Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS monitoring, logging, and auditing services solve different operational and governance problems. CloudWatch focuses on metrics, logs, alarms, and automated operational responses. CloudTrail records AWS API activity for auditing and accountability. Amazon EventBridge, formerly called CloudWatch Events, routes events and triggers automated actions.
The exam commonly tests which service captures a particular type of information, how frequently metrics are published, and how to connect monitoring data to automated responses.
Key Concepts
Amazon CloudWatch
Amazon CloudWatch provides observability for AWS resources, applications, and—in some cases—on-premises systems. Its major capabilities include:
- Metrics: Time-ordered numerical data points used to understand resource and application behavior.
- Alarms: Evaluate metrics and initiate actions when thresholds or alarm conditions are met.
- CloudWatch Logs: Centralized collection and analysis of system and application logs.
- Events: Event routing and automation capabilities now provided by Amazon EventBridge.
CloudWatch can help identify performance issues, optimize resource use, derive insights from logs, and automate responses to operational changes.
CloudWatch Metrics and EC2 Monitoring
Many AWS services publish metrics automatically to CloudWatch. For EC2:
- Basic monitoring: Metrics are published at five-minute intervals by default and do not incur an additional charge for the monitoring feature.
- Detailed monitoring: Metrics are published at one-minute intervals and incur additional charges.
CloudWatch does not automatically provide every operating-system metric. Metrics such as memory utilization and disk usage generally require the CloudWatch agent or another custom metric collection method.
Applications and scripts can publish custom metrics through the AWS CLI, APIs, or supported integrations.
Custom metrics support two broad resolutions:
- Standard resolution: One-minute granularity.
- High resolution: One-second granularity, with additional cost implications.
AWS service metrics are generally published using standard resolution unless the service documents otherwise.
CloudWatch Alarms
A CloudWatch alarm evaluates metric data and changes state based on configured conditions. The principal states are:
- OK: The metric is within the configured condition.
- ALARM: The metric has breached the configured condition.
- INSUFFICIENT_DATA: CloudWatch cannot determine the state because adequate data is unavailable.
Alarm types include:
- Metric alarm: Evaluates one metric and can initiate one or more actions.
- Composite alarm: Uses a rule expression that combines the states of multiple alarms. Composite alarms are useful when an action should occur only when several conditions collectively indicate a problem.
Alarm actions can support operational automation, such as notifying operators or initiating a supported remediation workflow.
CloudWatch Logs
CloudWatch Logs centralizes logs from applications, operating systems, and AWS services. Important capabilities include:
- Configurable log-group retention policies.
- Encryption using AWS Key Management Service (AWS KMS).
- Filtering and querying log data.
- Export or streaming to other services, including Amazon S3, Kinesis Data Streams, and Kinesis Data Firehose.
CloudWatch Logs is appropriate when logs need near-real-time monitoring, centralized access, metric filters, or integration with alerting and event-driven workflows. Amazon S3 is often more appropriate as a durable, low-cost archive or for long-term analysis.
CloudWatch Agent
The unified CloudWatch agent must be installed and configured on the systems from which it collects data. It can run on supported EC2 instances and on-premises servers, including Linux and Windows environments. The source material also identifies macOS as a supported installation environment.
The agent can collect:
- System-level metrics such as memory and disk utilization.
- Logs from EC2 instances and on-premises servers.
- Application custom metrics through the StatsD and CollectD protocols.
This makes the agent important when a scenario requires operating-system metrics or logs that are not available through default AWS service metrics.
AWS CloudTrail
AWS CloudTrail records AWS API activity for governance, security investigation, and auditing. It answers questions such as:
- Which identity made an API request?
- What action was performed?
- Which resource was affected?
- When and from where did the request originate?
CloudTrail distinguishes among several event categories:
- Management events: Control-plane operations that manage AWS resources, such as creating, modifying, or deleting resources. Management events are logged in the default event history.
- Data events: Detailed operations performed on or within resources, such as object-level activity. These can generate substantially higher event volume and must be configured when required.
- Insights events: Identify unusual activity patterns associated with API call rates, helping detect anomalous behavior.
The default CloudTrail event history provides recent management-event history for 90 days. For longer retention, centralized collection, or organization-wide auditing, create a trail that delivers events to Amazon S3. S3 retention then depends on the bucket’s lifecycle, retention, and access policies.
A trail can be configured for a single AWS Region or for all Regions. All-Regions trails are generally preferable for complete organization-wide auditing unless there is a specific reason to limit the scope.
Amazon EventBridge and CloudTrail Integration
Amazon EventBridge was previously known as CloudWatch Events. It receives events describing changes in AWS resources and can route matching events to targets for automated action.
CloudTrail API activity can be used as an event source. For example, an API call that changes a security group or creates an IAM policy can generate an event that EventBridge evaluates against a rule. Matching events can then initiate an appropriate target workflow.
CloudTrail can also deliver events to CloudWatch Logs, allowing API activity to be centralized with application and system logs for investigation and analysis.
Exam-Relevant Takeaways
- Use CloudWatch for AWS and application performance monitoring, metrics, alarms, and operational visibility.
- Use CloudWatch Logs for centralized system and application log collection.
- Use the CloudWatch agent for EC2 or on-premises operating-system metrics such as memory and disk usage.
- EC2 basic monitoring is five-minute resolution; detailed monitoring is one-minute resolution and chargeable.
- Standard custom metrics use one-minute granularity; high-resolution custom metrics can use one-second granularity.
- Use a metric alarm for a condition based on one metric and a composite alarm for logic across multiple alarms.
- An alarm in INSUFFICIENT_DATA does not mean the metric is healthy; it means CloudWatch cannot currently determine the condition.
- Use CloudTrail to audit AWS API activity, not to monitor CPU, memory, or application latency.
- The default CloudTrail event history covers recent management events for 90 days. Use a trail to deliver events to S3 for longer-term retention.
- Data events provide detailed resource-level activity and are distinct from management events.
- EventBridge can react to CloudTrail API events and trigger automated workflows.
Architecture Decision Guide
| Requirement | Best-fit service or feature | Key consideration |
|---|---|---|
| Monitor CPU, network, or other AWS service metrics | CloudWatch Metrics | Metrics are time-series performance data. |
| Monitor memory or disk usage on an EC2 instance | CloudWatch agent | Install and configure the agent on the instance. |
| Collect application and operating-system logs centrally | CloudWatch Logs | Configure retention and encryption as appropriate. |
| Trigger an alert from a threshold on one metric | CloudWatch metric alarm | Alarm state changes can initiate actions. |
| Trigger an action based on several alarm states | CloudWatch composite alarm | Use a rule expression combining multiple alarms. |
| Audit who performed an AWS API operation | CloudTrail | Review management, data, or Insights events as applicable. |
| Retain audit events beyond the default history period | CloudTrail trail to S3 | S3 provides the durable destination; configure retention and security controls. |
| Automatically react to an AWS API or resource-change event | EventBridge | Create an event pattern and configure a target. |
| Stream logs for processing or delivery elsewhere | CloudWatch Logs with Kinesis or export to S3 | Select the destination based on latency, processing, and retention needs. |
Common Exam Traps
- Confusing CloudWatch with CloudTrail: CloudWatch monitors performance and logs; CloudTrail records API activity and identity actions.
- Assuming memory metrics are automatic: EC2 default metrics do not provide all operating-system metrics. Use the CloudWatch agent for memory and disk metrics.
- Confusing Events with CloudTrail: CloudTrail records API activity. EventBridge uses events, including CloudTrail-derived events, to route and automate responses.
- Treating 90-day event history as permanent retention: The default CloudTrail history is limited. Configure a trail to store events in S3 for longer retention.
- Ignoring data events: Management events describe resource-management operations; data events capture detailed activity on supported resources.
- Choosing high-resolution metrics unnecessarily: One-second custom metrics can provide faster detection but increase cost and should be selected only when the use case needs that granularity.
- Interpreting INSUFFICIENT_DATA as OK: It indicates insufficient observations, not a healthy metric.
- Forgetting agent installation: The unified CloudWatch agent is software deployed to the source system; it is not automatically present on every server.
Real-World Engineer Notes
- Separate operational observability from security auditing. A mature design commonly uses CloudWatch for telemetry and CloudTrail for an immutable-style audit workflow centered on protected S3 storage.
- Use CloudWatch Logs retention policies rather than allowing every log group to grow indefinitely. Export or stream logs when they need to be archived, processed, or analyzed outside CloudWatch.
- Centralize CloudTrail trails across Regions and accounts when the goal is organization-wide detection and compliance visibility.
- Protect audit destinations with restrictive bucket policies, encryption, controlled administrative access, and lifecycle management.
- Use EventBridge for event-driven remediation, but make automated actions idempotent and test them carefully. A security or infrastructure event may be delivered more than once or arrive out of order.
- Choose metric resolution based on the detection objective. A one-minute or five-minute signal may be sufficient for capacity trends, while high-resolution data may be justified for rapid operational response.
Quick Reference Summary
- CloudWatch Metrics: Time-series performance and operational data.
- CloudWatch Alarms: Evaluate metrics and initiate actions.
- Metric alarm: Based on one metric.
- Composite alarm: Combines multiple alarm states.
- CloudWatch Logs: Centralized application and system logs.
- CloudWatch agent: Collects OS metrics, logs, and StatsD/CollectD metrics.
- CloudTrail: Audits AWS API activity.
- Management events: Resource-management operations.
- Data events: Detailed activity on supported resources.
- Insights events: Unusual API activity patterns.
- EventBridge: Routes events and triggers targets; formerly CloudWatch Events.
- EC2 basic monitoring: Five-minute interval.
- EC2 detailed monitoring: One-minute interval and additional cost.
- Default CloudTrail event history: Recent management events for 90 days.
- Long-term CloudTrail retention: Create a trail and deliver events to S3.
Flashcards
1. What is the primary purpose of CloudWatch?
To monitor AWS and application performance using metrics, logs, alarms, and related automation capabilities.
2. What is the primary purpose of CloudTrail?
To record AWS API activity for auditing, governance, accountability, and security investigations.
3. What is the default EC2 metric interval?
Five minutes. Detailed monitoring provides one-minute intervals for an additional charge.
4. How can memory and disk utilization be collected from EC2?
Install and configure the unified CloudWatch agent.
5. What are the two main CloudWatch alarm types?
Metric alarms evaluate one metric; composite alarms evaluate a rule involving multiple alarms.
6. What does INSUFFICIENT_DATA mean for a CloudWatch alarm?
There is not enough metric data to determine whether the alarm condition is satisfied.
7. What is the difference between standard and high-resolution custom metrics?
Standard custom metrics have one-minute granularity; high-resolution custom metrics can have one-second granularity.
8. How long is default CloudTrail event history available?
Recent management events are available for 90 days. A trail is required for longer-term delivery and retention.
9. Where are long-term CloudTrail events commonly stored?
In Amazon S3 through a CloudTrail trail.
10. What are CloudTrail data events?
Detailed events for activity performed on or within supported resources, distinct from control-plane management events.
11. What service was formerly called CloudWatch Events?
Amazon EventBridge.
12. How can CloudTrail API activity trigger automation?
EventBridge can match CloudTrail-derived events with an event pattern and invoke a configured target.
Practice Questions
Question 1
A company needs to alert when the operating-system memory utilization of an EC2 instance exceeds 85 percent. CPU and network metrics are already visible in CloudWatch, but memory is not. What should an architect recommend?
A. Enable CloudTrail data events for the instance
B. Install and configure the unified CloudWatch agent
C. Create a CloudTrail trail that delivers events to S3
D. Use EventBridge to calculate memory utilization
Correct answer: B
Explanation: Memory is an operating-system-level metric and is not generally available from default EC2 metrics. The CloudWatch agent collects memory and other system-level metrics and publishes them to CloudWatch.
Question 2
A security team must retain AWS API activity for several years and review events from every Region. Which design best meets the requirement?
A. Use the default CloudTrail event history in one Region
B. Enable EC2 detailed monitoring in every Region
C. Create an all-Regions CloudTrail trail that delivers events to an appropriately protected S3 bucket
D. Store CloudWatch alarm state changes in CloudWatch Logs
Correct answer: C
Explanation: The default CloudTrail event history is limited to recent management events. An all-Regions trail delivers audit events to S3, where long-term retention and lifecycle controls can be configured.
Question 3
An operations team wants to invoke an automated remediation function whenever an API call modifies a security group. Which combination should be used?
A. CloudWatch metric and composite alarm
B. CloudTrail event and EventBridge rule
C. CloudWatch agent and CloudTrail data event
D. CloudWatch Logs retention policy and S3 lifecycle rule
Correct answer: B
Explanation: CloudTrail records the API activity, and EventBridge can match the resulting event and invoke a target for remediation.
Question 4
An application requires centralized log collection, encryption, a defined retention period, and the ability to stream logs for near-real-time processing. Which service is the best starting point?
A. CloudWatch Logs
B. CloudTrail Insights
C. EC2 detailed monitoring
D. CloudTrail default event history
Correct answer: A
Explanation: CloudWatch Logs supports centralized system and application logs, retention configuration, KMS encryption, and delivery or streaming to services such as Kinesis Data Streams and Kinesis Data Firehose.
Question 5
A team wants an alarm to notify administrators only when both a high error-rate alarm and a low-availability alarm are active. Which CloudWatch feature should be used?
A. A high-resolution custom metric
B. A metric alarm with two actions
C. A composite alarm
D. CloudTrail Insights
Correct answer: C
Explanation: A composite alarm evaluates a rule based on multiple underlying alarm states, allowing notification only when the required combination of conditions is met.