AWS CloudWatch
Anatomy of Alarms
Alarm States
AWS CloudWatch alarms continuously monitor metrics and compare them against your defined thresholds. An alarm can reside in one of three states:
| Alarm State | Description |
|---|---|
| OK | Metric value is within the defined threshold. |
| ALARM | Metric value breaches the threshold for the required number of evaluation periods. |
| INSUFFICIENT_DATA | Not enough datapoints yet to determine the state. |
Core Configuration Settings
CloudWatch evaluates your metrics based on three key parameters:
| Setting | Definition |
|---|---|
| Threshold | The metric limit that triggers the alarm (e.g., > 70% CPU). |
| Period | The duration for each datapoint aggregation (e.g., 5 minutes). |
| Evaluation Periods | Number of consecutive periods that must breach the threshold. |
Note
When an alarm has fewer datapoints than the specified evaluation periods (for example, at startup or during missing metrics), it transitions to INSUFFICIENT_DATA until it can fully evaluate the threshold.
How States Transition
Imagine you set up an alarm on an RDS instance to fire when CPU utilization exceeds 70%, with:
- Period = 5 minutes
- Evaluation Periods = 3
- Period 1: CPU spikes to 80% → only one breach datapoint → state moves to INSUFFICIENT_DATA
- Period 2: CPU remains above 70% → second breach datapoint → still INSUFFICIENT_DATA
- Period 3: CPU stays above 70% → third breach datapoint → state transitions to ALARM
If the CPU then drops below 70% for three consecutive periods, the alarm returns to OK.
References
- AWS CloudWatch Alarms Documentation
- AWS CloudWatch Metrics and Dimensions
- Working with Datapoints and Statistics
Watch Video
Watch video content