CloudWatch alarm metrics are defined using comparison operators to measure whether data points received at set intervals exceed a specified threshold. If the data points received exceed the specified threshold, a metric breach occurs. If a metric breach occurs for x consecutive intervals where x = alarm minimum breach period, the alarm goes into the ALARM state.

CloudWatch alarms may also go into the ALARM state when a single metric breach is followed by x-1 consecutive periods of insufficient data and/or metric breaches. This behavior is common with alarms that track a metric that does not consistently receive data every period. For example if you have a custom metric that sends a '1' to CloudWatch each time a specific error occurs, you may have periods where no '1' is sent because no error occurred.

When CloudWatch evaluates metrics to determine whether to go into the ALARM state, it treats periods of insufficient data following a metric breach point as breaching when the oldest data point is breaching. For example let’s say you have an alarm that is configured as follows:

Threshold

A metric breach occurs (oldest data is to the left, newest data is to the right, ID signifies Insufficient Data for that period):
| 7 | ID | ID | 55 |
  1    2     3    4
This evaluates to an alarm state of OK

Next minute:
| ID | ID | 55 | ID |
   1    2     3    4
This evaluates to an alarm state of OK

Next minute:
| ID | 55 | ID | ID |
   1     2    3    4
This evaluates to an alarm state of OK

One more minute:
| 55 | ID | ID | ID |
   1     2    3    4
This evaluates to an alarm state of ALARM

When the oldest data point in an evaluation period is a metric breach followed by either additional metric breaches or by insufficient data, CloudWatch goes into the ALARM state.