Cloudwatch alarm send notify when 1 datapoint exceed the threshold 3

I believe it’s because your metric has insufficient data therefore the only way is to alarm.

Hi, you see that the alarm flip with only one datapoint in your case. I believe your case is exactly described in https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data on the last line of the table, which shows that when the "Treat Missing Data" option is set to "Missing", an alarm with only one breaching datapoint flips to the ALARM state. The reason is that the "Missing" behaviour flips the alarm to INSUFFICIENT_DATA only when ALL datapoints evaluated are missing. Otherwise the alarm tries to evaluate the status with as little data as available, even if that's only one datapoint. "Missing" is the default behaviour, so if you didn't specify a value, this is what is happening.