How do I combine multiple CloudWatch alarms into one alarm?

Short description

To combine multiple CloudWatch alarms into one alarm, create a composite alarm. When you create a composite alarm, you must create rules and define the rules to combine the status of the monitored alarms.

Note:

• Composite alarms can monitor only the states of other alarms. They don't directly monitor metrics.
• Composite alarms can send Amazon Simple Notification Service System (Amazon SNS) notifications and create OpsItems or incidents in AWS Systems Manager.
• Composite alarms can't initiate Amazon Elastic Compute Cloud (Amazon EC2) or AWS Auto Scaling actions.
• To create complex rule expressions, use logical operators such as, AND, OR, and NOT.

Resolution

Note: The following resolution creates an example composite alarm that monitors the CPU utilization and memory usage metrics of an Amazon EC2 instance. Modify the metrics for your use case.

Create the individual metric alarms

Complete the following steps:

1. Open the CloudWatch console.
2. Navigate to the Alarms section, and then choose Create Alarm.
3. Under Per-Instance Metrics, filter for CPUUtilization, and then select your Amazon EC2 instance.
4. Configure the alarm's thresholds, actions, and other parameters:
   Set statistic to Average.
   Set threshold to Static.
   Set comparison operator to Greater Than.
   Specify the threshold percentage that the alarm invokes.
   Set the evaluation periods and period. For example, two periods of 5 minutes.
5. Create a name for your alarm.
6. Choose Create.
7. Repeat steps 1-6 to create a metrics alarm for MemoryUtilization.

Create a composite alarm

Complete the following steps:

1. Open the CloudWatch console.
2. Navigate to the Alarms section, and then select your metrics alarms.
3. Choose Create composite Alarm, and then specify the alarm conditions.
   Note: The rule that you create in the Rule Expression box invokes the composite alarm when the specified metric alarms are in the ALARM state. Edit the conditions for your use case. To invoke the alarm when the metric alarms are in the ALARM state, specify the rule expression >> ALARM("Alarm1") AND ALARM("Alarm2").
4. Configure the action that your alarm takes when it's invoked. 
5. Create a name for your alarm, and then save the alarm.

Suppress the actions of your alarms

Composite alarms allow you to suppress alarm actions based on other suppressor alarms. For more information, see Suppressing composite alarm actions.