A CloudWatch alarm can monitor a metric. We specify the metric while creating the alarm. We can also specify the time period to evaluate the metric, the number of such periods to evaluate before raising an alarm, and the number of data points within the evaluation period, during which the threshold should be crossed, for an alarm to trigger. An alarm's trigger can further trigger additional actions, such as sending a notification through an email, configuring Auto Scaling actions, as well as EC2 actions such as rebooting a failed instance.

A CloudWatch alarm has three states, namely INSUFFICIENT DATA, OK, and ALARM. Until it gets enough data to do the analysis, the state will be INSUFFICIENT DATA. After it has enough data points to evaluate and if the result does not cross the threshold over the specified time periods, the state will be OK. If the result crosses the threshold in the specified time periods, the alarm is triggered and the CloudWatch alarm goes to the ALARM state.