An on-call team is paged whenever a single CloudWatch alarm on API latency breaches, but most pages are false alerts caused by brief latency blips while the service is otherwise healthy. They only want to be paged when high latency coincides with an elevated 5xx error rate, treating that combination as a real incident, and they want to keep the two existing metric alarms rather than rebuild them. Which approach BEST achieves this?
- ALower the latency alarm threshold and raise its datapoints-to-alarm so it fires only on sustained high latency, expecting the longer evaluation period to exclude the cases where errors are not also elevated.
- BAdd a metric math expression to the latency alarm that multiplies latency by the 5xx count and alarm when the product exceeds a fixed value, so one alarm represents both signals at once.
- CConfigure an Amazon EventBridge rule on the latency alarm's state-change events that pages the team, filtering only the events where the latency alarm has been in ALARM for several minutes.
- DCreate a CloudWatch composite alarm whose rule combines the existing latency alarm AND the existing 5xx error-rate alarm, and send the notification from the composite alarm so it fires only when both child alarms are in ALARM. Correct
Why A is wrong: Tuning the latency alarm's threshold and evaluation period never brings the 5xx error metric into the decision, so it cannot require both signals and still pages on latency-only blips.
Why B is wrong: Multiplying two unrelated units gives a brittle, hard-to-tune quantity and forces a rebuild of the existing alarm, whereas a composite alarm combines the two alarm states cleanly without that fragility.
Why C is wrong: An EventBridge rule on the latency alarm alone has no visibility into the error-rate alarm, so it still pages on latency-only events and does not enforce the both-conditions requirement.
Why D is correct: A composite alarm evaluates a rule over other alarms' states, so requiring the latency alarm AND the error-rate alarm to be in ALARM pages the team only on the real combination while reusing both existing alarms.