# Guide: Setting Up Amazon SES Usage Spike Alarms (250% Increase)

This guide provides step-by-step instructions for configuring an Amazon CloudWatch alarm to notify you when your Amazon SES send usage increases by more than 250% in 1 day.

You can choose to set this up **manually via the AWS Console** or **programmatically via AWS CloudShell (CLI)**.

---

## Part 1: Manual Setup via AWS Console

### Step 1: Create an SNS Topic (Notification Channel)

1. Navigate to the **Amazon SNS Console**.
2. Click **Topics** on the left menu, then **Create topic**.
3. Choose **Standard** as the type.
4. Name the topic (e.g., `SES-Usage-Alerts`) and click **Create topic**.

- **How to check:** Once created, you should see the Topic details page with a unique Topic ARN displayed at the top.

### Step 2: Subscribe Your Email to the Topic

1. On the topic details page you just created, click the **Create subscription** button.
2. Under **Protocol**, select **Email**.
3. Under **Endpoint**, enter the email address where you want to receive alerts.
4. Click **Create subscription**.

- **How to check:** 
  - The subscription status will initially show as `Pending confirmation`. 
  - Check your email inbox for a message from "AWS Notifications". Click the **Confirm subscription** link in the email. 
  - Return to the SNS console, refresh the page, and the status should now say `Confirmed`.

### Step 3: Create the CloudWatch Alarm with Metric Math

1. Navigate to the **Amazon CloudWatch Console**.
2. Go to **Alarms** > **All alarms** > **Create alarm**.
3. Click **Select metric**.
4. Search for `SES Send`, go to **SES** > **Account Metrics**, check the box next to the **Send** metric, and click the **Graphed metrics** tab.
5. Change **Statistic** to **Sum** and **Period** to **1 hour**.
6. Click **Add math** > **Start with empty expression** to add a new row (`e1`). Set the expression to `DIFF(m1)`.
  - *Tip: Uncheck the box under the "Select" column for `m1` and `e1` so they don't trigger the alarm.*
7. Click **Add math** > **Start with empty expression** again to add row (`e2`). Set the expression to `IF(m1 - e1 > 0, (e1 / (m1 - e1)) * 100, 0)`. Keep this row checked.
8. Click the **Select metric** button at the bottom.
9. Under **Conditions**, set:
  - **Threshold type:** Static
  - **Whenever e2 is:** Greater than
  - **than:** 250
10. Expand **Additional configuration** and set **Treat missing data as:** to `good (not breaching)`. Click **Next**.
11. Under **Notification**, choose **In alarm**, select **Select an existing SNS topic**, and choose `SES-Usage-Alerts`. Click **Next**.
12. Name the alarm (e.g., `SES-Spike-250Percent-Increase`) and click **Create alarm**.

- **How to check:** 
  - Go to **Alarms** > **All alarms**. 
  - Locate your new alarm. The state should initially say `Insufficient data` and then transition to `OK` within a few minutes if data is flowing correctly.

---

## Part 2: Automated Setup via AWS CloudShell (CLI)

If you prefer using the terminal, you can do this entirely inside your browser using **AWS CloudShell**.

### Step 1: Open AWS CloudShell

1. In the AWS Management Console, click the **CloudShell icon (`>_`)** located in the top navigation bar next to the search bar.
2. Wait a few seconds for the terminal to initialize.

- **How to check:** You should see a command prompt ending with `[cloudshell-user@ip-... ~]$`.

### Step 2: Create SNS Topic and Subscribe

Paste the following commands into CloudShell (replace `your-email@example.com` with your actual email):

```bash
# Create the SNS Topic
TOPIC_ARN=$(aws sns create-topic --name SES-Usage-Alerts --query "TopicArn" --output text)
echo "Topic ARN: $TOPIC_ARN"

# Subscribe your email
aws sns subscribe \
    --topic-arn "$TOPIC_ARN" \
    --protocol email \
    --notification-endpoint "your-email@example.com"
```

- **How to check:** 
  - Run `aws sns list-subscriptions-by-topic --topic-arn "$TOPIC_ARN"`. The output should list your email with a `SubscriptionArn` of `PendingConfirmation`.
  - Check your email inbox, click the confirmation link, and run the exact same command again. The output should now show an active ARN instead of `PendingConfirmation`.

### Step 3: Create the CloudWatch Alarm

Paste the following command into CloudShell to create the metric math alarm:

```bash
aws cloudwatch put-metric-alarm \
    --alarm-name "SES-Spike-250Percent-Increase" \
    --alarm-description "Triggers when daily SES send volume grows by more than 250%" \
    --alarm-actions "$TOPIC_ARN" \
    --evaluation-periods 1 \
    --comparison-operator GreaterThanThreshold \
    --threshold 250 \
    --treat-missing-data notBreaching \
    --metrics '[
      {
        "Id": "m1",
        "MetricStat": {
          "Metric": {
            "Namespace": "AWS/SES",
            "MetricName": "Send"
          },
          "Period": 86400,
          "Stat": "Sum"
        },
        "ReturnData": false
      },
      {
        "Id": "e1",
        "Expression": "DIFF(m1)",
        "ReturnData": false
      },
      {
        "Id": "e2",
        "Expression": "IF(m1 - e1 > 0, (e1 / (m1 - e1)) * 100, 0)",
        "Label": "Percentage Increase",
        "ReturnData": true
      }
    ]'
```

- **How to check:** 
  - Run `aws cloudwatch describe-alarms --alarm-names "SES-Spike-250Percent-Increase"`. 
  - The output will return a JSON object confirming the alarm's exact configuration. Look for the `"StateValue"` line—it should be `"OK"` (or `"INSUFFICIENT_DATA"` until new data arrives).