AWS CLI를 사용하여 CloudWatch Alarm 의 이상 탐지 알람 (Anomaly Detection alarm) 생성하기

aws cloudwatch put-metric-alarm \
    --alarm-name [알람명] \
    --comparison-operator [임계값 유형] \
    --evaluation-periods [알람 평가에 사용할 연속 데이터 포인트 수] \
    --threshold-metric-id [임계값으로 사용할 메트릭 ID] \
    --alarm-actions "[알람을 보낼 SNS의 ARN]" \
    --metrics '[
        {
            "Id": "[지표 식별자]",
            "MetricStat": {
                "Metric": {
                    "Namespace": "[지표 네임스페이스]",
                    "MetricName": "[지표명]",
                    "Dimensions": [
                        {
                            "Name": "[차원 이름]",
                            "Value": "[차원 값]"
                        }
                    ]
                },
                "Period": [데이터 포인트 간격(초)],
                "Stat": "[통계 방법]"
            }
        },
        {
            "Id": "[임계값 지표 식별자 (threshold-metric-id와 일치)]",
            "Expression": "ANOMALY_DETECTION_BAND([지표 식별자], [이상 탐지 임계값])"
        }
    ]'

aws cloudwatch put-metric-alarm \
    --alarm-name EC2_NetworkIn_Anomaly_Alarm \
    --comparison-operator LessThanLowerOrGreaterThanUpperThreshold \
    --evaluation-periods 2 \
    --threshold-metric-id t1 \
    --alarm-actions "arn:aws:sns:ap-northeast-1:123456789012:my-sns-topic" \
    --metrics '[
        {
            "Id": "m1",
            "MetricStat": {
                "Metric": {
                    "Namespace": "AWS/EC2",
                    "MetricName": "NetworkIn",
                    "Dimensions": [
                        {
                            "Name": "InstanceId",
                            "Value": "i-xxxxxxxxxxxxxxxxx"
                        }
                    ]
                },
                "Period": 300,
                "Stat": "Average"
            }
        },
        {
            "Id": "t1",
            "Expression": "ANOMALY_DETECTION_BAND(m1, 2)"
        }
    ]'

aws cloudwatch describe-alarms --alarm-names "EC2_NetworkIn_Anomaly_Alarm"
# {
#     "MetricAlarms": [
#         {
#             "AlarmName": "EC2_NetworkIn_Anomaly_Alarm",
#             "AlarmArn": "arn:aws:cloudwatch:ap-northeast-1:123456789012:alarm:EC2_NetworkIn_Anomaly_Alarm",
#             "AlarmConfigurationUpdatedTimestamp": "2025-07-27T16:12:40.006000+00:00",
#             "ActionsEnabled": true,
#             "OKActions": [],
#             "AlarmActions": [
#                 "arn:aws:sns:ap-northeast-1:123456789012:my-sns-topic"
#             ],
#             "InsufficientDataActions": [],
#             "StateValue": "OK",
#             "StateReason": "Thresholds Crossed: 2 datapoints [7090.0 (27/07/25 16:08:00), 1854.6 (27/07/25 16:03:00)] were not less than the lower thresholds [0.0, 0.0] or not greater than the upper thresholds [10882.146951771912, 8375.33042800286].",
#             "StateReasonData": "{\"version\":\"1.0\",\"queryDate\":\"2025-07-27T16:13:29.164+0000\",\"startDate\":\"2025-07-27T16:03:00.000+0000\",\"period\":300,\"recentDatapoints\":[1854.6,7090.0],\"recentLowerThresholds\":[0.0,0.0],\"recentUpperThresholds\":[8375.33042800286,10882.146951771912],\"evaluatedDatapoints\":[{\"timestamp\":\"2025-07-27T16:08:00.000+0000\",\"value\":7090.0,\"threshold\":10882.146951771912}]}",
#             "StateUpdatedTimestamp": "2025-07-27T16:13:29.167000+00:00",
#             "Dimensions": [],
#             "EvaluationPeriods": 2,
#             "ComparisonOperator": "LessThanLowerOrGreaterThanUpperThreshold",
#             "Metrics": [
#                 {
#                     "Id": "m1",
#                     "MetricStat": {
#                         "Metric": {
#                             "Namespace": "AWS/EC2",
#                             "MetricName": "NetworkIn",
#                             "Dimensions": [
#                                 {
#                                     "Name": "InstanceId",
#                                     "Value": "i-xxxxxxxxxxxxxxxxx"
#                                 }
#                             ]
#                         },
#                         "Period": 300,
#                         "Stat": "Average"
#                     }
#                 },
#                 {
#                     "Id": "t1",
#                     "Expression": "ANOMALY_DETECTION_BAND(m1, 2)"
#                 }
#             ],
#             "ThresholdMetricId": "t1"
#         }
#     ],
#     "CompositeAlarms": []
# }

# 단일 알람 삭제
aws cloudwatch delete-alarms --alarm-names "EC2_NetworkIn_Anomaly_Alarm"

# 복수 알람 삭제
aws cloudwatch delete-alarms --alarm-names "alarm1" "alarm2"