Find CloudWatch Alarms Stuck in INSUFFICIENT_DATA

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReportStaleAlarms",
      "Effect": "Allow",
      "Action": ["cloudwatch:DescribeAlarms", "cloudwatch:ListMetrics"],
      "Resource": "*"
    },
    {
      "Sid": "DeleteStaleAlarms",
      "Effect": "Allow",
      "Action": "cloudwatch:DeleteAlarms",
      "Resource": "arn:aws:cloudwatch:us-east-1:123456789012:alarm:*"
    }
  ]
}

// find-cloudwatch-alarms-insufficient-data.ts
// Lists CloudWatch alarms in one Region that have been in INSUFFICIENT_DATA for more than N days,
// and checks whether the metric behind each metric alarm has reported any data in the last two weeks.
// Report-only by default. --apply deletes metric alarms whose metrics are gone and that no
// composite alarm depends on. Composite alarms are only reported.
// Usage: npx tsx find-cloudwatch-alarms-insufficient-data.ts [--days 7] [--apply]
import {
  CloudWatchClient,
  DeleteAlarmsCommand,
  DescribeAlarmsCommand,
  ListMetricsCommand,
  paginateDescribeAlarms,
  type MetricAlarm,
  type Metric,
} from "@aws-sdk/client-cloudwatch";

const args = process.argv.slice(2);
const apply = args.includes("--apply");
const minDays = Number(args[args.indexOf("--days") + 1]) || 7;
const cw = new CloudWatchClient({}); // region from AWS_REGION or your profile

interface Row { Alarm: string; Type: string; StuckDays: number; Metric: string; MetricData: string; Verdict: string }

// The metrics an alarm reads: a single metric, or every MetricStat inside a metric math alarm.
function metricsOf(a: MetricAlarm): Metric[] {
  if (a.MetricName) return [{ Namespace: a.Namespace, MetricName: a.MetricName, Dimensions: a.Dimensions }];
  return (a.Metrics ?? []).flatMap((q) => (q.MetricStat?.Metric ? [q.MetricStat.Metric] : []));
}

// ListMetrics only returns metrics that reported data in the past two weeks.
async function reportedRecently(m: Metric): Promise<boolean> {
  const res = await cw.send(new ListMetricsCommand({
    Namespace: m.Namespace,
    MetricName: m.MetricName,
    Dimensions: (m.Dimensions ?? []).map((d) => ({ Name: d.Name, Value: d.Value })),
  }));
  const want = (m.Dimensions ?? []).length;
  return (res.Metrics ?? []).some((x) => (x.Dimensions ?? []).length === want);
}

async function hasParents(name: string): Promise<boolean> {
  const res = await cw.send(new DescribeAlarmsCommand({ ParentsOfAlarmName: name }));
  return (res.CompositeAlarms ?? []).length + (res.MetricAlarms ?? []).length > 0;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  const deletable: string[] = [];
  const now = Date.now();
  for await (const page of paginateDescribeAlarms({ client: cw }, {
    StateValue: "INSUFFICIENT_DATA",
    AlarmTypes: ["MetricAlarm", "CompositeAlarm"],
  })) {
    for (const a of page.MetricAlarms ?? []) {
      const stuck = Math.floor((now - (a.StateUpdatedTimestamp?.getTime() ?? now)) / 86_400_000);
      if (stuck < minDays) continue;
      const metrics = metricsOf(a);
      const live = await Promise.all(metrics.map(reportedRecently));
      const label = metrics.map((m) => `${m.Namespace}/${m.MetricName} ${(m.Dimensions ?? []).map((d) => d.Value).join(",")}`).join(" + ");
      let verdict: string;
      if (a.AlarmName?.startsWith("TargetTracking-")) verdict = "owned by a scaling policy: leave it";
      else if (!metrics.length) verdict = "query-based alarm: check manually";
      else if (live.some(Boolean)) verdict = `metric reports: check TreatMissingData (${a.TreatMissingData ?? "missing"})`;
      else if (await hasParents(a.AlarmName ?? "")) verdict = "metric gone, but a composite alarm uses it";
      else {
        verdict = "DELETE: metric gone";
        deletable.push(a.AlarmName ?? "");
      }
      rows.push({ Alarm: a.AlarmName ?? "", Type: "metric", StuckDays: stuck, Metric: label || "(expression)", MetricData: metrics.length ? (live.some(Boolean) ? "yes" : "none in 14 days") : "n/a", Verdict: verdict });
    }
    for (const c of page.CompositeAlarms ?? []) {
      const stuck = Math.floor((now - (c.StateUpdatedTimestamp?.getTime() ?? now)) / 86_400_000);
      if (stuck >= minDays) rows.push({ Alarm: c.AlarmName ?? "", Type: "composite", StuckDays: stuck, Metric: "(rule)", MetricData: "n/a", Verdict: "review its child alarms" });
    }
  }

  rows.sort((x, y) => y.StuckDays - x.StuckDays);
  console.table(rows);
  // Standard-resolution alarms cost $0.10 per alarm metric per month in us-east-1 (price list, September 2026).
  console.log(`${rows.length} alarms stuck in INSUFFICIENT_DATA for ${minDays}+ days; ${deletable.length} watch metrics that no longer exist (about $${(deletable.length * 0.1).toFixed(2)}/month).`);

  if (!apply) {
    console.log("Report only: nothing was deleted. Re-run with --apply to delete the alarms marked DELETE.");
    return;
  }
  for (let i = 0; i < deletable.length; i += 100) {
    const batch = deletable.slice(i, i + 100); // DeleteAlarms takes up to 100 names per call
    await cw.send(new DeleteAlarmsCommand({ AlarmNames: batch }));
    console.log(`Deleted ${batch.length} alarms: ${batch.join(", ")}`);
  }
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-cloudwatch
npm install --save-dev tsx typescript

# Report alarms stuck for 7+ days
AWS_PROFILE=readonly AWS_REGION=us-east-1 npx tsx find-cloudwatch-alarms-insufficient-data.ts

# Only alarms stuck for 30+ days, and delete the ones whose metric is gone
AWS_PROFILE=admin AWS_REGION=us-east-1 npx tsx find-cloudwatch-alarms-insufficient-data.ts --days 30 --apply

┌─────────┬────────────────────┬─────────────┬───────────┬─────────────────────────────────────────────────────────────────────────┬───────────────────┬────────────────────────────────────────────────────┐
│ (index) │ Alarm              │ Type        │ StuckDays │ Metric                                                                  │ MetricData        │ Verdict                                            │
├─────────┼────────────────────┼─────────────┼───────────┼─────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────┤
│ 0       │ 'web-3-high-cpu'   │ 'metric'    │ 212       │ 'AWS/EC2/CPUUtilization i-0a1b2c3d4e5f60718'                            │ 'none in 14 days' │ 'DELETE: metric gone'                              │
│ 1       │ 'legacy-alb-5xx'   │ 'metric'    │ 140       │ 'AWS/ApplicationELB/HTTPCode_ELB_5XX_Count app/legacy/50dc6c495c0c9188' │ 'none in 14 days' │ 'DELETE: metric gone'                              │
│ 2       │ 'db-old-cpu'       │ 'metric'    │ 95        │ 'AWS/RDS/CPUUtilization db-old'                                         │ 'none in 14 days' │ 'metric gone, but a composite alarm uses it'       │
│ 3       │ 'orders-dlq-depth' │ 'metric'    │ 31        │ 'AWS/SQS/ApproximateNumberOfMessagesVisible orders-dlq'                 │ 'yes'             │ 'metric reports: check TreatMissingData (missing)' │
│ 4       │ 'db-tier-health'   │ 'composite' │ 95        │ '(rule)'                                                                │ 'n/a'             │ 'review its child alarms'                          │
└─────────┴────────────────────┴─────────────┴───────────┴─────────────────────────────────────────────────────────────────────────┴───────────────────┴────────────────────────────────────────────────────┘
5 alarms stuck in INSUFFICIENT_DATA for 7+ days; 2 watch metrics that no longer exist (about $0.20/month).
Report only: nothing was deleted. Re-run with --apply to delete the alarms marked DELETE.