Create a custom metric for blocked requests from a metrics filter and alarm using CloudWatch anomaly detection

Why the Answer Is Correct

The company needs alerts on sudden changes in blocked traffic specifically, and explicitly does not want alerts for other changes in AWS WAF log behavior. The first step is therefore to make the signal specific: a CloudWatch Logs metrics filter that matches blocked requests on the aws-waf-logs log group creates a custom metric whose data consists only of blocked-request activity, so nothing else that happens in the WAF logs can influence it (A). uncledana identified this as the most precise approach, noting that the option focuses on blocked requests. The second requirement is detecting a sudden change without maintaining thresholds as the WAF rules are tuned over time, which is what CloudWatch anomaly detection provides: an alarm is created using CloudWatch anomaly detection on the published custom metric, so the alarm learns the baseline of normal blocked traffic and fires on a statistical deviation rather than on a fixed value that would need constant adjustment (A). The alarm then notifies the existing SNS topic, alerting the DevOps engineer (A). Srikantha described this as the most efficient solution because it monitors blocked requests through a custom metric and uses anomaly detection to identify significant deviations, which CHRIS12722222 reinforced as the way to detect a sudden change in blocked requests. A is the correct answer.

Why the Other Options Are Wrong

B creates a CloudWatch anomaly detector for the log group and an alarm on the metrics it publishes, using the LogAnomalyPriority metric with a high setting and a static threshold of one anomaly. Log anomaly detection analyses the log content as a whole, so it would raise anomalies for changes in WAF log behavior other than blocked traffic, which the company explicitly does not want to be alerted about. D does the same thing with a medium LogAnomalyPriority setting and a sum of anomalies over an hour exceeding an expected value, inheriting the same defect that the analysis is not scoped to blocked requests. C creates a metrics filter for counted requests rather than blocked requests, then alarms when the sum of blocked requests over one hour exceeds a static threshold. Counting all requests rather than blocked requests dilutes the signal with traffic of no interest, and a static threshold neither detects sudden changes nor adapts as the rules are tuned; CHRIS12722222 objected that a one-hour period is too long because a blocked-request spike could normalize within that hour and never trigger the alarm. A is correct.

Community Comment Notes

Community voted A (88). Srikantha explained that option A is the most efficient because it directly monitors blocked requests through a custom CloudWatch metric and uses CloudWatch anomaly detection to identify significant deviations, which is what the requirement asks for. CHRIS12722222 supported A on the specific grounds that a sudden change in blocked requests cannot be detected over a one-hour period, since the spike could normalize within that window. uncledana described A as the most precise and scalable solution because it focuses on blocked requests and uses anomaly detection for adaptive monitoring. Slays was the sole dissenter, preferring C and arguing that anomaly detection is not wanted because only blocked-traffic increases should notify; that reasoning inverts the requirement, since the company explicitly wants sudden changes in blocked traffic detected and only the metrics filter in A scopes the signal to blocked requests. No alternative received support.