CloudWatch alarms in AWS - Step-by-Step Execution

Process Flow - CloudWatch alarms

Metric data collected

↓

Evaluate metric against threshold

↓

Threshold met

↓

Trigger actions

↓

Wait for next evaluation

CloudWatch alarms watch metrics and compare them to a set limit. If the metric crosses the limit, the alarm changes state and can trigger actions.

Execution Sample

AWS

Metric: CPUUtilization
Threshold: 70
Period: 1 min
Evaluate every 1 min
Alarm action: Send notification

This alarm checks CPU usage every minute. If CPU usage goes above 70%, it triggers a notification.

Process Table

Step	Metric Value (%)	Condition (Value > 70?)	Alarm State	Action Taken
1	65	No	OK	No action
2	72	Yes	ALARM	Send notification
3	75	Yes	ALARM	No action
4	68	No	OK	No action
5	69	No	OK	No action
6	71	Yes	ALARM	Send notification

💡 Alarm evaluates metric every minute; stops when monitoring ends or alarm deleted.

Status Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	After 6
Metric Value (%)	N/A	65	72	75	68	69	71
Alarm State	OK	OK	ALARM	ALARM	OK	OK	ALARM
Action Taken	None	None	Notification sent	None	None	None	Notification sent

Key Moments - 3 Insights

Why does the alarm state change back to OK after being ALARM?

Because the metric value dropped below the threshold (see step 4 in execution_table), the alarm returns to OK state.

Does the alarm send notifications every time the metric is above threshold?

No, only when the alarm transitions to the ALARM state (steps 2 and 6). In step 3, the metric is still above threshold but the state was already ALARM, so no action is triggered.

What happens if the metric value equals the threshold exactly?

The alarm triggers only if the value is greater than the threshold, not equal. So equal values keep alarm state OK.

Visual Quiz - 3 Questions

Look at the execution_table, what is the alarm state at step 5?

A OK

B ALARM

C INSUFFICIENT_DATA

D UNKNOWN

💡 Hint

Check the 'Alarm State' column for step 5 in the execution_table.

At which step does the alarm first send a notification?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Action Taken' column to find when 'Send notification' first appears.

If the threshold was changed to 65%, what would be the alarm state at step 1?

A OK

B INSUFFICIENT_DATA

C ALARM

D UNKNOWN

💡 Hint

Compare the metric value at step 1 with the new threshold in the variable_tracker.

Concept Snapshot

CloudWatch alarms watch a metric over time.
They compare metric values to a threshold.
If metric > threshold, alarm state becomes ALARM.
Alarm can trigger actions like notifications.
Alarm state returns to OK if metric falls below threshold.
Evaluations happen at set intervals.

Full Transcript

CloudWatch alarms monitor metrics like CPU usage. Every evaluation period, the alarm checks if the metric is above a set threshold. If yes, the alarm state changes to ALARM and triggers actions such as notifications. If the metric falls below the threshold, the alarm state returns to OK. This process repeats at each evaluation interval, allowing continuous monitoring and alerting.