Lesson 04 — Amazon CloudWatch Logs, Metrics, Dashboards & Enterprise Monitoring Architecture

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 13 – Enterprise Security Operations, Logging, Monitoring & Threat Detection

🎯 Lesson Objectives

By the end of this lesson, you will be able to:

Explain Amazon CloudWatch architecture.
Understand CloudWatch Logs.
Understand Metrics.
Understand Dashboards.
Configure Alarms.
Configure Composite Alarms.
Configure Metric Filters.
Query logs using CloudWatch Logs Insights.
Understand CloudWatch Events.
Integrate CloudWatch with EventBridge.
Monitor enterprise workloads.
Build SOC dashboards.
Design enterprise monitoring architecture.
Monitor cloud security controls.
Detect operational anomalies.
Integrate CloudWatch with Security Operations.
Build enterprise alerting strategies.
Design enterprise monitoring governance.
Secure CloudWatch.
Apply CloudWatch best practices.

📚 Lesson Information

Area	Details
Estimated Time	8–10 Hours
Difficulty	Advanced
Prerequisites	Lesson 03 – AWS CloudTrail Enterprise Logging
Hands-on Labs	Yes
AWS Services	CloudWatch, CloudTrail, EventBridge, SNS, Lambda, Systems Manager

💼 Business Scenario

CloudNova Technologies has successfully centralised CloudTrail logging across all AWS accounts.

However, security teams still struggle to detect incidents quickly.

Current challenges include:

No central monitoring dashboards.
Critical EC2 instances not monitored.
Failed logins go unnoticed.
CPU spikes are detected hours later.
Security logs are collected but not analysed.
No CloudWatch Alarms for security events.
Metric Filters are not configured.
Logs are difficult to search during investigations.
Different business units create inconsistent dashboards.
Alert fatigue due to poor alarm configuration.
No standard naming convention.
Limited visibility into production workloads.

During a ransomware simulation, CloudNova discovers that although all API calls were recorded in CloudTrail, nobody noticed suspicious behaviour until several hours later.

The CISO asks:

“How can we transform raw logs into actionable alerts and real-time operational visibility across our AWS environment?”

1. Introduction to Amazon CloudWatch

Cover:

What is CloudWatch?
Why CloudWatch matters.
Monitoring vs Logging.
Operational monitoring.
Security monitoring.
Business monitoring.

2. CloudWatch Architecture

Explain:

Metrics
Logs
Dashboards
Alarms
Composite Alarms
Metric Filters
Logs Insights
Events
Agent
Contributor Insights
Application Insights
Anomaly Detection

Architecture Diagram

AWS Resources

↓

CloudWatch Agent

↓

CloudWatch Logs

↓

Metrics

↓

Metric Filters

↓

CloudWatch Alarms

↓

SNS / EventBridge

↓

SOC

↓

Incident Response

3. CloudWatch Components

Explain:

Metrics
Namespaces
Dimensions
Logs
Log Groups
Log Streams
Dashboards
Alarms
Insights
Events
Contributor Insights

4. CloudWatch Logs

Topics:

Log Groups
Log Streams
Retention
Encryption
Subscription Filters
Cross-account logging
Enterprise logging strategy

5. CloudWatch Metrics

Explain:

Standard Metrics
Custom Metrics
Dimensions
Statistics
Aggregation
Resolution
High-resolution metrics

6. CloudWatch Dashboards

Enterprise dashboards for:

SOC
Operations
Executive Management
Security Team
DevOps Team
Cloud Engineering

7. CloudWatch Alarms

Cover:

Static Thresholds
Dynamic Thresholds
Alarm States
SNS Notifications
Lambda Actions
Auto Scaling
Systems Manager Automation

8. Composite Alarms

Explain:

Alarm correlation
Noise reduction
Enterprise alerting
Operational examples

9. Metric Filters

Create metrics from:

CloudTrail
Application Logs
Authentication Logs
Security Events
API Activity

Enterprise examples:

Console login failures
Root account usage
IAM policy changes
Security group modifications
CloudTrail stopped

10. CloudWatch Logs Insights

Topics:

Query language
Search
Filter
Parse
Stats
Time-series analysis
Investigation examples

11. Contributor Insights

Explain:

Top users
Top IP addresses
Most active services
Security use cases
Performance use cases

12. Anomaly Detection

Cover:

Machine-learning baseline
Dynamic thresholds
False positives
Enterprise monitoring

13. Enterprise Monitoring Strategy

Monitor:

Identity
Compute
Network
Storage
Databases
Containers
Serverless
Applications
Security Services

14. CloudWatch Security Monitoring

Monitor:

Failed console logins
Root usage
IAM changes
Security group modifications
KMS events
CloudTrail health
Config failures
GuardDuty findings

15. Enterprise Dashboards

Create dashboards for:

SOC Operations
Cloud Operations
Security Management
Executive KPIs
Compliance
Incident Response

16. CloudWatch Governance

Govern:

Naming
Retention
Encryption
Access
Dashboards
Alarm ownership
Documentation
Cost optimisation

17. CloudWatch Threat Model

Threats include:

Deleted log groups
Disabled alarms
Missing metrics
Alarm suppression
Unauthorised dashboard changes
Excessive permissions
Log tampering

18. Enterprise CloudWatch Architecture

AWS Accounts

↓

CloudWatch Agent

↓

CloudWatch Logs

↓

Metrics

↓

Metric Filters

↓

CloudWatch Dashboards

↓

CloudWatch Alarms

↓

SNS

↓

EventBridge

↓

Security Operations Centre

19. CloudWatch Integration

CloudWatch integrates with:

CloudTrail
GuardDuty
Security Hub
AWS Config
Lambda
SNS
EventBridge
Systems Manager
Security Lake

20. CloudWatch in Incident Response

Example workflow:

CloudTrail Event

↓

Metric Filter

↓

CloudWatch Alarm

↓

SNS

↓

EventBridge

↓

Lambda

↓

SOC Notification

↓

Investigation

🛠 Enterprise Labs

Lab 01

Configure Enterprise CloudWatch Architecture

Lab 02

Create Enterprise Log Groups

Lab 03

Configure Metric Filters

Lab 04

Create Security Alarms

Lab 05

Build Enterprise Dashboards

Lab 06

Configure Composite Alarms

Lab 07

Use CloudWatch Logs Insights

Lab 08

Investigate IAM Activity Using CloudWatch

Lab 09

Monitor CloudTrail Events

Lab 10

Enterprise CloudWatch Assessment

💻 AWS Console Walkthrough

Students configure:

Log Groups
Log Streams
Dashboards
Metrics
Metric Filters
Alarms
Composite Alarms
Logs Insights
Contributor Insights
Anomaly Detection

💻 AWS CLI Exercises

# List CloudWatch log groups
aws logs describe-log-groups

# List log streams
aws logs describe-log-streams \
  --log-group-name CloudTrail

# Retrieve log events
aws logs get-log-events \
  --log-group-name CloudTrail \
  --log-stream-name STREAM_NAME

# Create a metric filter
aws logs put-metric-filter

# List CloudWatch metrics
aws cloudwatch list-metrics

# View metric statistics
aws cloudwatch get-metric-statistics

# Create a CloudWatch alarm
aws cloudwatch put-metric-alarm

# List alarms
aws cloudwatch describe-alarms

# Describe dashboards
aws cloudwatch list-dashboards

✅ Verification Checklist

Students should be able to:

Explain CloudWatch architecture.
Create Log Groups.
Configure Log Streams.
Configure Metrics.
Create Metric Filters.
Configure Alarms.
Configure Composite Alarms.
Build Dashboards.
Query Logs Insights.
Integrate CloudWatch with CloudTrail.
Monitor enterprise workloads.
Design enterprise monitoring strategies.
Implement CloudWatch governance.

🏢 Enterprise Best Practices

CloudNova standards:

Standardise Log Group naming conventions.
Encrypt CloudWatch Logs using customer-managed KMS keys.
Configure log-retention policies for every Log Group.
Use Metric Filters for high-value security events.
Build role-specific dashboards for SOC, Operations and Management.
Reduce alert fatigue with Composite Alarms.
Regularly review alarm thresholds.
Integrate CloudWatch with EventBridge and Security Operations.
Monitor CloudWatch service health and alarm delivery.

🚫 Common Mistakes

Using default log-retention settings.
Creating too many alarms.
Ignoring alarm ownership.
Never testing alarms.
Not encrypting Log Groups.
Treating dashboards as static reports.
Forgetting to tune Metric Filters.
Allowing alert fatigue to grow.
Ignoring CloudWatch costs.
Failing to monitor alarm failures.

🧪 DIY Enterprise Challenge

Design CloudNova’s enterprise CloudWatch monitoring platform supporting:

500 AWS accounts
Multi-Region monitoring
SOC dashboards
Executive dashboards
Security dashboards
Composite Alarms
EventBridge integration
Lambda automation
CloudTrail integration
Security Lake integration

Prepare:

Monitoring architecture
Dashboard strategy
Alarm catalogue
Metric Filter catalogue
Governance framework
Cost-optimisation strategy
Operational runbook
Monitoring maturity roadmap

📊 Knowledge Check

Create and answer 50 enterprise-level questions covering:

CloudWatch architecture
Log Groups
Log Streams
Metrics
Dashboards
Alarms
Composite Alarms
Metric Filters
Logs Insights
Contributor Insights
Anomaly Detection
CloudWatch governance
Enterprise monitoring
Security monitoring

💡 Key Takeaways

After completing this lesson, you should be able to:

Design enterprise monitoring architectures using Amazon CloudWatch.
Build secure Log Groups, Metrics, Dashboards and Alarms.
Convert raw logs into actionable security alerts using Metric Filters.
Use CloudWatch Logs Insights to investigate operational and security events.
Integrate CloudWatch with CloudTrail, EventBridge, Lambda and Security Operations workflows.
Establish governance, monitoring standards and dashboards that support 24×7 enterprise cloud operations.

🚀 Next Lesson

➡️ Lesson 05 — AWS Config, Configuration Compliance, Conformance Packs & Enterprise Governance