Amazon CloudWatch

What it is

Amazon CloudWatch is AWS's monitoring and observability service. It collects metrics and logs from AWS services, your applications, and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry servers. It lets you graph them on dashboards, alarm when something crosses a threshold, and act automatically, for example by scaling out, recovering an instance, or notifying a team.

Choose CloudWatch when a question is about performance metrics, logs, alarms, dashboards, or automatic reactions to metrics. For who made an API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry call, use AWS CloudTrail. For how a resource is configured and whether it complies, use AWS Config.

Metrics

A metric is a time-ordered set of data points, such as CPUUtilization. Metrics belong to a namespace (such as AWS/EC2) and are identified by dimensions (such as InstanceId). Metrics exist only in the AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry where they are created.
EC2 basic monitoring sends most metrics every 5 minutes at no charge. Detailed monitoring sends them every 1 minute, for a charge.
EC2 does not report memory or disk space usage by itself: install the CloudWatch agent to collect them (such as mem_used_percent and disk_used_percent). The agent also collects logs and traces from EC2 instances, on-premises servers, and containers.
Custom metrics: publish your own with PutMetricData, at standard (1-minute) or high resolution (down to 1 second).
Retention: data points under 60 seconds are kept for 3 hours, 1-minute data for 15 days, 5-minute data for 63 days, and 1-hour data for 455 days (15 months). Older data is rolled up to coarser periods.
Anomaly detection learns a metric's normal pattern and can alarm on deviations. Metric streams send metrics continuously to destinations such as Data Firehose and partner tools.

Alarms

An alarm watches a metric (or a math expression) and changes state: OK, ALARM, or INSUFFICIENT_DATA.
Actions:
- Notify an SNS topic.
- Run an EC2 action: stop, terminate, reboot, or recover an instance. Recover (on StatusCheckFailed_System) moves the instance to healthy hardware and keeps its instance ID, private, public, and Elastic IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses, metadata, and EBS volumes; data in RAM and on instance store volumes is lost.
- Trigger an EC2 Auto Scaling policy.
- Invoke a Lambda function.
- Create a Systems Manager OpsItem or incident.
Billing alarms: after you turn on billing alerts, alarm on the EstimatedCharges metric, which is stored in US East (N. Virginia) and covers worldwide charges.
Composite alarms combine several alarms with Boolean logic, to reduce alarm noise by acting only when a combination is true.

A CloudWatch alarm. A metric, such as CPU or errors, is evaluated by an alarm whose state is OK or ALARM. In ALARM, the alarm notifies an SNS topic, triggers an Auto Scaling policy, or runs an EC2 action such as recover.

CloudWatch Logs

Log events go into log streams, which are grouped into log groups. Retention is set per log group, and the default is never expire, so set a retention period to control cost.
Log classes: Standard for full features, and Infrequent Access for lower-cost logs you rarely query. Infrequent Access has a lower ingestion price but doesn't support metric filters, subscription filters, or Live Tail; you query it with Logs Insights. A log group's class can't be changed after creation.
Metric filters turn patterns in logs (such as ERROR) into metrics you can alarm on.
Subscription filters send a real-time feed of log events to Kinesis Data Streams, Data Firehose, or Lambda.
Logs Insights runs interactive queries over log data.
Export to S3 for archiving. Exported data can take up to 12 hours to become available, so use subscriptions for CI/CD (Continuous integration and continuous delivery)Practices in which every code change is built and tested automatically (continuous integration) and kept ready to release, often deploying it automatically through a pipeline (continuous delivery or deployment).Glossary entry.
Encryption: log data is always encrypted; you can use your own KMS key per log group.

More features

Dashboards: graphs and alarms, including across Regions and accounts.
Cross-account observability: monitor many accounts from one monitoring account.
Container Insights and Lambda Insights: metrics and logs for containers and Lambda functions.
Synthetics canaries: scripts that check endpoints and user flows on a schedule.
RUM: real user monitoring of web app performance.
Application Signals: application performance monitoring built on traces (see AWS X-Ray).
EventBridge, formerly CloudWatch Events, reacts to events; see Amazon EventBridge.

Security, resilience, performance, and cost

Security

IAM controls who can read metrics and logs and change alarms. Encrypt sensitive log groups with KMS, and use interface VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry to send data privately from VPCs.

Resilience

Use alarms with EC2 instance recovery and Auto Scaling to replace failed capacity automatically.

Performance

Alarm on the metrics that matter to users, such as LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry and errors, and use detailed or high-resolution metrics when one-minute reactions matter.

Cost

Basic AWS service metrics are free. You pay for custom metrics, detailed monitoring, alarms, dashboards, API requests, and logs ingested and stored.
Set log retention, use the Infrequent Access log class, and avoid high-cardinality custom metrics.

CloudWatch, CloudTrail, or Config?

Question asks for	Choose
CPU, latency, error rates, and other performance metrics	Amazon CloudWatch
Alarms, dashboards, application logs	Amazon CloudWatch
Who called which API, from where, and when	AWS CloudTrail
How a resource was configured over time, and whether it complies with rules	AWS Config
Trace a request across services	AWS X-Ray

Reverse mindmap: when the question points here

Is it Amazon CloudWatch?

Yes, when the question says
- Monitor CPU, network, or latency metrics leads to CloudWatch metrics
- Alert when a metric crosses a threshold leads to CloudWatch alarm
- Central application logs leads to CloudWatch Logs
- Dashboard of metrics across Regions leads to CloudWatch dashboards
Metrics details
- Memory or disk usage on EC2 leads to CloudWatch agent
- One-minute EC2 metrics leads to Detailed monitoring
- Our own application metric leads to Custom metric
- Sub-minute metrics leads to High-resolution custom metric
Alarms and actions
- Recover an impaired instance, same instance ID and IP leads to Alarm with EC2 recover action
- Scale on a metric leads to Alarm with Auto Scaling policy
- Too many alerts at once leads to Composite alarm
Logs details
- Count errors in logs and alarm leads to Metric filter
- Stream logs to Lambda or Firehose in real time leads to Subscription filter
- Query logs interactively leads to Logs Insights
- Logs kept forever by default leads to Set retention
- Cheaper logs, rarely queried, no metric filters leads to Infrequent Access log class
No, when the question says
- Who made an API call leads to CloudTrail
- Resource configuration history and compliance leads to Config

Key takeaways

CloudWatch collects metrics and logs, graphs them, alarms on them, and triggers actions.
EC2 basic monitoring is every 5 minutes; detailed monitoring is every 1 minute; memory and disk metrics need the CloudWatch agent.
Custom metrics can be high resolution (down to 1 second); metrics are kept for up to 15 months.
Alarm actions include SNS, EC2 recover, stop, terminate, or reboot, Auto Scaling, Lambda, and Systems Manager; composite alarms reduce noise.
Logs: set retention (the default is never expire), use metric filters for alarms, subscription filters for real-time streaming, and Logs Insights for queries.
CloudWatch is for performance and logs; CloudTrail is for API activity; Config is for configuration compliance.