Question

A payments team runs a service whose transaction volume has strong daily and weekly seasonality (high during business hours, near-zero overnight and on weekends). They currently have a static CloudWatch alarm on the TransactionCount metric that triggers when the count drops below a fixed threshold. This alarm fires false positives every night and weekend, and it also misses real outages during daytime peaks because the static floor is set too low. The team wants an alarm that automatically adapts to expected traffic patterns and only alerts when volume deviates from the expected range for that time of day. What should they implement?

Accepted Answer

Create a CloudWatch anomaly detection model on the TransactionCount metric and configure the alarm to trigger when the metric falls outside the anomaly detection band (below the lower band).

Answer

Replace the single alarm with multiple static-threshold alarms scheduled via EventBridge rules to enable different thresholds for daytime, nighttime, and weekend windows.

Answer

Configure the existing static alarm to treat missing data as 'notBreaching' and increase the evaluation period to 24 hours to smooth out overnight dips.

Answer

Use a CloudWatch metric math expression to compute a rolling average and alarm when the current TransactionCount is below 50% of that average.