Lesson 09 — Monitoring, Logging & Backup

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand the importance of monitoring and logging.
Configure Amazon CloudWatch.
Understand AWS CloudTrail.
Create CloudWatch Alarms.
Monitor EC2 health and performance.
Protect EC2 data using AWS Backup.
Apply enterprise monitoring and backup best practices.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Intermediate

Prerequisites: Lesson 08 – EC2 Hardening & Patch Management

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies now operates hundreds of production EC2 instances that power its learning platform.

One Monday morning, students begin reporting:

Website is slow.
Login failures.
Intermittent outages.

At the same time, the Security Operations Center (SOC) notices unusual API activity and high CPU utilisation on one application server.

The Cloud Security team must answer several questions:

Which server is affected?
What happened?
When did it happen?
Who made infrastructure changes?
Can the affected server be restored if required?

To answer these questions, CloudNova relies on:

Amazon CloudWatch
AWS CloudTrail
AWS Backup
Amazon EBS Snapshots

🤔 Why Monitoring Matters

Monitoring helps detect issues before they become outages.

Without monitoring:

Problem Occurs

↓

Nobody Notices

↓

Service Outage

↓

Customer Complaints

With monitoring:

Problem Occurs

↓

CloudWatch Detects

↓

Alarm Triggered

↓

Administrator Notified

↓

Issue Resolved

Enterprise Monitoring Architecture

                EC2 Instance

                     │

          CloudWatch Agent

                     │

          Amazon CloudWatch

      ┌──────────────┼──────────────┐
      │              │              │
   Metrics         Logs         Alarms

                     │

          Cloud Security Team

What is Amazon CloudWatch?

Amazon CloudWatch is AWS’s monitoring and observability service.

It collects:

Metrics
Logs
Events
Alarms
Dashboards

CloudWatch helps administrators understand the health of their AWS environment.

Common CloudWatch Metrics

Metric	Description
CPUUtilization	CPU usage
NetworkIn	Incoming network traffic
NetworkOut	Outgoing network traffic
DiskReadOps	Disk reads
DiskWriteOps	Disk writes
StatusCheckFailed	Instance health
Memory Usage*	Requires CloudWatch Agent
Disk Usage*	Requires CloudWatch Agent

What is the CloudWatch Agent?

The CloudWatch Agent runs on the EC2 instance and collects operating system-level metrics.

Examples:

Memory utilisation
Disk usage
Running processes
Custom application logs

Without the agent, CloudWatch only provides basic infrastructure metrics.

CloudWatch Dashboard

CloudNova’s operations dashboard displays:

Production EC2

↓

CPU Usage

↓

Memory Usage

↓

Disk Usage

↓

Network Traffic

↓

System Health

This provides a single view of infrastructure health.

CloudWatch Alarms

CloudWatch Alarms automatically notify administrators when thresholds are exceeded.

Example:

CPU > 80%

↓

CloudWatch Alarm

↓

Email Notification

↓

Cloud Security Team

Alarms can also trigger automated actions.

Common Enterprise Alarms

Alarm	Threshold
CPU Utilisation	>80%
Memory Usage	>85%
Disk Usage	>90%
Status Check Failed	1
Network Traffic Spike	Baseline exceeded

What is AWS CloudTrail?

CloudTrail records AWS API activity.

It answers questions such as:

Who launched an EC2 instance?
Who deleted a Security Group?
Who modified an IAM Role?
When was an EBS snapshot created?

CloudTrail focuses on AWS account activity, not operating system logs.

CloudTrail Architecture

Administrator

↓

AWS API

↓

CloudTrail

↓

Event History

↓

Amazon S3 (Optional Long-Term Storage)

Example CloudTrail Event

Event Name

RunInstances

↓

User

CloudAdmin

↓

Time

09:45 UTC

↓

Resource

CloudNova-App-Server-01

CloudTrail provides an audit trail for AWS operations.

CloudWatch vs CloudTrail

CloudWatch	CloudTrail
Infrastructure monitoring	AWS API auditing
Metrics	API events
Logs	User activity
Performance monitoring	Compliance & investigations
Operational visibility	Security visibility

Both services complement each other.

Why Backups Matter

Hardware failures, accidental deletions and ransomware can all lead to data loss.

Without backups:

Delete Server

↓

Data Lost

With backups:

Delete Server

↓

Restore Backup

↓

Business Continues

Backup Strategy

CloudNova follows the 3-2-1 backup principle:

Three copies of important data.
Two different storage types.
One copy stored separately.

AWS Backup simplifies centralised backup management.

What is AWS Backup?

AWS Backup is a managed service that automates backups for AWS resources.

Supported resources include:

Amazon EBS
Amazon EC2
Amazon RDS
Amazon DynamoDB
Amazon EFS
Amazon FSx

Backup Workflow

AWS Backup Plan

↓

Backup Vault

↓

Daily Backup

↓

Retention Policy

↓

Restore

Amazon EBS Snapshots

EBS Snapshots are point-in-time backups of EBS volumes.

Benefits:

Incremental backups
Encrypted snapshots
Cross-Region copy support
Fast restoration

Snapshots are commonly used before major operating system updates or application deployments.

CloudNova Backup Policy

Resource	Schedule
Production EC2	Daily
EBS Volumes	Daily
Critical Databases	Every 4 Hours
Backup Retention	30 Days
Monthly Archive	1 Year

🛠 Lab 01 — Review EC2 Monitoring

Navigate to:

EC2

↓

Instances

↓

CloudNova-App-Server-01

↓

Monitoring

Review:

CPU Utilisation
Network Traffic
Status Checks
Disk Operations

🛠 Lab 02 — Create a CloudWatch Alarm

Navigate to:

CloudWatch

↓

Alarms

↓

Create Alarm

Metric:

CPUUtilization

Threshold:

Greater than 80%

Evaluation:

5 Minutes

Create the alarm.

🛠 Lab 03 — Review CloudTrail Events

Navigate to:

CloudTrail

↓

Event History

Search for:

RunInstances

CreateVolume

CreateSnapshot

StopInstances

Review:

Event Time
User
Resource
API Call

🛠 Lab 04 — Install the CloudWatch Agent

Connect to the EC2 instance.

Install the agent:

sudo dnf install amazon-cloudwatch-agent -y

sudo yum install amazon-cloudwatch-agent -y

Verify:

sudo systemctl status amazon-cloudwatch-agent

🛠 Lab 05 — Create an EBS Snapshot

Navigate to:

EC2

↓

Volumes

↓

Actions

↓

Create Snapshot

Name:

CloudNova-Daily-Backup

Verify that the snapshot completes successfully.

🛠 Lab 06 — Create an AWS Backup Plan

Navigate to:

AWS Backup

↓

Backup Plans

↓

Create Backup Plan

Configure:

Setting	Value
Schedule	Daily
Start Time	02:00 AM
Retention	30 Days
Backup Vault	Default

Assign:

CloudNova-App-Server-01

🛠 Lab 07 — Restore a Snapshot (Simulation)

Navigate to:

Snapshots

↓

CloudNova-Daily-Backup

↓

Create Volume

Review the restore process.

Do not attach the restored volume unless required for testing.

💻 AWS CLI Lab

Describe CloudWatch Metrics

aws cloudwatch list-metrics

Create a CloudWatch Alarm

aws cloudwatch put-metric-alarm \
    --alarm-name HighCPU \
    --metric-name CPUUtilization \
    --namespace AWS/EC2 \
    --statistic Average \
    --period 300 \
    --threshold 80 \
    --comparison-operator GreaterThanThreshold \
    --evaluation-periods 1

View CloudTrail Events

aws cloudtrail lookup-events

Describe Snapshots

aws ec2 describe-snapshots \
    --owner-ids self

Create an EBS Snapshot

aws ec2 create-snapshot \
    --volume-id vol-xxxxxxxx \
    --description "CloudNova Daily Backup"

List Backup Plans

aws backup list-backup-plans

✅ Verification

Verify:

✔ CloudWatch metrics available.

✔ CloudWatch Alarm created.

✔ CloudTrail records AWS API activity.

✔ CloudWatch Agent installed and running.

✔ EBS Snapshot completed.

✔ AWS Backup Plan created.

✔ Backup resources assigned correctly.

🔍 Troubleshooting

Problem

CloudWatch metrics missing.

Check:

EC2 instance is running.
CloudWatch Agent installed.
IAM Role permissions.
Correct AWS Region.

Problem

CloudWatch Alarm never triggers.

Verify:

Metric selected correctly.
Threshold configured appropriately.
Evaluation period.

Problem

CloudTrail shows no events.

Check:

Correct AWS Region.
Event filters.
CloudTrail configuration.

Problem

Backup fails.

Review:

IAM permissions.
Backup Vault configuration.
AWS Backup service role.
Resource assignment.

🏢 Enterprise Best Practices

CloudNova standards:

Monitor every production EC2 instance.
Install the CloudWatch Agent on all servers.
Configure proactive CloudWatch Alarms.
Enable CloudTrail in all AWS Regions.
Protect backups with encryption.
Test backup restoration regularly.
Review dashboards daily.
Monitor unusual API activity.
Apply retention policies to logs and backups.

🚫 Common Mistakes

❌ Assuming EC2 is healthy without monitoring.

❌ Creating backups but never testing restores.

❌ Ignoring CloudWatch Alarms.

❌ Disabling CloudTrail.

❌ Leaving backup jobs unmanaged.

❌ Failing to monitor disk usage.

❌ Not protecting backup data with encryption and appropriate access controls.

🧪 DIY Challenge

Implement enterprise monitoring for a second EC2 instance.

Requirements:

CloudWatch Agent installed.
CPU Alarm (>80%).
Disk Usage Alarm (>90%).
Daily AWS Backup Plan.
Manual EBS Snapshot.
CloudTrail Event Review.

Tasks:

Verify CloudWatch metrics.
Create two CloudWatch Alarms.
Review CloudTrail events for the instance.
Perform a manual snapshot.
Assign the instance to the backup plan.
Document the recovery process from the latest snapshot.

Capture screenshots of:

CloudWatch Dashboard
CloudWatch Alarms
CloudTrail Event History
Backup Plan
Backup Vault
EBS Snapshot
AWS CLI outputs

📊 Knowledge Check

What is Amazon CloudWatch?
What is the purpose of the CloudWatch Agent?
What is the difference between CloudWatch and CloudTrail?
Why are CloudWatch Alarms important?
What information does CloudTrail record?
What is an EBS Snapshot?
What is AWS Backup used for?
Why should organisations regularly test backup restoration?
Which AWS CLI command lists CloudTrail events?
How do monitoring, logging and backups improve the security and resilience of an organisation?

💡 Key Takeaways

After completing this lesson, you should understand:

Amazon CloudWatch provides visibility into the health and performance of EC2 instances through metrics, logs, dashboards and alarms.
AWS CloudTrail records AWS API activity, supporting auditing, compliance and security investigations.
Amazon EBS Snapshots and AWS Backup protect business-critical data and enable recovery from failures or accidental changes.
Effective monitoring, logging and backup strategies reduce downtime, improve incident response and strengthen operational resilience.
Enterprise environments should continuously monitor systems, retain audit logs, automate backups and regularly test recovery procedures.

🚀 Next Lesson

➡️ Lesson 10 — Enterprise EC2 Architecture