Question

A SysOps administrator manages a three-tier web application. The team receives dozens of SNS notifications during minor, transient spikes because separate CloudWatch alarms exist for high CPU on the web tier, high latency on the load balancer, and elevated database connections. Leadership wants to be paged only when the application is genuinely degraded — specifically, when the load balancer latency alarm AND either the web tier CPU alarm OR the database connections alarm are all in the ALARM state at the same time. Which approach best meets this requirement while minimizing notification noise?

Accepted Answer

Create a CloudWatch composite alarm with a rule combining the existing alarms (latency AND (CPU OR DB connections)) and attach the SNS notification to the composite alarm only.

Answer

Increase the evaluation periods and datapoints-to-alarm on each individual alarm so they take longer to trigger, keeping the SNS action on each one.

Answer

Create an EventBridge rule that matches all three alarm state-change events and invokes a Lambda function to decide whether to publish to SNS.

Answer

Enable CloudWatch anomaly detection on all three metrics and route the anomaly alarms to a single SNS topic.