Monitoring: CloudWatch and CloudTrail

Monitoring and Logging: CloudWatch and CloudTrail

Amazon CloudWatch focuses on workload and service observability through metrics, logs, alarms, dashboards, traces, and related features. AWS CloudTrail records account API activity and is central to audit, governance, and security investigation. They solve complementary problems.

Core ideas

• Metrics are numeric time series with dimensions; high-cardinality custom dimensions can increase cost.
• Log groups contain streams and have configurable retention and access policy.
• Alarms evaluate metrics or expressions and can notify or automate responses.
• CloudTrail event history is useful for recent management events, while trails or event data stores support durable centralized records.

Design and operating model

Define service-level indicators from user outcomes, then instrument applications and infrastructure. Centralize logs in a protected account, set retention from operational and compliance needs, create actionable alerts with runbooks, and validate that CloudTrail covers every Region and relevant event type.

Example

aws cloudwatch put-metric-alarm \
  --alarm-name api-high-errors \
  --namespace Training/API \
  --metric-name ErrorCount \
  --statistic Sum \
  --period 300 \
  --evaluation-periods 2 \
  --threshold 10 \
  --comparison-operator GreaterThanThreshold

Run examples in a disposable training account and replace Regions, identifiers, policies, resource sizes, and names with reviewed values. Verify commands with the current AWS CLI and service documentation before production use.

Production guidance

• Alert on symptoms users feel and on capacity or dependency risks with clear ownership.
• Protect audit logs with encryption, restricted deletion, integrity validation, and independent retention.
• Control noisy logs and high-cardinality metrics, but never disable essential security evidence merely to save cost.

The chapter quiz follows the lesson and checks both service vocabulary and architecture decisions.