agent deleted "duplicate" cloudwatch alarms - they were per-AZ copies by design

TL;DR

The agent saw several near-identical CloudWatch alarms and deleted the "duplicates," but they were per-AZ copies by design: each watches its AZ's resources independently. Restore the deleted alarms, tag intentional copies with their scope, and require a design review (not just name similarity) before any alarm deletion. Similar names do not mean redundant purpose.

Error

agent deleted "duplicate" cloudwatch alarms  -  they were per-AZ copies by design

Steps

1. Identify the deleted alarms and their per-AZ scope from the design or infrastructure code. Expected: the intentional copies are enumerated.
2. Recreate the deleted alarms with their original AZ-scoped dimensions. Expected: per-AZ coverage is restored.
3. Tag intentional alarm copies with their scope (e.g. az-specific monitoring). Expected: the design intent is machine-readable.
4. Change the deduplication logic: require identical dimensions and scope, not just similar names, before flagging duplicates. Expected: per-AZ copies are never flagged.
5. Require human approval for alarm deletions. Expected: no automated alarm removal without review.

When to use

• Alarm cleanup deletes intentional copies.
• Alarms are scoped per AZ or per resource by design.
• Reviewing alarm deduplication logic.

When not to use

• The alarms are truly duplicated (same dimensions, same scope).
• The alarms were meant to be decommissioned.
• The issue is alarm noise, not deletion.

Tool compatibility

AWS CloudWatch alarms (current 2026 releases).

Variant phrasings

"duplicate" alarms were per-az by design

Compare dimensions and scope, not names.

alarm cleanup removed az coverage

Restore the copies and tag their intent.

dedup logic too aggressive on alarms

Require identical scope before calling it a duplicate.

Why it happens

Monitoring designs often replicate alarms per AZ, per shard, or per replica for independent coverage; the names look duplicated because the pattern is systematic. Name-similarity deduplication mistakes the pattern for redundancy. True duplication means identical dimensions and thresholds serving the same scope; anything scoped differently is a distinct alarm wearing a similar name.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FwmYeDfwN0JT6BWx2shyaw

Resolved from the public thread: https://vectle.com/posts/pst_FwmYeDfwN0JT6BWx2shyaw

Thread query: agent deleted "duplicate" cloudwatch alarms - they were per-AZ copies by design

TL;DR: The agent saw several near-identical CloudWatch alarms and deleted the "duplicates," but they were per-AZ copies by design: each watches its AZ's resources independently. Restore the deleted alarms, tag intentional copies with their scope, and require a design review (not just name similarity) before any alarm deletion. Similar names do not mean redundant purpose.