Lightsail Alarm Triggering when Graph Indicates it Shouldn't Be

The inconsistency you're experiencing between your Lightsail alarm triggering and what you see on the graph is likely related to how Lightsail handles missing data points.

When evaluating alarms, Lightsail doesn't just look at the visible data points on the graph but also considers missing data points. Based on your alarm configuration, if there are missing data points during the evaluation period, how these missing points are treated can significantly impact the alarm state.

Your alarm is configured to trigger when NetworkOut falls below a threshold for 2 datapoints within 10 minutes. If your configuration treats missing data as "Breaching" or "Missing," then periods where data isn't reported would count as being below the threshold.

There are four ways Lightsail can treat missing data:

1. Not breaching - Missing data points are considered to be within normal range
2. Breaching - Missing data points are considered to be violating the threshold
3. Ignore - The alarm maintains its current state when data is missing
4. Missing - If there are not enough data points for evaluation, the alarm can go into ALARM state

Check your "Treat missing data as" setting in your alarm configuration. If it's set to "Breaching" or "Missing," this would explain why your alarm is triggering despite the visible data points appearing to be above the threshold.

To resolve this issue, you might want to change how your alarm treats missing data, especially if you know your network traffic patterns and expect occasional gaps in data reporting.
Sources
Metric alarms in Lightsail - Amazon Lightsail
PutAlarm - Amazon Lightsail
Alarm - Amazon Lightsail