On this page
On this page
- What Is CloudWatch
- Metrics — Resolution, Namespaces, and Dimensions
- Standard vs High-Resolution
- Namespaces and Dimensions
- CloudWatch Logs
- Structure
- Sources
- Logs Insights
- Metric Filters
- CloudWatch Alarms
- Alarm States
- Alarm Actions
- Composite Alarms
- Anomaly Detection
- CloudWatch Agent — OS-Level Metrics and Logs
- CloudWatch Synthetics (Canaries)
- Contributor Insights
- Cross-Account Observability
- EventBridge vs CloudWatch Alarms
- Key Exam Scenarios
- CloudWatch Integration
- Automatically Published (CloudWatch monitors itself)
- Requires Setup
CloudWatch
CloudWatch is AWS's observability platform. It collects metrics, logs, and traces from your AWS resources and applications, then lets you search, visualize, alert on, and automate responses to that data. If something goes wrong in your AWS environment, CloudWatch is where you look first.
The Three Pillars
Metrics are numeric measurements over time — CPU utilization, request count, error rate, queue depth. Every AWS service automatically publishes metrics to CloudWatch. You can also publish your own custom metrics from application code. Metrics feed dashboards and alarms.
Logs are the raw text output from your applications and AWS services. CloudWatch Logs stores and indexes them, lets you search with filter patterns, and lets you route log data to other services. Lambda functions, ECS tasks, and EC2 instances all send their logs here.
Alarms watch a metric over time and trigger an action when a threshold is crossed — send an SNS notification, scale an Auto Scaling Group up or down, stop an EC2 instance. Alarms are how CloudWatch connects observation to action.
CloudWatch = what is happening (high CPU) · Config = what changed in the setup (instance type modified) · CloudTrail = who did it (user "Admin_Bob" made the API call)
Why It Matters in Practice
Without CloudWatch, you're flying blind. You wouldn't know that your Lambda function's error rate jumped from 0.1% to 15% at 2 AM, that a DynamoDB table is being throttled, or that an EC2 instance has been running at 100% CPU for six hours. CloudWatch makes all of this visible and actionable without any additional infrastructure.
CloudWatch Agent
For EC2 instances and on-premises servers, the CloudWatch Agent is a small process you install that ships detailed OS-level metrics (memory, disk, network at the process level) and log files to CloudWatch. AWS's built-in EC2 metrics don't include memory usage — the agent fills that gap.
Logs Insights
CloudWatch Logs Insights is an interactive query engine for your log data. You write SQL-like queries to find errors, calculate latency percentiles, or count events across millions of log lines. It's the fastest way to answer "what exactly happened at 3:47 AM?" without setting up a separate log analytics platform.