Question

A security operations team receives dozens of CloudWatch alarm notifications each night for a fleet of EC2 instances. Individual metric alarms fire for high CPU, high memory, and low disk space, but the team only wants to be paged when an instance shows signs of genuine distress — specifically when CPU is high AND disk space is low at the same time. They want to reduce noise without deleting the existing metric alarms, which feed other dashboards. What is the MOST appropriate approach?

Accepted Answer

Create a CloudWatch composite alarm that references the existing CPU and disk-space metric alarms with an ALARM(cpu) AND ALARM(disk) rule, and send notifications only from the composite alarm.

Answer

Delete the individual metric alarms and create a single metric math alarm that adds CPU and disk metrics together, alarming when the sum crosses a threshold.

Answer

Configure an SNS filter policy on the existing alarm topic so subscribers only receive messages when two alarms publish within the same minute.

Answer

Increase the evaluation period and datapoints-to-alarm on each individual metric alarm so they fire less frequently overnight.