This assumes you have already configured the aws command line tool. If not, check out my article on Getting Started with the AWS CLI.

Cloudwatch alarms can be used to do something, such as:

• Publish message to a Simple Notifcation Service (SNS) topic
• Reboot an EC2 instance
• Auto Scale to create/start additional EC2 instances or to stop/terminate EC2 instances

When some conditiion is met, such as:

• An EC2 instance has:
  • high CPU (this article)
  • high memory usage
  • high network usage
  • EC2 instance status check has failed
  • An EC2 instance in a Load Balancer Target Group health check returns "unhealthy"
• An ElastiCache Redis Cache Cluster has a high number of connections
• a Lambda Function has one or more errors
• Your monthy AWS Bill is estimated to exceed x (this article)

More commonly, an AWS Budget is used to do something (such as send an email alert) when your estimated spend or actual spend exceeds x currency. Check out my article Create a Budget using the AWS CLI.

By default, CloudWatch billing alerts are set to "Not delivered". In the AWS billing console https://console.aws.amazon.com/billing, select Billing Preferences in the left panel and update Alert preferences so that CloudWatch billing alerts are set to Delivered.

If you have not yet created and subscribed to a Simple Notifcation Service (SNS) topic, check out my article Create Simple Notification Service (SNS) Topics using the AWS CLI. Assuming you have created and subscribed to a Simple Notifcation Service (SNS) topic, the aws sns list-topics command can be used to list your topics. 

~]$ aws sns list-topics
{
    "Topics": [
        {
            "TopicArn": "arn:aws:sns:us-east-1:123456789012:my-topic"
        }
    ]
}

Now that you have the Amazon Resource Number (ARN) of one of your Simple Notification Service (SNS) Topic, you can use the aws cloudwatch put-metric-alarm command to create a new cloudwatch alarm.

• Period and Evaluation Periods and Datapoints to Alarm are used to set the Alarm State, such as In Alarm. In this example:
  • --period 21600 means that the billing estimate will be checked once every 21600 seconds (6 hours)
  • --datapoints-to-alarm 1 means there only needs to be a single occurrence where the billing exceeds the threshold for the alarm state to be set to In Alarm. This works in conjunction with Comparison Operator and Threshold and Unit. In this example, the combination of --comparison-operator  GreaterThanThreshold and --threshold 1000.00 and --unit Maximum means that the alarm will be trigger when the estimated billing exceeds $1000.00
  • --evaulation-periods 1 means only the current occurence is evaluated to determine if the alarm state should be updated
• A message will be published to your Simple Notification Service (SNS) Topic if the billing estimate exceeds $1000.00 or if the Alarm has INSUFFICIENT_DATA.

It is also noteworthy that if Datapoints to Alarm were 2 and Evaluation Periods were 10, then the alarm state would be set to In Alarm if the billing estimate exceeds the threshold in 2 of the last 10 periods.

aws cloudwatch put-metric-alarm \
--alarm-name billing \
--alarm-description "Alarm when billing is estimated to exceed $1000.00" \
--namespace AWS/Billing \
--metric-name EstimatedCharges \
--comparison-operator GreaterThanThreshold \
--threshold 1000.0 \
--statistic Maximum \
--period 21600 \
--evaluation-periods 1 \
--treat-missing-data missing \
--datapoints-to-alarm 1 \
--dimensions "Name=Currency,Value=USD" \
--alarm-actions <the ARN of your SNS topic>
--insufficient-data-actions <the ARN of your SNS topic>

If you want to have multiple action, such as creating an alarm and autoscaling or reboot the EC2 instance, --alarm-action will be the list of actions you want.

The aws cloudwatch list-metrics --namespace=AWS/Billing command can be used to return metrics.

aws cloudwatch list-metrics --namespace=AWS/Billing