Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS monitoring, logging, and auditing services solve different operational and governance problems. The key distinction is understanding whether you need to observe workload behavior, collect logs, record AWS API activity, or react automatically to events.
This lesson introduces three closely related services:
- Amazon CloudWatch for performance monitoring and log collection.
- AWS CloudTrail for recording AWS API activity and supporting accountability.
- Amazon EventBridge for routing events, including CloudTrail events, to targets for automation.
Together, these services form a common foundation for operations, security investigations, compliance evidence, and event-driven remediation.
Key Concepts
Amazon CloudWatch: Performance Monitoring and Logs
Amazon CloudWatch is primarily used to observe AWS resources and applications. It can collect and expose operational telemetry such as metrics, logs, and alarms.
CloudWatch can also collect operating system and application logs through the CloudWatch agent. The agent can be installed on supported:
- Amazon EC2 instances
- On-premises servers
- Other systems where the agent can be deployed and configured
This allows infrastructure and application logs to be centralized in CloudWatch Logs rather than inspected individually on each server.
Typical CloudWatch use cases include:
- Tracking resource or application performance
- Creating alarms when thresholds are exceeded
- Centralizing operating system and application logs
- Supporting troubleshooting and operational analysis
CloudWatch answers questions such as:
- Is the workload healthy?
- Is latency increasing?
- Are resource levels approaching a threshold?
- What does the application or operating system log show?
AWS CloudTrail: API Auditing and Accountability
AWS CloudTrail records activity associated with actions taken through the AWS Management Console, AWS SDKs, AWS CLI, and other AWS interfaces. The resulting event information helps establish:
- Who performed an action
- What action was performed
- When it occurred
- Which resource or AWS service was involved
- How the request was made, where the event provides that context
CloudTrail is therefore an auditing and governance service rather than a replacement for application performance monitoring.
Common use cases include:
- Investigating an unexpected resource change
- Supporting compliance and audit requirements
- Determining which identity modified a security group or IAM policy
- Establishing an operational timeline during an incident
- Detecting potentially suspicious API activity
CloudTrail answers questions such as:
- Who deleted or modified this resource?
- When was this configuration changed?
- Which identity called this AWS API?
- What request caused the current state?
Amazon EventBridge: Event Routing and Automation
Amazon EventBridge receives events from AWS services, applications, and other supported sources. Rules evaluate event patterns and route matching events to targets.
CloudTrail events can be used as an EventBridge source. This enables event-driven responses to AWS API activity. For example, an organization could detect a particular configuration change and route the event to a target that sends an alert, invokes a function, or starts a remediation workflow.
The design relationship is:
- An API action occurs.
- CloudTrail records the activity as an event.
- EventBridge evaluates the event against a rule.
- A matching event is delivered to one or more targets.
EventBridge answers questions such as:
- What should happen automatically when this event occurs?
- How can a security or operations team be alerted immediately?
- How can a workflow start when a resource or configuration changes?
Exam-Relevant Takeaways
- Use CloudWatch for performance monitoring, operational telemetry, alarms, and logs.
- Use the CloudWatch agent to collect system and application logs from EC2 instances or on-premises servers.
- Use CloudTrail to record AWS API activity for security, compliance, governance, and forensic investigation.
- CloudTrail helps identify who did what and when; it is not primarily a workload performance-monitoring tool.
- Use EventBridge to match events and route them to targets for alerting or automated action.
- CloudTrail and EventBridge are complementary: CloudTrail records activity, while EventBridge can react to selected events.
- A complete operational design often combines metrics, logs, audit records, and event-driven responses rather than relying on one service.
Architecture Decision Guide
| Requirement | Primary service or feature | Why |
|---|---|---|
| Monitor resource or application performance | Amazon CloudWatch metrics and alarms | Measures operational behavior and can notify when thresholds are reached |
| Collect operating system or application logs | CloudWatch agent and CloudWatch Logs | Centralizes logs from EC2 or on-premises systems |
| Determine who changed an AWS resource | AWS CloudTrail | Records AWS API activity and identity context |
| Support compliance or security auditing | AWS CloudTrail | Provides an audit trail of account activity |
| Trigger an automated response to an AWS event | Amazon EventBridge | Matches events and sends them to configured targets |
| Investigate both workload symptoms and configuration changes | CloudWatch plus CloudTrail | Combines runtime evidence with control-plane audit evidence |
Common Exam Traps
- Confusing CloudWatch with CloudTrail: CloudWatch focuses on monitoring and logs; CloudTrail focuses on AWS API auditing.
- Assuming CloudTrail replaces application logs: CloudTrail records AWS service activity, not every message or error generated inside an application.
- Assuming CloudWatch automatically collects all operating system logs: Server log collection generally requires the CloudWatch agent and appropriate configuration and permissions.
- Using CloudTrail alone for real-time remediation: CloudTrail records events; EventBridge is the service used to match events and initiate event-driven actions.
- Treating monitoring and auditing as interchangeable: A healthy CPU graph does not show who changed an IAM policy, and an audit record does not explain application latency.
- Ignoring permissions and delivery configuration: Agents, CloudTrail, and EventBridge integrations require correctly configured IAM permissions and destinations or targets.
Real-World Engineer Notes
- Design observability around distinct evidence types: metrics indicate trends, logs provide detailed context, and audit events establish accountability.
- Use CloudWatch alarms for operational conditions and EventBridge rules for discrete events or state changes.
- When investigating an incident, correlate CloudWatch timestamps and workload logs with CloudTrail events to determine whether a configuration change caused the symptom.
- Centralized logging is only useful when retention, access control, and log destinations are deliberately designed.
- Automated remediation should be narrowly scoped. A rule that reacts to every event can create noise or unintentionally modify production resources.
- Logging and auditing data can contain sensitive information. Restrict access using IAM and apply appropriate retention and protection policies.
Quick Reference Summary
- CloudWatch: Observe performance and collect operational logs.
- CloudWatch agent: Sends system and application logs from servers to CloudWatch.
- CloudTrail: Records AWS API activity for auditing, compliance, and investigations.
- EventBridge: Matches events and routes them to targets for notifications or automation.
- Combined pattern: Monitor with CloudWatch, audit with CloudTrail, and automate with EventBridge.
Flashcards
- Q: Which AWS service is primarily used for performance monitoring and operational telemetry?
A: Amazon CloudWatch.
- Q: Which service records AWS API activity so an organization can determine who performed an action and when?
A: AWS CloudTrail.
- Q: How can system and application logs be collected from EC2 or on-premises servers into CloudWatch?
A: Install and configure the CloudWatch agent.
- Q: Which service can react to selected CloudTrail events?
A: Amazon EventBridge.
- Q: What is the main distinction between CloudWatch and CloudTrail?
A: CloudWatch monitors workload behavior and collects logs; CloudTrail audits AWS API activity.
- Q: What type of question is CloudTrail designed to answer?
A: Who performed an AWS action, what they did, and when it occurred.
- Q: What type of question is CloudWatch designed to answer?
A: Whether a workload is operating within expected performance and health parameters.
- Q: What is the relationship between CloudTrail and EventBridge?
A: CloudTrail records API activity, while EventBridge can match the resulting events and route them to targets.
- Q: Which service should be considered when centralizing application and operating system logs?
A: Amazon CloudWatch Logs, commonly populated from servers by the CloudWatch agent.
- Q: Why is CloudTrail important for compliance and security?
A: It provides an audit record of account activity that can support investigations and demonstrate accountability.
Practice Questions
Question 1
A security team must determine which identity modified a production security group and the approximate time of the change. Which AWS service should the architect prioritize?
A. Amazon CloudWatch Metrics
B. AWS CloudTrail
C. Amazon EventBridge
D. Amazon EC2 Auto Scaling
Correct answer: B. AWS CloudTrail
CloudTrail records AWS API activity and provides information about the identity, action, and time associated with the request. CloudWatch metrics do not provide this audit history, and EventBridge is primarily used to route matching events rather than serve as the audit record.
Question 2
An organization needs to collect application and operating system logs from EC2 instances and several on-premises servers in a centralized location. Which solution is most appropriate?
A. Configure the CloudWatch agent on the servers and send logs to CloudWatch Logs.
B. Enable an EventBridge rule for every application log line.
C. Use CloudTrail to collect operating system logs.
D. Create CloudWatch metrics without installing an agent.
Correct answer: A. Configure the CloudWatch agent on the servers and send logs to CloudWatch Logs.
The CloudWatch agent is designed to collect system and application logs from supported servers. CloudTrail records AWS API activity and is not a general-purpose operating system log collector.
Question 3
A compliance team wants an alert whenever a sensitive AWS configuration change occurs. The alert should be sent to an operations target automatically. Which architecture is appropriate?
A. CloudWatch metric alarm only
B. CloudTrail recording the event and an EventBridge rule routing matching events to an alerting target
C. The CloudWatch agent forwarding the event from an EC2 instance
D. An EC2 instance polling every AWS service for changes
Correct answer: B. CloudTrail recording the event and an EventBridge rule routing matching events to an alerting target
CloudTrail provides the audit event, and EventBridge can evaluate the event pattern and invoke or notify the configured target.
Question 4
An application has rising latency. The team also suspects that a recent IAM or networking change may have contributed to the issue. Which combination provides the most relevant evidence?
A. CloudWatch for performance and logs, plus CloudTrail for API changes
B. CloudTrail only
C. EventBridge only
D. CloudWatch agent only
Correct answer: A. CloudWatch for performance and logs, plus CloudTrail for API changes
CloudWatch supplies runtime performance and application evidence, while CloudTrail can reveal related control-plane changes and identify the actor responsible.
Question 5
Which statement best describes Amazon EventBridge in a monitoring and auditing architecture?
A. It replaces CloudTrail as the permanent record of API activity.
B. It collects operating system logs from every server automatically.
C. It evaluates events and routes matching events to targets for automation or notification.
D. It measures CPU utilization and application latency.
Correct answer: C. It evaluates events and routes matching events to targets for automation or notification.
EventBridge is an event-routing and automation service. CloudTrail provides API audit records, and CloudWatch provides performance monitoring and log collection.