CloudWatch alarm considers missing data points before alarm creation

Question

I observed that when my cloud watch alarm is configured to treat missing data as breaching.
The cloud watch alarm created at time T considers missing  data points before T and alarms. Shouldn't cloud watch alarm only considers data points after the alarm's creation time?

In my case, the alarm was deleted and re-created, I don't know if this is a corner case which triggers the behavior that I saw.

Here are the alarm histories:

* 2023-11-11 07:42:49 Alarm "request_data_from_endpoint_Errors_Sum" created
* 2023-11-11 07:43:42 Alarm updated from Insufficient data to In alarm. Details are below. Please notice that it considers the missing data points between 7:33 and 7:42.

```
{
  "alarmName": "request_data_from_endpoint_Errors_Sum",
  "alarmType": "MetricAlarm",
  "timestamp": "2023-11-11T07:43:42.851Z",
  "historyItemType": "StateUpdate",
  "historySummary": "Alarm updated from INSUFFICIENT_DATA to ALARM",
  "historyData": {
    "version": "1.0",
    "oldState": {
      "stateValue": "INSUFFICIENT_DATA",
      "stateReason": "Unchecked: Initial alarm creation"
    },
    "newState": {
      "stateValue": "ALARM",
      "stateReason": "Threshold Crossed: no datapoints were received for 10 periods and 10 missing datapoints were treated as [Breaching].",
      "stateReasonData": {
        "version": "1.0",
        "queryDate": "2023-11-11T07:43:42.846+0000",
        "statistic": "Sum",
        "period": 60,
        "recentDatapoints": [],
        "threshold": 0,
        "evaluatedDatapoints": [
          {
            "timestamp": "2023-11-11T07:42:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:41:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:40:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:39:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:38:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:37:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:36:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:35:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:34:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:33:00.000+0000"
          }
        ]
      }
    }
  }
}
```

Dmytro Sirant · Accepted Answer

Hi,

Not sure if it explains the behaviour, but found this Note:

```
If data points are missing soon after you create an alarm, 
and the metric was being reported to CloudWatch before 
you created the alarm, CloudWatch retrieves the most recent 
data points from before the alarm was created when evaluating 
the alarm.
```

here https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarm-evaluation

CloudWatch alarm considers missing data points before alarm creation

Conteúdo relevante