How to set an alarm based on a AWS::CloudWatch::AnomalyDetector

Question

I've created an AnomalyDetector as below, and wish to use it in an Alarm. [The documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cw-alarm.html#aws-properties-cw-alarm--examples) doesn't make sense to me: there's nothing in that code snippet to link the AnomalyDetector to the alarm, and there seems to be nothing in the AnomalyDetector spec that provides an id that could be referred to be another resource. Is there an error in this documentation?

I can't simply use `ANOMALY_DETECTION_BAND(m1, 2)` in the Alarm as I need to exclude some data from the detector.

```
"ConfigFetchAnomalyDetector": {
                "Type": "AWS::CloudWatch::AnomalyDetector",
                "Properties": {
                    "MetricMathAnomalyDetector": {
                        "MetricDataQueries": [
                        {
                            "Id": "someValueA",
                            "Label": "Some Value A",
                            "MetricStat": {
                                "Metric": {
                                    "MetricName": "someMetric",
                                    "Dimensions": [
                                    {
                                        "Name": "os",
                                        "Value": "iOS"
                                    }
                                    ],
                                    "Namespace": "SomeNamespace"
                                },
                                "Period": 900,
                                "Stat": "Sum"
                            },
                            "ReturnData": false
                        },
                        {
                            "Id": "someValueB",
                            "Label": "someValueB",
                            "MetricStat": {
                                "Metric": {
                                    "MetricName": "someMetric",
                                    "Dimensions": [
                                    {
                                        "Name": "os",
                                        "Value": "iPadOS"
                                    }
                                    ],
                                    "Namespace": "SomeNamespace"
                                },
                                "Period": 900,
                                "Stat": "Sum"
                            },
                            "ReturnData": false
                        },
                        {

"Id": "totalOfValues",
                            "Label": "Total of Values",
                            "Expression": "someValueA + someValueB",
                            "ReturnData": true
                        }]
                    },
                    "Configuration": {
                        "MetricTimeZone": "Europe/London",
                        "ExcludedTimeRanges": [
                        {
                            "StartTime": "2022-08-11T00:00:00",
                            "EndTime": "2022-08-11T23:59:59"
                        }]
                    }
                }
            },

```

Answer

Hello there,

Thanks for your question.

I do not see any error on the documentation for the AnomalyDetector resource for CloudWatch service on CloudFormation documents. So what happens is that when we want to use Anomaly Detector on CloudWatch Alarm firstly we need define the Anomaly Detector model to be created(whether it is for single Metric or a MetricMath) which is what we are doing with the section of **"Type": "AWS::CloudWatch::AnomalyDetector",** and then we are referencing the Anomaly detection to be used for the metrics/MetricMath function on the Alarm configuration.

With the information you have provided, I have come up with below example CloudFormation Template and tested to create CW Alarm that is using **MetricMathAnomalyDetector**.

```
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Parameters": {
        "Instance1": {
            "Description": "The EC2 instance ID to associate this alarm with.",
            "Type": "AWS::EC2::Instance::Id"
        },
        "Instance2": {
            "Description": "The EC2 instance ID to associate this alarm with.",
            "Type": "AWS::EC2::Instance::Id"
        }
    },
    "Resources": {
        "ConfigFetchAnomalyDetector": {
            "Type": "AWS::CloudWatch::AnomalyDetector",
            "Properties": {
                "MetricMathAnomalyDetector": {
                    "MetricDataQueries": [{
                        "Id": "m1",
                        "Label": "m1",
                        "MetricStat": {
                            "Metric": {
                                "MetricName": "CPUUtilization",
                                "Dimensions": [{
                                    "Name": "InstanceId",
                                    "Value": {
                                        "Ref": "Instance1"
                                    }
                                }],
                                "Namespace": "AWS/EC2"
                            },
                            "Period": 60,
                            "Stat": "Average"
                        },
                        "ReturnData": false
                    }, {
                        "Id": "m2",
                        "Label": "m2",
                        "MetricStat": {
                            "Metric": {
                                "MetricName": "CPUUtilization",
                                "Dimensions": [{
                                    "Name": "InstanceId",
                                    "Value": {
                                        "Ref": "Instance2"
                                    }
                                }],
                                "Namespace": "AWS/EC2"
                            },
                            "Period": 60,
                            "Stat": "Average"
                        },
                        "ReturnData": false
                    }, {
                        "Id": "e1",
                        "Label": "Total of Values",
                        "Expression": "m1 + m2",
                        "ReturnData": true
                    }]
                },
                "Configuration": {
                    "MetricTimeZone": "Europe/London",
                    "ExcludedTimeRanges": [{
                        "StartTime": "2022-08-11T00:00:00",
                        "EndTime": "2022-08-11T23:59:59"
                    }]
                }
            }
        },
        "EC2AnomalyDetectionAlarm": {
            "Type": "AWS::CloudWatch::Alarm",
            "Properties": {
                "AlarmDescription": "EC2AnomalyDetectionAlarm",
                "AlarmName": "EC2AnomalyDetectionAlarm",
                "ComparisonOperator": "LessThanLowerOrGreaterThanUpperThreshold",
                "EvaluationPeriods": 1,
                "Metrics": [{
                    "Expression": "ANOMALY_DETECTION_BAND(e1, 2)",
                    "Id": "ad1"
                }, {
                    "Id": "e1",
                    "Label": "Total of Values",
                    "Expression": "m1 + m2",
                    "ReturnData": true
                }, {
                    "Id": "m1",
                    "Label": "m1",
                    "MetricStat": {
                        "Metric": {
                            "MetricName": "CPUUtilization",
                            "Dimensions": [{
                                "Name": "InstanceId",
                                "Value": {
                                    "Ref": "Instance1"
                                }
                            }],
                            "Namespace": "AWS/EC2"
                        },
                        "Period": 60,
                        "Stat": "Average"
                    },
                    "ReturnData": false
                }, {
                    "Id": "m2",
                    "Label": "m2",
                    "MetricStat": {
                        "Metric": {
                            "MetricName": "CPUUtilization",
                            "Dimensions": [{
                                "Name": "InstanceId",
                                "Value": {
                                    "Ref": "Instance2"
                                }
                            }],
                            "Namespace": "AWS/EC2"
                        },
                        "Period": 60,
                        "Stat": "Average"
                    },
                    "ReturnData": false
                }],
                "ThresholdMetricId": "ad1",
                "TreatMissingData": "breaching"
            }
        }
    }
}
```
Once you create the Alarm you can see the Anomaly Detection model with below AWS CLI command and see how the model is configured:

```
# aws cloudwatch describe-anomaly-detectors --anomaly-detector-types METRIC_MATH
```

If you have any further questions, please post it as a comment and I am happy to help you further.

I trust that you find above information helpful. Have an AWSome day ahead!

Thanks

How to set an alarm based on a AWS::CloudWatch::AnomalyDetector

Relevant content