Inactivity Stop Alarm with AWS Cloudwatch | Unexpected behaviour

Question

I have read the following sections of AWS documentation

• Metric alarm states
• Evaluating an alarm
• Alarm actions
• Configuring how alarms treat missing data

I'm still having trouble with the settings to get a right behaviour for my inactivity alarm.

Use case definition:

I want to have an stop action for my EC2 instance if the instance has been running with no activity for an hour. I defined inactivity to be "Max Network out traffic in the period <= 200 KB". I'm treating the missing data as "Not breaching (within the threshold)"

I tried:

1. Set the period to be 1 hour with 1 evaluation periods and 1 data point, taking the MAX statistic of network out to be <= 200kb: This doesn't work since when the ec2 has been stopped for a lets say 2 hours and I start the instance, it takes only the single first minute for calculating the max and goes to ALARM state, stopping the instance after 1 minute.

2. After that I switched period to be 1 minute and asking for 60 evaluation periods and 60 data points for triggering the alarm, now the alarm gets to OK state but it never triggers even though the last 60 minutes have been below the 200kb... I thought this last option should work

Settings overview in AWS

Questions:

a) Which period, evaluation periods and data points should I set to get the expected behaviour mentioned above?

b) Why 2) is not working?

Thanks!