Operational Excellence and Automation · Topic 5 of 7
Alerting, SLOs and User Experience
Build CloudWatch alarms with SNS and Systems Manager actions, watch users with Synthetics and RUM, and set SLOs with error budgets in Application Signals.
- 5 min
- M out of N datapoints and composite alarms reduce alert noise.
- Anomaly detection fits seasonal traffic with no fixed threshold.
- Alarm actions reach SNS, EC2, Auto Scaling and Systems Manager OpsCenter; EventBridge routes state changes to automation.
What it is
Alerting decides when a signal needs a person or an automated action. User experience monitoring measures what customers actually see, and service level objectives (SLOs) turn that into a measurable target the business agrees on.
The exam wants alerts that are few and meaningful, user monitoring that catches problems before customers report them, and SLOs that tie alerts to an error budget instead of raw thresholds.
How it works
CloudWatch alarms that do not cry wolf
| Alarm feature | What it does | Use it to |
|---|---|---|
| Datapoints to alarm (M out of N) | Fires only when M of the last N periods breach | Ignore single spikes |
| Missing data treatment | Treat gaps as breaching, not breaching, ignore or missing | Alarm when a heartbeat metric stops |
| Metric math | Alarm on an expression such as error rate | Alert on ratios, not raw counts |
| Anomaly detection | Learns a band from history | Seasonal traffic with no fixed threshold |
| Composite alarm | Combines alarms with AND, OR and NOT | One page for a real incident instead of twenty |
Alarm actions include an SNS topic, EC2 actions (stop, terminate, reboot, recover), Auto Scaling policies and Systems Manager OpsItems in OpsCenter. SNS fans out to email, SMS, HTTPS endpoints, Lambda and chat through Amazon Q Developer in chat applications.
Alarm state changes are also EventBridge events. Route them with rules to Lambda, Step Functions or a Systems Manager Automation runbook when the response should be automatic.
For many accounts, create alarms in each account through StackSets, or alarm on shared metrics from the monitoring account with cross-account observability.
Synthetic transactions and real user monitoring
| Method | Service | What it tells you |
|---|---|---|
| Synthetic monitoring | CloudWatch Synthetics canaries | Whether a scripted path such as login and checkout works, every few minutes, even with no traffic |
| Real user monitoring | CloudWatch RUM | Page load times, JavaScript errors and sessions from real browsers |
Canaries are scripts in Node.js or Python on a schedule. Blueprints cover heartbeat checks, API calls, broken links, visual comparison and multi-step GUI workflows. Run canaries from several Regions to see what users in each place see, and alarm on their success percentage.
RUM uses a small JavaScript snippet in the web page. It shows performance by browser, device and location, which synthetic tests cannot, because they run from a few fixed points.
Use both: synthetics detect outages at 3 a.m. when nobody is on the site, and RUM shows how real users experience the site at busy times.
Service level objectives
An SLO has three parts: a service level indicator (SLI) such as availability or latency, a goal such as 99.9 percent, and an interval. The interval can be rolling, which follows recent experience, or calendar aligned, such as one month, which matches business reporting.
CloudWatch Application Signals auto-discovers services and collects latency and availability for each operation, which make natural SLIs. You can also use any CloudWatch metric or metric expression as an SLI.
| SLO type | Counts | Example |
|---|---|---|
| Period-based | Good versus bad time periods | 99 percent of one minute periods have p99 latency under 500 ms |
| Request-based | Good versus total requests | 99.9 percent of requests succeed |
The error budget is the failure allowed before the SLO is missed, for example one percent of periods for a 99 percent goal. The burn rate shows how fast the budget is being spent: above 1 means the SLO will be missed if the trend continues. Application Signals can alarm on SLO attainment and on burn rate over a look-back window.
A fast burn over a short window means a page now. A slow burn over a long window can be a ticket, and a spent budget is a signal to pause risky releases.
How the exam asks about this
- "Operators get dozens of alerts for one database failure and miss the important one" -> composite alarms that page only when the combined condition is true.
- "Detect a broken checkout flow at night, when no customers are using the site" -> CloudWatch Synthetics canaries on a schedule with an alarm.
- "Track whether 99.9 percent of API requests succeed each month and alert when the error budget burns too fast" -> a request-based SLO in Application Signals with a burn rate alarm.
What to remember for the exam
- M out of N datapoints and composite alarms reduce alert noise.
- Anomaly detection fits seasonal traffic with no fixed threshold.
- Alarm actions reach SNS, EC2, Auto Scaling and Systems Manager OpsCenter; EventBridge routes state changes to automation.
- Synthetics is scripted and proactive; RUM is real user and passive.
- An SLO is an SLI, a goal and an interval; the error budget is what remains allowed to fail.
- Application Signals supports period-based and request-based SLOs with burn rate alarms.
An alarm on raw CPU is not an SLO. When the question mentions customers, agreements or error budgets, choose an SLI that measures user experience, such as availability or latency.
Common mistakes
Relying only on RUM to detect outages. With no visitors there is no data, so an outage at night goes unseen. Add synthetic canaries.
Paging on every threshold breach. Single spikes wake people for nothing. Use M out of N evaluation and composite alarms.
Setting a 100 percent SLO. It leaves no error budget, so every deployment becomes a violation. Choose a realistic goal below 100 percent.
Check yourself
Which feature combines several alarms so operators receive one notification for one incident?
A CloudWatch composite alarm, using AND, OR and NOT rules across its child alarms.
What is the difference between CloudWatch Synthetics and CloudWatch RUM?
Synthetics runs scripted canaries on a schedule, while RUM collects data from real users' browsers.
What does a burn rate above 1 mean for an SLO?
The error budget is being used faster than the goal allows, so the SLO will be missed if it continues.
Topic 5 of 7 in Operational Excellence and Automation
Test yourself on Operational Excellence and Automation
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.