Amazon CloudWatch

Management & Governance

Monitoring and observability service that collects metrics, logs, and events from AWS resources and applications.

Verified against AWS documentation · 2026-08-27

Key facts

  1. 01Three pillars: Metrics (numbers over time), Logs (text streams), Alarms (act on thresholds)
  2. 02Metrics retention rolls up: 1-min data kept 15 days, 5-min for 63 days, 1-hr for 15 months — old detail is gone forever
  3. 03EC2 basic monitoring is 5-min intervals free; detailed monitoring is 1-min and costs extra
  4. 04Alarms have three states: OK, ALARM, INSUFFICIENT_DATA — and can trigger SNS, Auto Scaling, or EC2 actions
  5. 05Memory and disk usage on EC2 are NOT default metrics — need the CloudWatch Agent (classic exam trap)
  6. 06Logs never expire by default — retention is configurable per log group from 1 day to 10 years

Exam triggers

Phrases and scenarios that point here.

  • "Monitor", "metric", "threshold", "alert when CPU exceeds" → CloudWatch Alarms
  • "Scale when..." → CloudWatch Alarm triggering an Auto Scaling policy
  • Track memory/disk on EC2 → CloudWatch Agent, not default metrics
  • Centralize application logs across instances → CloudWatch Logs
  • "Search logs with a query language" → CloudWatch Logs Insights
  • Custom app metric (queue depth, active users) → PutMetricData custom metric

Not this service

  • Who did what — API call audit trail → CloudTrail
  • Resource configuration history and compliance → AWS Config
  • Distributed request tracing across microservices → X-Ray
  • React to resource state changes and route events → EventBridge

Use cases

  1. 01Alarm on a payment API's p99 latency so the on-call engineer hears about slowness before customers tweet about it
  2. 02Auto Scaling a fleet of web servers off CPU utilization during a ticket-sale launch, then scaling back in overnight
  3. 03Shipping application logs from 40 ECS tasks into one log group, then using Logs Insights to find every 5xx in the last hour
  4. 04Publishing a custom 'orders stuck in pending' metric and alarming when it climbs — a business signal AWS metrics can't see
  5. 05Billing alarm on estimated charges so a forgotten sandbox NAT Gateway doesn't quietly eat the month's budget

How it's charged

  1. 01Metrics: AWS default metrics are free; custom metrics and detailed monitoring are charged per metric per month, tiered down with volume
  2. 02Logs are charged twice: per GB ingested (the big one) and per GB-month stored — ingestion typically dominates the bill
  3. 03Logs Insights queries charged per GB of data scanned
  4. 04Alarms charged per alarm metric per month; high-resolution, anomaly detection, and composite alarms cost more
  5. 05Dashboards: 3 free, then charged per dashboard per month
  6. 06Free tier covers small workloads: 10 custom metrics, 10 alarms, 5 GB logs, 3 dashboards

Commonly confused with

AWS CloudTrailManagement & GovernanceAWS ConfigManagement & GovernanceAWS X-RayDeveloper ToolsAmazon EventBridgeApplication Integration

References