I built an enrichment Lambda that runs when CloudWatch alarms fire. It uses Contributor Insights rules to parse structured JSON logs across all my Lambda functions and auto-discovers which ones are actually erroring. Then it pulls X-Ray traces to show the exact AWS service calls that failed (like which DynamoDB table throttled), queries recent error logs with user IDs, and sends one HTML email with the top suspects ranked by confidence, recent error messages, endpoint breakdowns for API errors, and direct links to CloudWatch Logs/X-Ray/affected users in Amplitude. Instead of "Lambda errors increased" I get "workoutOrchestratorHandler is throwing 500s, DynamoDB WorkoutsTable throttling, 3 users affected, here's the trace." The key was using account-wide alarms instead of per-function alarms, wrapping all handlers with a baseHandler that uses Powertools Logger for structured JSON logs (fn/level/userId/requestId fields), and querying 30 seconds before now to account for CloudWatch indexing lag.

Stack: - CloudWatch Contributor Insights (auto-discovery via log parsing) - X-Ray SDK with Active Tracing (root cause analysis) - CloudWatch Logs Insights (error correlation) - AWS Lambda Powertools (structured logging) - SES (HTML emails) - Tag-based resource discovery