarding events to Datadog — querying an internal CMDB, fetching AWS resource tags via the EC2 or Lambda API, or pulling runbook URLs from a Confluence connector — and inject all of that metadata into the Datadog event or incident payload at creation time.
Challenge
Avoiding Duplicate Alerts Across Both Monitoring Platforms
Organizations running both CloudWatch alarms and the native Datadog AWS integration simultaneously risk generating duplicate alert storms, where the same underlying AWS issue fires notifications from both platforms independently. That overwhelms on-call engineers and makes it hard to know which alert represents the authoritative state.
How Tray.ai Can Help:
tray.ai workflows can include deduplication logic using built-in state stores or external key-value lookups to check whether a Datadog monitor already exists for a given CloudWatch alarm before creating a new one. This prevents duplicate incident creation and lets teams designate a single authoritative alerting path for each AWS service tier.
Start using our pre-built AWS CloudWatch & Datadog templates today
Start from scratch or use one of our pre-built AWS CloudWatch & Datadog templates to quickly solve your most common use cases.
AWS CloudWatch & Datadog Templates
Find pre-built AWS CloudWatch & Datadog solutions for common use cases
Template
CloudWatch Alarm to Datadog Monitor Alert
This template listens for CloudWatch alarm state change events via Amazon EventBridge and automatically creates or updates a Datadog monitor alert with the alarm name, state, threshold, and affected resource. It maps CloudWatch alarm severity levels to Datadog monitor priority tiers and posts a summary notification to a configured Datadog event stream.
Steps:
- Receive CloudWatch alarm state change notification via EventBridge or SNS trigger
- Parse alarm metadata including name, state, threshold, and affected AWS resource ARN
- Create or update a Datadog monitor alert with mapped severity and enriched alarm context
Connectors Used: AWS CloudWatch, Datadog
Template
Scheduled CloudWatch Metrics Sync to Datadog
On a configurable schedule, this template queries specified CloudWatch metric namespaces and dimensions, retrieves recent data points, and submits them to the Datadog Metrics API with custom tags for environment, region, and service. It's designed for teams who need AWS custom metrics visible in Datadog dashboards without configuring the native AWS integration for every metric namespace.
Steps:
- Trigger workflow on a defined schedule (e.g., every 5 minutes)
- Query CloudWatch GetMetricData API for configured namespaces and dimension filters
- Submit retrieved data points to Datadog Metrics API with environment and service tags
Connectors Used: AWS CloudWatch, Datadog
Template
CloudWatch Composite Alarm to Datadog Incident Creator
When a CloudWatch Composite Alarm enters an ALARM state, this template automatically opens a new Datadog incident, populates it with contributing alarm details and affected service metadata, assigns it to the appropriate responder team, and sends a Datadog notification. When the Composite Alarm resolves, the workflow marks the Datadog incident as resolved.
Steps:
- Detect CloudWatch Composite Alarm state transition to ALARM via EventBridge
- Create Datadog incident with contributing alarm context, severity, and service team assignment
- Monitor for CloudWatch alarm resolution and automatically resolve the Datadog incident
Connectors Used: AWS CloudWatch, Datadog
Template
CloudWatch Log Events to Datadog Log Forwarder
This template subscribes to one or more CloudWatch Log Groups and forwards matching log events to Datadog Log Management in real time. Each forwarded log entry is enriched with custom tags for AWS account ID, region, log group name, and service, making the logs immediately searchable and alertable within Datadog.
Steps:
- Trigger on new CloudWatch Log Group events matching defined filter patterns
- Enrich each log entry with AWS account, region, service, and environment metadata tags
- Submit structured log payloads to Datadog Logs intake API in batches
Connectors Used: AWS CloudWatch, Datadog
Template
Datadog Monitor Recovery Sync Back to CloudWatch Dashboard
This two-way template listens for Datadog monitor state changes — particularly recoveries and mutes — and pushes corresponding annotations to a CloudWatch dashboard widget, so AWS-focused stakeholders can see incident lifecycle events without logging into Datadog directly. It also optionally creates a CloudWatch custom metric data point to track Datadog alert frequency over time.
Steps:
- Receive Datadog monitor state change webhook (alert, warn, recovery, mute)
- Post an annotation event to the configured AWS CloudWatch dashboard
- Submit a custom CloudWatch metric data point recording the alert state transition
Connectors Used: AWS CloudWatch, Datadog
Template
CloudWatch Anomaly Detection Event to Datadog Event Stream
This template captures CloudWatch Anomaly Detection band breaches from EventBridge and enriches them with metric dimension context before posting them to the Datadog event stream. The resulting Datadog events are tagged by AWS service, region, and anomaly severity, enabling correlation overlays on Datadog APM and infrastructure dashboards.
Steps:
- Capture CloudWatch anomaly detection breach event from Amazon EventBridge
- Enrich event payload with metric namespace, dimension labels, and anomaly confidence score
- Post enriched event to Datadog event stream with correlated service and region tags
Connectors Used: AWS CloudWatch, Datadog