Amazon CloudWatch
Amazon CloudWatch is a monitoring service that collects and correlates metrics, logs, and events from Amazon Web Services and on-premises resources so operators can visualize performance and react to problems. Metrics are the fundamental concept in CloudWatch — every other feature is built on top of the metric data it gathers from resources such as Amazon EC2, Amazon RDS, and Amazon DynamoDB. It works alongside Amazon Cloudtrail and AWS Identity and Access Management (IAM) to give a full picture of both resource health and account activity.
AI Practitioner focus
- CloudWatch observes metrics, logs, alarms, dashboards, and traces around AI applications: latency, errors, throttles, token/endpoint usage, drift alerts emitted by other services, and agent/runtime telemetry.
- CloudWatch shows operational behavior; AWS CloudTrail records API activity and Amazon Config records resource configuration/compliance state.
Key points
- Metrics — the fundamental concept in CloudWatch; time-ordered sets of data points (e.g. CPU usage on EC2, request count on API Gateway) collected from AWS resources, applications, and on-premises servers.
- Standard monitoring (basic) — enabled by default at no extra cost, reporting EC2 metrics such as CPU utilization, network I/O, and disk I/O at a 5-minute interval; detailed monitoring is an additional-cost opt-in that raises the interval to 1 minute. Memory utilization and disk space usage are not part of the default EC2 metrics — they require installing and configuring the CloudWatch agent on the instance.
- Alarms — CloudWatch Alarms watch a metric against a threshold or anomaly and trigger actions, e.g. sending an Amazon SNS notification if EC2 CPU stays above 80% for 5 minutes.
- Logs — collects, stores, and monitors log files from AWS services and applications (Lambda execution logs, VPC Flow Logs, custom app logs).
- Dashboards — customizable graphs and widgets that visualize metrics and logs, e.g. real-time CPU, memory, and disk usage.
- Events (Amazon EventBridge) — a CloudWatch feature that responds to AWS events in near real time and connects to your own apps and other targets, e.g. triggering Lambda on an EC2 state change.
- CloudWatch Synthetics — simulates user interactions to monitor application endpoints, such as pinging a website URL and checking response content and latency.
- CloudWatch Contributor Insights — analyzes high-cardinality log data to identify top contributors, e.g. the top IPs causing a traffic spike.
- CloudWatch Logs Insights — interactive, SQL-like queries over log data for troubleshooting, e.g. searching for errors in Lambda logs.
- CloudWatch Anomaly Detection — applies machine learning against metric data to automatically detect anomalies, e.g. alerting when network traffic deviates from normal patterns.
- CloudWatch Evidently — AWS discontinued CloudWatch Evidently effective October 17, 2025; the service is closed to all customers and no longer accessible. For feature-flag and gradual-rollout use cases, AWS recommends AWS AppConfig (a feature of AWS Systems Manager).
- CloudWatch Logs log classes — a log group is created as either the Standard class (full feature set: Logs Insights, Live Tail, metric filters, subscription filters, Container/Lambda Insights ingestion) or the lower-cost Infrequent Access class (ad hoc and forensic querying only, missing those real-time features); the class is fixed at log group creation and can’t be changed afterward.
- Container Insights and Lambda Insights — dashboards that summarize performance and errors for containers and Lambda functions over a selected time window.
- The CloudWatch Agent or API can be used to monitor hybrid cloud architectures, including on-premises servers.
- Integrates with Amazon SNS, Amazon EC2 Auto Scaling, Amazon Cloudtrail, and AWS Identity and Access Management (IAM); CloudTrail can deliver its events to a CloudWatch Logs log group so CloudWatch Alarms can trigger SNS notifications on specific API activity (e.g. security group changes) in near real time.
- Distinct from Amazon Config, which tracks resource configuration state and compliance over time rather than performance metrics.
- Can monitor estimated AWS charges: once enabled, billing data is calculated and pushed to CloudWatch as metric data several times daily, stored in the US East (N. Virginia) Region and representing worldwide account charges.