CloudWatch Anomaly Detection Alarms

CloudWatch anomaly detection applies machine-learning algorithms to your metric data to create a model of expected values. This allows for dynamic thresholds that adapt to the natural fluctuations (seasonality) of your infrastructure without manual intervention.

Learning Objectives

• Explain the machine learning mechanism behind CloudWatch anomaly detection.
• Configure anomaly detection bands using standard deviation settings.
• Differentiate between static threshold alarms and anomaly detection alarms.
• Troubleshoot common alarm states like INSUFFICIENT_DATA and ALARM in the context of seasonal metrics.

Key Terms & Glossary

• Anomaly Detection Band: The shaded area on a CloudWatch graph representing the range of expected values for a metric.
• Seasonality: Predictable changes that recur over a specific period, such as higher CPU usage every Monday morning or lower traffic during weekends.
• Standard Deviation ($\\sigma$): A measure of how much the metric fluctuates from the mean. In anomaly detection, this defines the width of the band.
• Evaluation Period: The number of the most recent data points to evaluate when determining the alarm state.
• Datapoints to Alarm: The required number of breaching data points (M) within a set of evaluation periods (N).

The "Big Idea"

In modern DevOps, static thresholds (e.g., "Alarm if CPU > 80%") are often too rigid. A system might normally run at 90% during a nightly batch job and 10% at noon. Anomaly detection shifts the focus from absolute limits to statistical deviance, allowing the system to alert you only when behavior is truly "weird" based on historical patterns.

Formula / Concept Box

Hierarchical Outline

1. Metric Selection & Modeling
   • Historical Analysis: AWS analyzes up to 2 weeks of data to build the initial model.
   • Continuous Learning: The model updates every hour as new data arrives.
2. Alarm Configuration
   • Threshold Type: Choose "Anomaly detection" instead of "Static".
   • Band Thickness: 1, 2, or 3 standard deviations (standard is 2).
   • Direction: Alarm when the metric is "Greater than the band", "Lower than the band", or "Outside the band".
3. Advanced Evaluation
   • Datapoints to Alarm: $M$ out of $N$ evaluation.
   • Missing Data Treatment: Configure as missing, breaching, ignore, or non-breaching.

Visual Anchors

Alarm State Transition Logic

Metric Band Visualization

Definition-Example Pairs

• Term: Seasonality Awareness

• Definition: The ability of the ML model to recognize hourly, daily, or weekly patterns.

• Example: An e-commerce site has high traffic every Sunday at 8 PM. Static alarms would fire every Sunday; Anomaly Detection learns this is "Normal" and remains OK.

• Term: Model Exclusion

• Definition: Manually telling the model to ignore specific time ranges (e.g., during a deployment or load test).

• Example: During a 4-hour maintenance window, you exclude that data so the model doesn't think the "Zero Traffic" state is a new normal.

Worked Examples

Scenario: RDS Database Latency

Goal: Detect unusual latency spikes in an RDS instance where latency normally fluctuates between 5ms and 20ms throughout the day.

1. Metric: AWS/RDS -> ReadLatency.
2. Threshold Type: Anomaly Detection.
3. Configuration:
   • Standard Deviation: Set to 2 (Moderate sensitivity).
   • Evaluation Period: 1 Minute.
   • Datapoints to Alarm: 3 out of 5.
4. Result: If latency hits 40ms for 3 minutes within any 5-minute window, the alarm triggers. If it hits 40ms for only 1 minute, the alarm stays OK to avoid false positives from transient blips.

Checkpoint Questions

1. What is the default amount of historical data CloudWatch attempts to use when building an anomaly detection model?
2. What happens to the anomaly detection alarm if you change the metric's unit?
3. True or False: You can only use anomaly detection on AWS-provided standard metrics.
4. Which alarm state indicates that the machine learning model is still being trained?

Muddy Points & Cross-Refs

• Cold Starts: New metrics without history will stay in INSUFFICIENT_DATA until enough points are collected. Don't rely on AD for brand-new resources in the first few hours.
• Sudden Step Changes: If your application permanently changes behavior (e.g., a version update that uses 20% more memory), the AD model will initially alarm, then slowly "learn" the new level over several days. You may need to reset the model.
• Cross-Ref: Combine with CloudWatch ServiceLens to visualize these anomalies across distributed traces.

Comparison Tables

Static vs. Anomaly Detection Alarms