Monitoring and Management Tools

The AWS management and monitoring tools give you visibility into how your resources perform, who did what, and whether your account follows best practices. The CLF-C02 exam loves to test whether you can pick the right tool for a scenario — especially the classic split between CloudWatch (performance) and CloudTrail (audit history). Learn each tool's one-line job and the distinctions below become easy points.

Core Idea

• CloudWatch = performance monitoring. It collects metrics, logs, alarms, and dashboards that answer "how is my system doing right now?"
• CloudTrail = audit history. It records API calls to answer "who did what, when, and from where?"
• Config = configuration and compliance over time, while Trusted Advisor = automated best-practice checks across five categories.

Amazon CloudWatch

CloudWatch is the central observability service for monitoring performance and operational health.

• Metrics are time-ordered data points (CPU utilization, network traffic, request counts). Many AWS services publish metrics automatically; you can also push custom metrics.
• Alarms watch a metric against a threshold and take action — send an SNS notification, trigger EC2 Auto Scaling, or stop/reboot an instance.
• CloudWatch Logs centralizes log files from EC2, Lambda, and other sources so you can search and set metric filters on them.
• Dashboards give a single visual view of metrics across regions and services.
• CloudWatch Events / EventBridge react to state changes in near real time.

Remember: memory usage is not a default EC2 metric — it needs the CloudWatch agent.

AWS CloudTrail

CloudTrail records API activity across your account for governance, compliance, and auditing. Every action — through the console, CLI, or SDK — is logged as an event showing who made the call, what action, when, and the source IP.

• Events can be delivered to an S3 bucket for long-term retention and to CloudWatch Logs for analysis.
• The last 90 days of management events are viewable in Event history by default; create a trail to store more.
• Use CloudTrail to answer "Who terminated that instance?" or "Who changed this security group?"

AWS Config

AWS Config continuously tracks resource configurations and evaluates them against rules over time.

• It records a configuration timeline so you can see how a resource looked at any past point and what changed.
• Config rules flag resources that drift from a desired state (for example, "flag any S3 bucket that is publicly readable" or "all EBS volumes must be encrypted").
• Its focus is compliance and change management, not performance.

AWS Trusted Advisor

Trusted Advisor runs automated best-practice checks and gives recommendations across five categories:

• Cost Optimization — idle or underused resources you could downsize or stop.
• Security — open ports, exposed access keys, MFA on the root account.
• Fault Tolerance — backups, Multi-AZ, redundancy.
• Performance — over-utilized instances, service configuration.
• Service Limits (Quotas) — usage approaching account limits.

Basic and Developer support get a limited set of checks; Business, Enterprise On-Ramp, and Enterprise support unlock the full set of checks.

AWS Health Dashboard and Systems Manager

• AWS Health Dashboard shows the status of AWS services (Service health) and personalized alerts about events affecting your specific resources (Your account health) — planned maintenance, degradations, and outages.
• AWS Systems Manager provides operational management of resources at scale: run commands, patch fleets, store configuration data, and manage instances without SSH via Session Manager. Think "operate and automate managed instances."

High-Yield Exam Patterns

• "Who made this API call / who deleted a resource?" → CloudTrail.
• "Monitor CPU / trigger an alarm / collect logs / view metrics" → CloudWatch.
• "Track configuration changes over time / check compliance against rules" → AWS Config.
• "Reduce cost, close security gaps, or check service limits automatically" → Trusted Advisor.
• "See if an AWS service outage is affecting my resources" → AWS Health Dashboard.
• Full Trusted Advisor checks require Business or Enterprise support, not Basic.

Common Traps to Avoid

• Do not swap CloudWatch and CloudTrail — performance monitoring is CloudWatch; API/audit history is CloudTrail.
• Do not confuse Config (configuration and compliance) with CloudTrail (API activity); Config tracks state, CloudTrail tracks actions.
• EC2 memory and disk usage are not default CloudWatch metrics — the CloudWatch agent is required.
• Trusted Advisor gives recommendations only; it does not automatically remediate.