CloudWatch Foundations
Explore how CloudWatch metrics and logs provide different types of observability data for AWS environments. Understand how alarms work, including evaluation rules and handling missing data, to accurately monitor incidents and troubleshoot effectively in production systems.
Observability in AWS comes down to two different kinds of evidence, and most of the confusion in an incident comes from reaching for the wrong one. Metrics are continuous, numeric, and evaluated automatically on a schedule, which is what makes them the foundation for alarms. Logs are discrete, contextual records, searched or filtered after they're already emitted. Neither one is a replacement for the other, and an alarm built on metrics can only ever be as trustworthy as the metric feeding it.
That last point matters more than it sounds. A CloudWatch alarm only helps during an incident when its state can actually be explained from its inputs. An application failing while its alarm sits in INSUFFICIENT_DATA points to a specific, checkable cause: the alarm isn't receiving, selecting, or interpreting the metric datapoints it's supposed to be evaluating.
The same metric line can produce different alarm timelines, because missing datapoints are themselves part of the evaluation inputs. An alarm can only evaluate what exists inside its configured period boundaries, so a gap can either keep it from ...