Learn
AWS
Management & governance
CloudWatch

AWSGCP laterAzure later

CloudWatchAmazon CloudWatch

Management & governanceCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

Metrics, logs, alarms and dashboards for your AWS resources and applications, with alarms that notify people or act on their own.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDDeveloper – AssociateHIGHSysOps Administrator – AssociateHIGHSecurity – SpecialtyMEDData Engineer – AssociateMED

Where CloudWatch takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

Knowing how everything is doing

Amazon CloudWatch monitors your AWS resources and the applications you run on them. Many AWS services send it basic metrics automatically and at no charge; you can add your own metrics, collect logs, chart both on dashboards, and set alarms on them.

Alarms act. An alarm watches a metric against a threshold. When its state changes and holds, it can notify an SNS topic, run an Auto Scaling policy, or take an EC2 action, such as stopping an instance that sits idle.

Reach for it when

you must know when CPU, errors or latency cross a line
Auto Scaling should add instances as load rises
logs from many servers belong in one place, searchable
an error in the logs should raise an alarm

It is the wrong tool when

you need to know who called which API, and when: that is CloudTrail
you want memory use inside an instance with nothing installed: the CloudWatch agent has to collect it

Mental model

The monitors on a hospital ward

The monitors on a hospital ward. Each patient is wired to a screen showing pulse and oxygen minute by minute, and the nurses' station sees every screen at once. A reading that stays out of range for long enough, not a single blip, sets off an alarm that pages a doctor, or starts a drip by itself.

A reading on the screena value tracked over timeMetric

Which patient, which bedname-value pairs that identify itDimension

The nurses' stationmany metrics on one screenDashboard

The alarm that pages a doctora threshold breached for long enoughAlarm

The notes in the patient's charttext records, searchable laterLogs

An extra sensor taped onsoftware that collects more from insideCloudWatch agent

How it works

Metrics in, alarms out

Metrics arriveEC2, EBS, RDS and many other services send metrics on their own; EC2 every 5 minutes by default, or every minute with detailed monitoring.
Add what is missingThe CloudWatch agent collects memory, disk and process metrics and log files from inside EC2 instances and on-premises servers.
Set an alarmA threshold, a period, and how many periods must breach before the alarm changes state.
Act on the changeNotify an SNS topic, run an Auto Scaling policy, or take an EC2 action.

EC2 basic monitoring: Every 5 minutesno charge; status checks every minute
Detailed monitoring: Every minutecharged per metric
High resolution: 1 secondfor custom metrics
Metrics kept: 15 monthsrolled up as they age
Logs kept: Foreverby default; or 1 day to 10 years
Alarm states: ThreeOK, ALARM, INSUFFICIENT_DATA

The metric
Is CloudWatch receiving it? Memory use inside an instance arrives only if the CloudWatch agent sends it.
The period
Is the alarm's period at least the metric's resolution? Basic EC2 metrics arrive every 5 minutes.
Breaching long enough
Have enough of the evaluation periods breached the threshold, not just one spike?
The action
The state changed and held, so the alarm runs its actions: an SNS notification, an Auto Scaling policy or an EC2 action.

Pick a case to follow the alarm through each check.

Architecture

One place for every signal

Metrics and logs arrive from the servers, the database and CloudTrail; alarms notify the team, and a subscription filter streams logs on to S3.

Every signal in one service. The web servers' agent sends memory, disk and the application's logs; RDS sends its metrics on its own; CloudTrail can send API activity to a log group.

Alarms on API activity. With CloudTrail events in CloudWatch Logs, a metric filter can count a particular call and an alarm can tell the team when it happens.

Logs leave as they arrive. A subscription filter routes matching log events on to other services, such as S3 or Data Firehose, in real time.

Security

Protecting what you collect

Logs are encrypted both in transit and at rest.

Mask what is sensitive. Data protection policies audit sensitive data in log events and mask it.

Keep logs as long as the rules say. Retention is set per log group, from 1 day to 10 years, or never expiring; deletion protection stops an important log group being deleted by mistake.

Watch many accounts from one. Cross-account observability links source accounts to a central monitoring account, which can see their metrics, logs and traces.

Cost

How you are charged, not what it costs today

The free tier covers basic monitoring metrics from AWS services, 10 custom metrics, 10 alarm metrics, 3 dashboards, 5 GB of log data and 1 million API requests.

Custom metrics and detailed monitoring are charged per metric; the agent's metrics count as custom metrics.

Alarms and dashboards are charged by the hour, and high-resolution alarms cost more.

Logs are charged for ingestion and storage by the GB, and Logs Insights queries by the data they scan; the Infrequent Access log class lowers the ingestion charge.

Prices change, so none are printed here. Check the CloudWatch pricing page on aws.amazon.com.

Comparison

Behaviour against audit, and how long data lasts

Service	Answers	Choose it when
CloudWatch	How are my resources and applications behaving?	Watching behaviour and alarming on it
CloudTrail	Who did what in my account, and when?	Auditing the API calls made to AWS

EC2 monitoring	Period	Charged
Basic	5 minutes; status checks every minute	No
Detailed	1 minute	Per metric

Data points with a period of	Kept for
Under 60 seconds	3 hours
1 minute	15 days
5 minutes	63 days
1 hour	455 days, about 15 months

SAA traps

The phrase in the question, and what it means

monitor memory utilisation of EC2 instancesThe CloudWatch agent

EC2 does not send memory use from inside the instance by itself.

EC2 metrics every minuteDetailed monitoring

Basic monitoring sends them every 5 minutes.

alarm on an error message in the application logsA metric filter, then an alarm

The filter turns matching log lines into a metric, from the moment it is created.

fewer, more meaningful alarmsA composite alarm

It goes into ALARM only when its rule over other alarms is met.

keep application logs for exactly one yearSet the log group's retention

By default, logs never expire.

send logs to S3 or Firehose as they arriveA subscription filter

It routes log events to other services in real time.

sub-minute metrics from an applicationHigh-resolution custom metrics

Stored at 1-second resolution; alarms on them can use 10 or 30 seconds.

find out who deleted a bucketCloudTrail, not CloudWatch

CloudWatch measures behaviour; CloudTrail records API calls.

stop EC2 instances that sit idleAn alarm with an EC2 action

An alarm can stop an instance when a metric stays low.

monitor several accounts from one placeCross-account observability

A central monitoring account views the metrics, logs and traces of the others.

Scenario

Exam style, marked when you answer

An operations team runs web servers on EC2 in an Auto Scaling group. The team must be emailed when memory use on any server stays above 85 percent for 15 minutes, and error lines from the application logs must be searchable in one place. What should a solutions architect do?

Practice

Fill the gap, the way the challenges work

Web servers send their memory use every minute. When it stays above 85 percent for 10 minutes, the on-call engineer must get an email. What watches the metric and sends the notification?

EC2 Auto Scaling· Web servers, with the agentPick a service belowSNS· On-call email

Quick revision

The night before the exam

What: Metrics, logs, alarms and dashboards.
EC2 metrics: Every 5 minutes, or every 1 with detailed monitoring.
Agent: Memory, disk, processes and log files from inside servers.
Alarms: OK, ALARM, INSUFFICIENT_DATA; act on sustained changes only.
Actions: SNS, Auto Scaling, EC2 actions.
Logs: Log groups that never expire by default; query with Logs Insights.
Metric filter: Log lines become a metric, from creation onwards.
Retention: Metrics for up to 15 months, rolled up as they age.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.