Amazon CloudWatch
Amazon CloudWatch
Overview
Amazon CloudWatch collects, visualizes, and acts on metrics, logs, and events from AWS resources and applications. Track numeric metrics over time, centralize and search logs, and trigger alarms that notify operators or automatically scale/remediate when thresholds are crossed. Many AWS services publish standard metrics automatically, making CloudWatch the monitoring and observability foundation for health visibility, troubleshooting, and cost/performance optimization.
Key Concepts
Metrics and Custom Metrics
CloudWatch auto-collects standard metrics like EC2 CPU utilization and ELB request counts. OS-level data such as memory or disk usage — not visible from the hypervisor — can be sent as custom metrics via the CloudWatch Agent or API. Metrics are aggregated as time series and visualized on dashboards.
Alarms and Automated Actions
Alarms evaluate metrics against thresholds and trigger SNS notifications, Auto Scaling actions, or EC2 actions when state changes. For example: scale out when CPU exceeds a threshold, scale in when it drops, or page on-call engineers on anomalies. Composite alarms combine multiple conditions.
CloudWatch Logs
Application and service logs stream to log groups and log streams with configurable retention. Logs Insights queries log data with a purpose-built query language. Metric filters count pattern occurrences and convert them to metrics for alarming. Long-term log archival exports to S3.
Relationship with EventBridge
Amazon EventBridge (evolved from CloudWatch Events) routes AWS service events and cron schedules to Lambda, SQS, and other targets. Powers event-driven automation: 'run a function at a fixed schedule,' 'react automatically to a specific resource change.'
vs. CloudTrail (Audit Logs)
CloudWatch handles performance and state monitoring — metrics and logs. CloudTrail records who called which API at what time — the audit log for security investigations and compliance. They serve different purposes; feeding CloudTrail events into CloudWatch Logs for analysis and alarming is common practice.
Typical Use Cases
- Collect and dashboard EC2, RDS, and Lambda metrics centrally
- Trigger Auto Scaling to add or remove instances based on CPU alarms
- Aggregate application logs in CloudWatch Logs and investigate with Logs Insights
- Send immediate notifications via SNS when thresholds are breached
- Schedule periodic jobs with EventBridge cron and automate operations
Exam Relevance
CloudWatch is core to SOA and appears in SAA and DVA for operations design. 'Monitor metrics and auto-scale → CloudWatch alarm + Auto Scaling,' 'aggregate and investigate logs → CloudWatch Logs/Logs Insights' are standard patterns. The most common trap: memory utilization and disk usage are not standard metrics — the CloudWatch Agent (custom metrics) is required, a frequent SOA question. The most critical comparison: 'CloudWatch = performance/state monitoring' vs. 'CloudTrail = API operation audit logs.' EventBridge for scheduled execution and event-driven automation is also regularly tested.
Related Services
References
Last updated: 2026-06-24
This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.