Why did my CloudWatch alarm send me a notification after a single breached data point?

Short description

Your CloudWatch alarm might be configured to treat a missing data point the same way as a breaching data point.

You might have a series of non-breaching data points, followed by a single breaching data point, and then missing data points. Your alarm counts any missing data points following a breaching data point as additional breaches. This causes your alarm to notify you after only one data point breaches the defined threshold.

When all data points are missing except one breaching data point, your alarm goes into ALARM state. This happens when the oldest available breaching data point in the alarm's evaluation range is at least as old as the value of Datapoints to Alarm, and all other more recent data points are breaching or missing. This causes an ALARM state even if the total number of breaching data points is lower than the Datapoints to Alarm setting, and even when missing data is being treated as missing.

Resolution

Edit your alarm to do one or more of the following:

• If you don't want to be notified after a single breach when data points may be intermittent, change how missing data points are evaluated to NOT BREACHING.
• Use a longer period for a datapoint.
• Increase the number of evaluation periods before the alarm is triggered.

Related information

describe-alarm-history

put-metric-alarm