Problem Statement/Rationale

Two alarms are pointed at metrics that don't measure what we assumed.

waf-blocked-spike specifies a Region = CloudFront dimension that WAFv2 doesn't publish for CLOUDFRONT-scoped web ACLs, so it has never had a datapoint and can never fire. It sits in OK because missing data is treated as not breaching.

requests-floor uses CloudFront Requests, which counts WAF-blocked scanner traffic. A total telemetry outage would still show that and look healthy, so the alarm could never fire either. Repoint it at AWS/WAFV2 AllowedRequests: the WAF allowlist blocks everything that isn't /v1/*, so allowed requests are telemetry by construction.

Expected Results

Both alarms fire on incident.

Actual Results

Alarms never fire.