Skip to content
DRDiwakar Rai

NotesCloudWatch & CloudTrail

CloudWatch & CloudTrail

Observability and API audit — metrics, logs, alarms, trails, and the near-real-time alert pattern.

Updated Sep 26, 2026

CloudWatch & CloudTrail Quick Notes



CloudWatch

  • Metrics: Basic (5 min) vs detailed (1 min) on EC2.
  • Alarms: Threshold → action (SNS, ASG policy, EC2 recover, …).
  • Logs: Log groups / streams; retention and permissions matter.
  • Metric filters: Turn log patterns into metrics that feed alarms.
  • Agents: Ship guest OS / app logs (httpd, etc.) into CloudWatch Logs.

CloudTrail

  • API activity audit trail.
  • ~90 days in Event History by default; create a trail to send to S3 and/or CloudWatch Logs.
  • Management events vs data events (data events cost more / more granular).
  • IAM / STS / CloudFront produce global service events.
  • Not real-time — there is delivery delay.

Near-Real-Time Bad API Alerts

CloudTrail → CloudWatch Logs → metric filter (error codes)
→ CloudWatch alarm → SNS

  • Athena / QuickSight → reports, not immediate warnings.
  • Trusted Advisor service-limit checks ≠ illegal API detection.
  • ASG / ELB scaling often driven by CloudWatch metrics (CPU, ALB request count, SQS depth).
  • EC2 recover alarm for system-status failures on supported types.