Alarms
Configure threshold and anomaly alarms, composite alarms, and SNS actions, including alarm fatigue and missing-data traps.
Mental model
A CloudWatch Alarm watches one metric (or an expression). At every evaluation period it compares the metric value against a threshold and moves between three states: OK, ALARM, INSUFFICIENT_DATA. Think of it as a standing query that runs automatically and shouts when the answer crosses a line.
Prerequisites
Alarm Fundamentals & States
Goal
Understand the three alarm states and what drives transitions between them. Create your first metric alarm via CLI. Learn how period, evaluation periods, and datapoints-to-alarm interact.
Estimated time: 60 min
The three alarm states
What's happening here
Every CloudWatch alarm is always in exactly one of three states:
- OK: the metric is within the threshold. Everything is fine.
- ALARM: the metric has breached the threshold for the configured number of evaluation periods. Something needs attention.
- INSUFFICIENT_DATA: CloudWatch doesn't have enough data points to evaluate the alarm. This happens when: the metric has never been published, the metric stopped publishing, or the alarm was just created and hasn't evaluated yet.
INSUFFICIENT_DATA is not the same as OK. A new alarm starts in INSUFFICIENT_DATA. If your metric stops publishing (your Lambda function was deleted, your service went down), the alarm goes to INSUFFICIENT_DATA: not ALARM. Without explicit configuration, a silent service looks healthy.
Key evaluation parameters:
Period: the time window (in seconds) over which metric data is aggregated per evaluation. Minimum 60s for standard metrics.EvaluationPeriods: how many consecutive periods to evaluate. The alarm looks at the last N periods.DatapointsToAlarm: how many of those N periods must breach the threshold to trigger ALARM. Default = EvaluationPeriods (all must breach). Setting M of N (e.g. 3 of 5) prevents flapping from single spikes.ComparisonOperator,GreaterThanThreshold,GreaterThanOrEqualToThreshold,LessThanThreshold,LessThanOrEqualToThreshold.
export AWS_REGION=ap-south-1
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
# Verify the metric from the Metrics lab exists
aws cloudwatch list-metrics \
--namespace MyApp/InvoiceService \
--region $AWS_REGION \
--query 'Metrics[*].MetricName'
# If the metric doesn't exist yet, publish a seed data point
aws cloudwatch put-metric-data \
--namespace MyApp/InvoiceService \
--metric-name InvoiceErrors \
--value 0 \
--unit Count \
--region $AWS_REGION