Cloud Monitoring

AWS CLF-C02 — CloudWatch, CloudTrail, X-Ray, Health Dashboard, CodeGuru, Trusted Advisor

Amazon CloudWatch Metrics

CloudWatch provides metrics for every AWS service. A metric is a variable to monitor (e.g., CPUUtilization, NetworkIn).

Key Concepts

Metrics belong to namespaces (grouped by service)
Each metric has a dimension (attribute) like instance ID, environment, etc.
Up to 30 dimensions per metric
Metrics have timestamps — you can view them over time
Can create CloudWatch dashboards to visualize metrics

EC2 Monitoring

Monitoring Type	Interval	Cost
Basic Monitoring	Every 5 minutes	Free
Detailed Monitoring	Every 1 minute	Additional cost

EC2 memory (RAM) usage is NOT a built-in metric — you must push it as a custom metric

Custom Metrics

Push your own metrics to CloudWatch using the PutMetricData API
Examples: memory usage, disk space, number of logged-in users, application-specific metrics
Resolution: standard (1 minute) or high resolution (1 second)

Exam Tip:

EC2 default monitoring = 5 min. Detailed = 1 min (costs more). RAM is NOT a default metric — it must be a custom metric. This is a very common exam question!

CloudWatch Alarms

Trigger notifications and automated actions based on metric thresholds.

Alarm States

OK — metric is within threshold
INSUFFICIENT_DATA — not enough data to determine state
ALARM — metric has breached the threshold

Alarm Actions

Action Type	Examples
Auto Scaling	Increase or decrease EC2 instances in an ASG
EC2 Actions	Stop, terminate, reboot, or recover an EC2 instance
SNS Notifications	Send notifications (email, SMS, Lambda trigger, etc.)

Can choose the period to evaluate the metric (e.g., 5 min, 1 hour)
Billing alarms can be created on the estimated charges metric (only available in us-east-1)
Composite alarms can combine multiple alarms with AND/OR logic

Key Point:

CloudWatch Alarms can trigger 3 types of actions: Auto Scaling, EC2 instance actions, and SNS notifications. Billing alarms help you avoid surprise AWS charges.

CloudWatch Logs

Centralized logging service for collecting, monitoring, and analyzing log files from AWS services and applications.

Key Features

Log Groups — a collection of log streams (usually representing an application)
Log Streams — a sequence of log events from the same source (e.g., one EC2 instance)
Adjustable retention — from 1 day to 10 years (or never expire)
Real-time monitoring with subscription filters
Can send logs to S3, Lambda, Kinesis Data Streams, Kinesis Data Firehose

Log Sources

Elastic Beanstalk — collection of logs from applications
ECS — collection from containers
Lambda — function logs
CloudTrail — filter-based logs
CloudWatch Log Agent / Unified Agent — on EC2 machines or on-premises servers
Route 53 — DNS queries
VPC Flow Logs, API Gateway, and more

CloudWatch Logs Insights

Search and analyze log data interactively using a query language
Query multiple log groups across multiple AWS accounts
Purpose-built query language with aggregations, filters, and visualizations

Exam Tip:

CloudWatch Logs = centralized log collection. The CloudWatch Agent must be installed on EC2 instances to push logs. Logs Insights lets you query logs with SQL-like syntax.

Amazon EventBridge (CloudWatch Events)

EventBridge is the successor to CloudWatch Events. A serverless event bus for building event-driven applications.

Event Sources

Schedule: cron jobs (e.g., "every hour," "every Monday at 9 AM")
Event Pattern: react to events from AWS services (e.g., IAM root user sign-in, EC2 instance state change, CodePipeline state change)
Partner events: events from SaaS partners (Zendesk, Datadog, Auth0, etc.)
Custom events: events from your own applications

Event Targets

Lambda, SQS, SNS, Kinesis, Step Functions, CodePipeline, EC2 actions, SSM, and many more

Key Point:

EventBridge = react to AWS events + schedule cron jobs + integrate with SaaS partners. It's the recommended way to build event-driven architectures on AWS (replacing CloudWatch Events).

AWS CloudTrail

Provides governance, compliance, and audit for your AWS account. Records every API call made in your account.

Key Features

Enabled by default for all AWS accounts
Records API calls from the Console, SDK, CLI, and AWS services
Logs can be sent to CloudWatch Logs or S3
A trail can be applied to all regions (recommended) or a single region

Event Types

Event Type	Description	Examples
Management Events	Operations on AWS resources (control plane)	Configuring security (IAM), setting up logging (CloudTrail), creating subnets (VPC). Logged by default.
Data Events	Operations on data within resources (data plane)	S3 object-level activity (GetObject, PutObject), Lambda function executions. NOT logged by default (high volume).
Insights Events	Detect unusual activity automatically	Bursts of IAM actions, gaps in periodic maintenance, spikes in provisioning. Uses ML to detect anomalies.

CloudTrail Insights

Enable CloudTrail Insights to detect unusual activity in your account
Analyzes normal management events to create a baseline
Continuously analyzes write events to detect unusual patterns
Anomalies appear in the CloudTrail console, can be sent to S3 or EventBridge

Exam Tip:

CloudTrail = "Who did what?" Audit trail of API calls. If someone deleted a resource and you need to find out who — check CloudTrail. Enabled by default. Data events cost extra and are not enabled by default.

AWS X-Ray

Distributed tracing service for analyzing and debugging distributed applications (e.g., microservices).

Key Features

Provides a visual service map of your application architecture
Trace requests as they travel through your application components
Identify performance bottlenecks and errors
Understand dependencies across services
Find where failures and errors occur
Identify which services are being throttled
Works with EC2, ECS, Lambda, Elastic Beanstalk, API Gateway, and more

Advantages

Troubleshoot performance — find bottlenecks across microservices
Understand dependencies — see how services interact
Pinpoint issues — find which service has errors, high latency
Identify impacted users — trace requests from specific users
SLA compliance — ensure response time meets commitments

Exam Tip:

X-Ray = distributed tracing, visual service map, debug microservices. If the question mentions "trace requests across services" or "debug a distributed application," think X-Ray.

AWS Health Dashboard

Service Health Dashboard

Shows the health of all AWS services across all regions
Shows historical information for each day
Has an RSS feed for notifications
Previously called "AWS Service Health Dashboard"
URL: health.aws.amazon.com/health/status

Your Account Health Dashboard (Personal Health Dashboard)

Provides personalized alerts and guidance when AWS is experiencing events that may impact YOUR resources
Shows only events relevant to your account (not all AWS services)
Provides proactive notifications for planned lifecycle events
Can be aggregated across your AWS Organization
Integrates with EventBridge for automated actions

Key Point:

Service Health = all AWS services, all regions (general). Your Account Health = only YOUR resources, personalized alerts. If the exam says "be notified when an AWS service impacts my resources," think Personal Health Dashboard.

Amazon CodeGuru

ML-powered service for automated code reviews and application performance recommendations.

CodeGuru Reviewer

Automated code reviews using machine learning
Identifies critical issues, security vulnerabilities, hard-to-find bugs
Supports Java and Python
Integrates with GitHub, Bitbucket, AWS CodeCommit

CodeGuru Profiler

Visibility/recommendations about application performance during runtime
Identifies and removes code inefficiencies
Finds the most "expensive" lines of code (CPU utilization)
Decrease compute costs
Provides heap summary (identify memory leaks)
Supports applications running on AWS or on-premises

Exam Tip:

CodeGuru Reviewer = automated code reviews (find bugs). CodeGuru Profiler = runtime performance optimization (find expensive code). Both use ML.

AWS Trusted Advisor

An online tool that provides real-time recommendations to help you follow AWS best practices. It inspects your AWS environment at the account level.

Five Pillars of Recommendations

Pillar	What It Checks	Examples
Cost Optimization	Identify ways to reduce cost	Idle load balancers, unassociated Elastic IPs, low-utilization EC2 instances, Reserved Instance optimization
Performance	Improve application performance	High-utilization EC2 instances, CloudFront CDN optimization, overprovisioned EBS
Security	Improve security posture	MFA on Root Account, IAM password policy, S3 bucket permissions, security groups with unrestricted access (0.0.0.0/0)
Fault Tolerance	Increase availability and redundancy	EBS snapshots, RDS Multi-AZ, Auto Scaling Groups across AZs
Service Limits	Check if you're approaching service quotas	VPC, IAM, EBS, RDS limits (warns at 80% of limit)

Checks by Support Plan

Support Plan	Available Checks
Basic & Developer	7 core checks only: • S3 Bucket Permissions • Security Groups — Specific Ports Unrestricted • IAM Use (at least one IAM user created) • MFA on Root Account • EBS Public Snapshots • RDS Public Snapshots • Service Limits
Business & Enterprise	Full set of checks across all 5 pillars + AWS Support API access + ability to enable weekly notifications

Exam Tip:

Trusted Advisor = account-level best practice checks (5 pillars). Basic/Developer support = only 7 core checks. Business/Enterprise = ALL checks. If the exam asks "check if MFA is enabled on root" or "identify underutilized resources," think Trusted Advisor.

Monitoring Services Summary

Service	Purpose	Think Of It As
CloudWatch Metrics	Monitor AWS resource metrics	"How is my resource performing?"
CloudWatch Alarms	Trigger actions on metric thresholds	"Alert me when CPU > 90%"
CloudWatch Logs	Centralized log collection	"What did my application log?"
EventBridge	React to events, schedule cron jobs	"When X happens, do Y"
CloudTrail	Audit API calls	"Who did what and when?"
X-Ray	Distributed tracing	"Where is the bottleneck in my microservices?"
Health Dashboard	AWS service status & personal alerts	"Is AWS broken? Does it affect me?"
CodeGuru	ML code reviews & performance	"Is my code efficient and bug-free?"
Trusted Advisor	Best practice recommendations	"Am I following AWS best practices?"