CloudWatch: metrics, logs, and alarms
CloudWatch is the central monitoring service. Every AWS resource publishes metrics to CloudWatch automatically: EC2 reports CPU utilization, network traffic, and disk I/O. RDS reports database connections, free storage, and read/write latency. Lambda reports invocation count, duration, and error rate. You can also publish custom metrics from your application code: business metrics like orders per minute or application metrics like queue depth.
CloudWatch Logs collects log files from EC2 instances (via the CloudWatch Agent), Lambda functions, API Gateway, VPC Flow Logs, and CloudTrail. Log groups organize related logs. Log streams are individual sources within a group. CloudWatch Logs Insights lets you run SQL-like queries against log data to analyze patterns, find errors, and extract statistics without shipping logs to a separate analytics tool.
CloudWatch Alarms watch a metric and trigger an action when the metric crosses a threshold: send an SNS notification, trigger an Auto Scaling action, or stop/terminate an EC2 instance. Composite alarms combine multiple alarms with AND/OR logic to reduce alert noise. CloudWatch Dashboards create visual panels of metrics from across multiple services and accounts in a single view.
X-Ray, EventBridge, and AWS Config
X-Ray provides distributed tracing for applications composed of multiple services. When a user request flows through API Gateway, through a Lambda function, into a DynamoDB table, and back, X-Ray tracks the entire path with timing for each segment. The service map visualizes which services are talking to each other and where latency is occurring. X-Ray is how you answer the question: this request took 800ms total, which part was slow?
EventBridge (formerly CloudWatch Events) is an event bus that connects AWS services, third-party SaaS applications, and your own applications. You define rules that match event patterns and route matching events to targets: Lambda functions, SQS queues, Step Functions workflows, ECS tasks. For example, a rule that fires when GuardDuty creates a finding of high severity and invokes a Lambda function to isolate the affected EC2 instance. EventBridge Scheduler creates scheduled invocations for recurring tasks.
AWS Config continuously records the configuration state of your AWS resources and evaluates them against rules you define. It answers the question: when did this security group change, and who changed it? Config rules detect non-compliant resources, such as S3 buckets with public access enabled or EC2 instances without encryption. Config is compliance and configuration history: not what is happening right now, but what changed and when.
How to choose the correct answer
CloudWatch Metrics: numeric time-series data from AWS services and custom sources. Alarms trigger actions on threshold breaches.
CloudWatch Logs: log file collection and querying. Logs Insights for ad-hoc analysis. Log groups and streams organize data.
X-Ray: distributed tracing across multiple services. Latency analysis, service maps, error debugging in microservices.
CloudTrail: API call audit log. Who called what API, when, from which IP. Security investigation and compliance audit.
EventBridge: event-driven reactions to AWS service events, scheduled tasks, SaaS integrations. Rule-based routing to targets.
AWS Config: resource configuration history and compliance evaluation. What changed, when, and is it compliant with rules.
CloudWatch vs CloudTrail: CloudWatch monitors performance and behavior. CloudTrail records who did what to your AWS resources.