Senior LevelCloud Computing (AWS/GCP/Azure)
How do you build advanced Metric Math Alarms in CloudWatch for anomaly detection?
❓ Interview Prompt: Explain CloudWatch Metric Math functions (RATE, SUM, ANOMALY_DETECTION_BAND), dynamic baseline thresholds, and low-noise alerting.
Static CloudWatch alarms (e.g. "Alert if CPU > 80%") trigger false positives during predictable daily traffic spikes. CloudWatch Metric Math & Anomaly Detection uses statistical baselines.
Advanced Capabilities:
1
Metric Math Expressions: Combines multiple raw metrics into a single expression (e.g. calculating Error Rate percentage: 'e1 / (e1 + m1) * 100').
2
Anomaly Detection Bands ('ANOMALY_DETECTION_BAND'): Analyzes 2 weeks of historical metric trends to create a dynamic upper/lower expected baseline band.
3
Low-Noise Alarms: Triggers alerts ONLY when a metric strays outside expected statistical bands, ignoring normal daily traffic peaks!
Code Implementation Example
hcl
# CloudWatch Metric Math Alarm for HTTP 5XX Error Percentage
resource "aws_cloudwatch_metric_alarm" "error_rate_pct" {
alarm_name = "http-5xx-error-rate-pct"
comparison_operator = "GreaterThanOrEqualToThreshold"
evaluation_periods = 2
threshold = 5.0 # Alert if error rate > 5%
metric_query {
id = "e1"
expression = "(m2 / m1) * 100" # Error Percentage Math Formula!
label = "ErrorRatePercentage"
return_data = true
}
metric_query { id = "m1"; metric { metric_name = "RequestCount"; namespace = "AWS/ApplicationELB" } }
metric_query { id = "m2"; metric { metric_name = "HTTPCode_Target_5XX_Count"; namespace = "AWS/ApplicationELB" } }
}💡Terraform CloudWatch Metric Math alarm evaluating HTTP 5XX error percentage.
🎯 Interview Key Takeaway
CloudWatch Metric Math combines raw metrics into dynamic formulas and anomaly bands to prevent false positive alerts.
#CloudWatch#Metric Math#Anomaly Detection#Observability#Senior
Back to all Cloud Computing (AWS/GCP/Azure) Questions→