From 026f8580ef7272431068126c3a2f5aa0943d07f0 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 17 Jun 2026 14:22:04 -0400
Subject: [PATCH] Fix DynamoDB throttle alarm metric: use
 Read/WriteThrottleEvents

ThrottledRequests and SystemErrors are not emitted at the TableName-only
dimension (only TableName+Operation), so these table-level alarms would sit
permanently in INSUFFICIENT_DATA and never fire. Replace with
ReadThrottleEvents and WriteThrottleEvents, which AWS/DynamoDB emits at the
TableName dimension.
---
 template.yaml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/template.yaml b/template.yaml
index 11810ca..2840810 100644
--- a/template.yaml
+++ b/template.yaml
@@ -174,18 +174,18 @@ Resources:
         - !Sub arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts
 
   # DynamoDB alarms — front-sla-alerts table
-  # ThrottledRequests and SystemErrors are documented at dimensions
-  # (TableName, Operation); CloudWatch also publishes the TableName-only
-  # aggregate, which is what we alarm on here. Neither has emitted yet
-  # (no throttle/5xx events to date), so the dimension was confirmed against
-  # the AWS DynamoDB metrics reference rather than live data.
-  AlertsTableThrottleAlarm:
+  # ReadThrottleEvents / WriteThrottleEvents are emitted at the TableName
+  # dimension, so these alarms transition normally. (ThrottledRequests and
+  # SystemErrors are only emitted at TableName+Operation granularity, never
+  # TableName-only, so alarms on them sit permanently in INSUFFICIENT_DATA
+  # and never fire — these are the correct table-level throttle signals.)
+  AlertsTableReadThrottleAlarm:
     Type: AWS::CloudWatch::Alarm
     Properties:
-      AlarmName: front-sla-alerts-throttled-requests
-      AlarmDescription: front-sla-alerts DynamoDB table is throttling requests
+      AlarmName: front-sla-alerts-read-throttle
+      AlarmDescription: front-sla-alerts DynamoDB table had one or more read throttle events
       Namespace: AWS/DynamoDB
-      MetricName: ThrottledRequests
+      MetricName: ReadThrottleEvents
       Dimensions:
         - Name: TableName
           Value: !Ref AlertsTable
@@ -198,13 +198,13 @@ Resources:
       AlarmActions:
         - !Sub arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts
 
-  AlertsTableSystemErrorsAlarm:
+  AlertsTableWriteThrottleAlarm:
     Type: AWS::CloudWatch::Alarm
     Properties:
-      AlarmName: front-sla-alerts-system-errors
-      AlarmDescription: front-sla-alerts DynamoDB table returned HTTP 500 system errors
+      AlarmName: front-sla-alerts-write-throttle
+      AlarmDescription: front-sla-alerts DynamoDB table had one or more write throttle events
       Namespace: AWS/DynamoDB
-      MetricName: SystemErrors
+      MetricName: WriteThrottleEvents
       Dimensions:
         - Name: TableName
           Value: !Ref AlertsTable