Alarms, Dashboards, and Notifications

The previous topic filled CloudWatch with numbers and log lines. Nobody is watching them. This topic closes the gap between a metric moving and a person or a script doing something about it, and it spends most of its effort on the two places that gap silently breaks: how an alarm decides to change state, and what happens to a notification after CloudWatch hands it to SNS.

Both failure directions get equal attention here. An alarm that never fires and an alarm that fires 40 times for one event are the same design mistake seen from opposite sides, and the fix for each is a specific feature rather than a better threshold.

What This Topic Covers

• Metric alarm anatomy: period, evaluation periods, datapoints to alarm, M out of N evaluation, the wider evaluation range CloudWatch reads, and the four missing-data treatments
• Why alarm actions fire only on a state change, the Auto Scaling exception, and how to diagnose an alarm stuck in INSUFFICIENT_DATA
• Alarms without a fixed threshold: metric math expressions and anomaly detection models, including what anomaly detection cannot drive
• Amazon SNS for alerting: topics, subscriptions and the confirmation step, fanout, filter policies, standard versus FIFO topics, per-protocol retry policies, dead-letter queues, and the KMS key policy that encrypted topics need
• Composite alarms: rule expressions over other alarms, what they can and cannot do, dependency cycles, and action suppression with WaitPeriod and ExtensionPeriod during maintenance
• Automated alarm actions: EC2 stop, terminate, reboot and recover, Auto Scaling policies, Lambda, Systems Manager OpsItems and incidents
• CloudWatch dashboards: widget types, cross-account and cross-Region views, dashboards managed as JSON, variables, and what dashboard sharing actually grants

Why It Matters

This is the part of Domain 1 where the exam stops asking what a service does and starts asking why a correctly configured setup produced the wrong outcome. The alarm history shows the action succeeded and no email arrived. The alarm stayed in ALARM for an hour and paged once. Alarms stopped arriving the day encryption was enabled on the topic. Each of those has one precise cause, and none of them is visible from the service names in the question.

The same knowledge carries the rest of the course. An Auto Scaling policy in the next domain is a CloudWatch alarm with a scaling action attached. Automated compliance response in the Security domain is the same detection-to-action pattern with a different trigger. Learn where alarms and notifications break here, and the later domains become applications of it rather than new material.