Skip to content
R&D

AWS Management Services — CloudWatch, CloudTrail, CloudFormation, Config, Systems Manager

The five “cloud”-named services in the AWS management/observability group.

One-liners

Section titled “One-liners”
CloudWatch     = metrics/monitoring — like Grafana/Prometheus role (metrics, logs, alarms, dashboards)
CloudTrail     = audit log of API CALLS — who did what, when, from where (security camera of AWS)
CloudFormation = AWS's Terraform — infrastructure as code from templates (AWS-only)
Config         = resource config history + compliance rules (drift detection)
Systems Manager = ops toolbox at scale — patch, run commands, session shell, Parameter Store

Detail

Section titled “Detail”

CloudWatch — “what’s happening NOW”

  • Metrics (CPU, mem, latency), Logs, Alarms (threshold → SNS → notify/scale), Dashboards
  • Real-time health monitoring

CloudTrail — “who did WHAT” (audit)

  • Every API call recorded: IAM user/role, action, time, source IP
  • alice called ec2:TerminateInstances at 14:03 from 1.2.3.4
  • Default 90 days console; extend to S3 for retention. Security/forensics/compliance.
  • NOT telemetry — telemetry = CloudWatch (performance data). CloudTrail = action log.

CloudFormation — infra as code

  • JSON/YAML template → AWS provisions whole stack (EC2+VPC+RDS+IAM)
  • Versioned in git, reviewed like code, rollback on failure
  • vs Terraform: CloudFormation AWS-only; Terraform multi-cloud (HCL)

Config — config history + compliance

  • Records resource state changes over time (t3.micro → t3.large at 15:00)
  • Rules: “all S3 private”, “all EBS encrypted” → compliant/non-compliant
  • Drift detection, compliance audits (SOC2/PCI)

Systems Manager — ops toolbox

  • Run Command (scripts on 1000s of EC2, no SSH)
  • Patch Manager (auto-patch OS), Session Manager (browser shell, no open ports)
  • Parameter Store (config/secrets — free tier of Secrets Manager), Inventory, State Manager

The 3 confusing ones

Section titled “The 3 confusing ones”
CloudWatch CloudTrail Config
Question Healthy NOW? WHO did WHAT? Current config OK?
Data Metrics/logs API call records Resource state history
Use Ops monitoring Security audit Compliance

Scenario: EC2 dies → CloudWatch (CPU spike?) + CloudTrail (who terminated?) + Config (what was it before?)

Exam phrase match

Section titled “Exam phrase match”
  • “monitor CPU utilization” → CloudWatch
  • “audit who deleted S3 bucket” → CloudTrail
  • “deploy infra from template” → CloudFormation
  • “ensure buckets encrypted (compliance)” → Config
  • “run script on 100 EC2 without SSH” → Systems Manager
Section titled “Related”
  • [[aws/index]]
  • [[aws/compute-map/index]]