
Episode 15: Monitoring & Observability - CloudWatch, CloudTrail & AWS Config | Interactive Format | SAA-C03
Master CloudWatch, CloudTrail & AWS Config! NEW interactive format with Pulse Checks, Trap Spotlights & Memory Hooks for active recall. 🆕 NEW INTERACTIVE FORMAT 🎯 PULSE CHECKS - Quick questions with real pauses (test yourself!) ⚠️ TRAP SPOTLIGHTS - Exam traps highlighted when topic is fresh 💡 MEMORY HOOKS - Vivid analogies that stick Active recall = 2-3x better retention than passive listening! 📈 CLOUDWATCH METRICS Every AWS service publishes metrics automatically. Metrics belong to namespaces, with dimensions identifying specific resources. CRITICAL: AWS doesn't track RAM by default! CPU/network/disk = yes. Memory/disk-inside-filesystem = NO. For RAM, install the CloudWatch Unified Agent. Memory hook: AWS sees your VM from OUTSIDE, not inside. Metric Streams push metrics to Datadog, Splunk, S3 via Kinesis Firehose. 📜 CLOUDWATCH LOGS Structure: Log Groups → Log Streams. Retention 1 day to 10 years (or forever). Encrypted by default; KMS optional. SOURCES: • EC2/on-prem: CloudWatch Logs Agent or Unified Agent • Lambda, ECS, API Gateway, Route 53, VPC Flow Logs: Native • CloudTrail: Filter-based THREE WAYS TO USE LOGS: • INSIGHTS: Query historical logs (librarian) • SUBSCRIPTIONS: Real-time stream to Kinesis/Lambda (journalist) • S3 EXPORT: Bulk archival, up to 12-hour delay (moving truck) TRAP: S3 Export is NOT real-time! For real-time, use Subscriptions. 🚨 CLOUDWATCH ALARMS States: OK, ALARM, INSUFFICIENT_DATA. Actions: EC2 (stop/terminate/reboot/RECOVER), Auto Scaling, SNS notifications. EC2 Recovery: System status check fails → instance moved to new hardware. Memory hook: System = AWS's problem, Instance = Your problem. COMPOSITE ALARMS: Combine alarms with AND/OR to reduce alarm noise. METRIC FILTERS: Convert log patterns into alarms. 🔍 AWS CLOUDTRAIL Enabled by DEFAULT! Records WHO did WHAT, WHEN, FROM WHERE. EVENT TYPES: • Management events (default ON): Resource operations • Data events (default OFF): S3 object access, Lambda invocations • Insights events: Anomaly detection 90-DAY RETENTION in CloudTrail. For longer, log to S3 + query with Athena. If a resource is unexpectedly deleted → check CloudTrail FIRST! Pattern: CloudTrail + EventBridge = Real-time security alerts. 📋 AWS CONFIG Tracks resource configurations over TIME. Per-region, can aggregate cross-region/account. CONFIG RULES: 75+ managed rules + custom Lambda rules. Evaluate on change or schedule. TRAP: Config DETECTS, doesn't PREVENT! For prevention use IAM/SCPs. Memory hook: Config = camera, not door lock. Auto-remediation via SSM Automation Documents. 🎯 CLOUDWATCH vs CLOUDTRAIL vs CONFIG (most-tested!) CLOUDWATCH = Performance ("How fast? Is it healthy?") CLOUDTRAIL = Audit ("Who? When? From where?") CONFIG = Compliance ("What does it look like? Compliant?") Same ALB, three stories: • CloudWatch: Connection metrics, error % over time • CloudTrail: Who modified the listener config? • Config: Is the SSL cert always assigned? ⚠️ TOP EXAM TRAPS 1. Three-service distinction (Performance/Audit/Compliance) 2. RAM needs Unified Agent (not default) 3. CloudTrail enabled by default 4. CloudTrail 90-day retention (use S3 for longer) 5. Data events NOT logged by default (S3, Lambda) 6. Config DETECTS, doesn't PREVENT 7. S3 Export NOT real-time (12-hr delay) 8. System vs Instance status check (recovery vs no help) 9. Composite alarms reduce noise (AND/OR) 10. EventBridge = CloudWatch Events 11. Insights = query engine, Subscriptions = real-time Perfect for SAA-C03 prep and real-world AWS operations! #AWS #CloudWatch #CloudTrail #AWSConfig #Monitoring #SAAC03 #SolutionsArchitect ⭐ 5-star rating if this helps!