From 0a299d55254e27b505571b126faf9148c796d0b2 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 17 Jun 2026 14:21:57 -0400
Subject: [PATCH] Fix DynamoDB throttle alarm metric: use
 Read/WriteThrottleEvents

ThrottledRequests is not emitted at the TableName-only dimension (only
TableName+Operation), so the table-level alarm would sit permanently in
INSUFFICIENT_DATA and never fire. Replace with ReadThrottleEvents and
WriteThrottleEvents, which AWS/DynamoDB emits at the TableName dimension.
---
 template.yaml | 42 ++++++++++++++++++++++++++++++------------
 1 file changed, 30 insertions(+), 12 deletions(-)

diff --git a/template.yaml b/template.yaml
index a67ac6f..40314bd 100644
--- a/template.yaml
+++ b/template.yaml
@@ -786,27 +786,45 @@ Resources:
         - !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
 
   # --- DynamoDB alarms (afterhours-shifts table) ---
-  # ThrottledRequests emits at the TableName dimension → safe to alarm.
-  # NOTE: SystemErrors is INTENTIONALLY OMITTED. AWS emits AWS/DynamoDB
-  # SystemErrors only at TableName+Operation granularity, never TableName-only,
-  # so a TableName-only SystemErrors alarm would sit permanently in
-  # INSUFFICIENT_DATA. (Verified: no DynamoDB table in this account has ever
-  # emitted SystemErrors, consistent with documented per-Operation emission.)
-  ShiftTableThrottleAlarm:
+  # ReadThrottleEvents / WriteThrottleEvents are the table-level throttle
+  # signals: AWS/DynamoDB emits them at the TableName dimension, so these
+  # alarms transition normally. (ThrottledRequests and SystemErrors are NOT
+  # emitted at TableName-only granularity — only at TableName+Operation — so
+  # alarms on them sit permanently in INSUFFICIENT_DATA and never fire.)
+  ShiftTableReadThrottleAlarm:
     Type: AWS::CloudWatch::Alarm
     Properties:
-      AlarmName: !Sub "DynamoDB-ThrottledRequests-${ShiftTable}"
-      AlarmDescription: "afterhours-shifts table had one or more throttled requests"
+      AlarmName: !Sub "DDB-ReadThrottle-${ShiftTable}"
+      AlarmDescription: "afterhours-shifts table had one or more read throttle events"
       Namespace: AWS/DynamoDB
-      MetricName: ThrottledRequests
+      MetricName: ReadThrottleEvents
       Dimensions:
         - Name: TableName
           Value: !Ref ShiftTable
       Statistic: Sum
       Period: 300
       EvaluationPeriods: 1
-      Threshold: 1
-      ComparisonOperator: GreaterThanOrEqualToThreshold
+      Threshold: 0
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions:
+        - !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
+
+  ShiftTableWriteThrottleAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmName: !Sub "DDB-WriteThrottle-${ShiftTable}"
+      AlarmDescription: "afterhours-shifts table had one or more write throttle events"
+      Namespace: AWS/DynamoDB
+      MetricName: WriteThrottleEvents
+      Dimensions:
+        - Name: TableName
+          Value: !Ref ShiftTable
+      Statistic: Sum
+      Period: 300
+      EvaluationPeriods: 1
+      Threshold: 0
+      ComparisonOperator: GreaterThanThreshold
       TreatMissingData: notBreaching
       AlarmActions:
         - !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"