Alerting and dashboards

Exam tasks: 1.1 (skills 1.1.1, 1.1.2 and 1.1.4: monitoring requirements, health checks, metrics, alerts and dashboards)

The decision: is the signal a line in a log, a number crossing a threshold, or an event some AWS service emits, and who needs to hear about it, how fast, and through which channel?

Picking the alerting mechanismCopy Anchor Link

CloudWatch metric filters and alarmsCopy Anchor Link

The classic pattern for "alert when someone does X": send the organization trail to a CloudWatch Logs log group, add a metric filter, and alarm on the metric.

{ ($.eventName = "DeleteTrail") || ($.eventName = "StopLogging") || ($.eventName = "PutEventSelectors") }

• A filter that matches increments a custom metric (for example Security/TrailTampering). An alarm with threshold 1 over 1 period sends to SNS.
• Typical security filters: root user activity, console sign-in without MFA, IAM policy changes, security group or NACL changes, KMS key disable or scheduled deletion, UnauthorizedOperation and AccessDenied bursts.
• Metric filters aren't retroactive. For "how often did this happen last month", query the logs with Logs Insights or Athena instead.
• Alarm states are OK, ALARM and INSUFFICIENT_DATA. For event counters, set missing data to notBreaching, otherwise quiet periods leave the alarm in INSUFFICIENT_DATA.
• Anomaly detection alarms learn a band from history. Use them for "unusual volume" when there's no fixed threshold, such as GetObject calls per hour.
• Composite alarms combine alarms with AND/OR to page only when several symptoms agree.
• CloudWatch Logs anomaly detection flags new or unusual log patterns without writing filters.

EventBridge rulesCopy Anchor Link

{
  "detail": {
    "severity": [{ "numeric": [">=", 7] }],
    "type": [{ "prefix": "CryptoCurrency:" }]
  },
  "detail-type": ["GuardDuty Finding"],
  "source": ["aws.guardduty"]
}

• Security services publish to the default event bus in the Region where the finding is. GuardDuty, Security Hub CSPM and Macie administrator accounts also receive their members' findings.
• For one central queue, add a rule in each Region that forwards to a central event bus in the security account. The target bus needs a resource policy allowing the source accounts or the organization (aws:PrincipalOrgID).
• Use an input transformer to turn raw JSON into a readable message before it reaches SNS or chat.
• Each target has a retry policy (by default up to 24 hours) and an optional dead-letter queue. Failures show in the rule's FailedInvocations metric.
• CloudTrail-based events (AWS API Call via CloudTrail) require a trail with logging on. Read-only calls (Get*, List*, Describe*) are only matched by rules in the state ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS.

AWS User NotificationsCopy Anchor Link

• One place to configure and read notifications from AWS services. AWS managed notifications (Health, billing) arrive by default; user-configured notifications are rules you create on EventBridge events and CloudWatch alarms.
• Channels: Console Notifications Center, email, Amazon Q Developer in chat applications (Slack, Microsoft Teams, Amazon Chime), and AWS Console Mobile App push.
• With AWS Organizations trusted access, the management account or a delegated administrator can create notification configurations for the whole organization or chosen OUs. Notifications appear only in the admin account, and they're kept for 90 days.
• Aggregation (within 5 minutes, within 12 hours, or none) groups related events to cut noise.

Health checks and AWS-side signalsCopy Anchor Link

Skill 1.1.2 asks for resource health checks as part of monitoring.

AWS Health

• Events go to EventBridge as source: aws.health, so you can auto-remediate, for example rotate a key when AWS reports it exposed.
• Organizational view aggregates events for every account in the management account or a delegated administrator. Events stay for 90 days.
• The AWS Health API needs a Business, Enterprise On-Ramp or Enterprise support plan. The dashboard and EventBridge events are available to everyone.

Trusted Advisor

• Every account gets a core set of security checks. The full set, the API and organizational view need Business support or higher.
• Trusted Advisor also surfaces Security Hub CSPM FSBP control results, so enable both instead of choosing.
• Check status changes are published to EventBridge in us-east-1.

DashboardsCopy Anchor Link

Amazon Managed Grafana

• A workspace is a managed Grafana server. Users sign in through IAM Identity Center or SAML, never IAM users, and get the Admin, Editor or Viewer role.
• Data sources include CloudWatch, Athena, OpenSearch Service, Amazon Managed Service for Prometheus, X-Ray and Timestream. In Organizations mode, the workspace can read data sources in member accounts through roles it creates.
• Connect it to private data sources through VPC configuration, and restrict who can reach the workspace with network access control.

ScenariosCopy Anchor Link

Further readingCopy Anchor Link

• Creating metrics from log events using filters
• Amazon EventBridge event patterns
• What is AWS User Notifications?
• Aggregating AWS Health events across accounts