Create CloudWatch metric math expressions and composite alarms
domain: docs.aws.amazon.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Define metric math expressions in GetMetricData API calls using the 'MetricDataQueries' array; each query is either a raw metric ('MetricStat') or a math expression ('Expression') referencing other query IDs
Use metric math functions such as ANOMALY_DETECTION_BAND, FILL, RATE, SUM, AVG, and IF to compute derived signals; reference other queries by their 'Id' field in expressions like 'SUM([m1, m2])'
Create a standard CloudWatch alarm via 'PutMetricAlarm' API (or aws cloudwatch put-metric-alarm CLI) specifying 'Metrics' array with math expressions for threshold-based alerting on computed values
Create a composite alarm via 'PutCompositeAlarm' API with 'AlarmRule' as a boolean expression combining existing alarm states: 'ALARM("alarm1") AND ALARM("alarm2")' or with OR/NOT operators
Set 'AlarmActions' and 'OKActions' to SNS topic ARNs for notifications; configure 'TreatMissingData' as 'breaching', 'notBreaching', 'ignore', or 'missing' to control alarm state during data gaps
Known gotchas
Composite alarms cannot directly reference metrics — they can only reference the state of other alarms; attempting to use a metric ARN in AlarmRule returns a validation error
Metric math expressions in alarms have a limit on the number of metrics and expressions per alarm; exceeding this limit requires splitting logic across multiple alarms composed with a composite alarm
CloudWatch alarms evaluate at a minimum period of 10 seconds (high-resolution) or 60 seconds (standard); the period must match the metric's resolution or the alarm may never receive data points
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?