India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
AWS Monitoring, Observability & Cloud Operations Services
AWS Monitoring and Operations is the use of CloudWatch, CloudTrail, Systems Manager, AWS Config and X-Ray to observe application health, trace requests, record changes and patch fleets. NTSPL sets these up for Indian companies around service-level objectives, so teams get fewer, more meaningful alerts, patched servers without SSH, and audit evidence that is generated rather than assembled.
AWS services in scope
The Problem Amazon CloudWatch with Application Signals and Container Insights and AWS X-Ray with OpenTelemetry (ADOT) Solve
Operations teams we meet are rarely short of data. They have 1,800 CloudWatch alarms on CPU above 80 percent, three log tools, a Nagios server nobody dares switch off, and still learn about outages from customers on social media. The core failure is that alerts are tied to infrastructure symptoms rather than to user-facing outcomes, so an engineer paged at 2 a.m. cannot tell whether the booking flow is broken or a batch node is busy. Meanwhile patching is a monthly spreadsheet, and SSH keys shared with vendors are the default way into production.
NTSPL rebuilds operations around a small number of service-level objectives per business journey, measured with CloudWatch Application Signals and OpenTelemetry traces, and alarms on SLO burn rate rather than raw thresholds. Infrastructure alarms remain but route to tickets, not pagers. We replace SSH and RDP with Session Manager, move patching to Systems Manager patch policies with maintenance windows per environment, and record every change with AWS Config and CloudTrail so audits pull from data, not screenshots.
When CloudWatch, Systems Manager and Config Should Run Your Operations (and When They Should Not)
Signals that point to monitoring & operations on AWS
- On-call engineers receive more than 50 alerts a day, and post-incident reviews show fewer than 1 in 10 needed action.
- Customers or the business report outages before your monitoring does, more than once a quarter.
- Patch compliance reports are compiled manually and show fewer than 80 percent of servers within the patch window.
- Vendors or engineers reach production with SSH keys or RDP passwords and no session recording.
- CloudWatch Logs is one of your top five AWS bill line items, or log retention is set to never expire across most groups.
- An ISO 27001, SOC 2, RBI or SEBI audit needs change-history and configuration evidence for the past 12 months.
When a different approach is better
- If you already run a mature third-party observability platform with APM, logs and on-call routing that teams use daily, replacing it with CloudWatch rarely pays back; integrate CloudWatch metrics and CloudTrail into it and use Systems Manager for patching only.
- If most of your estate runs on-premises with only a few AWS workloads, CloudWatch agents on-premises work but are not ideal; keep your existing on-premises monitoring and use Systems Manager hybrid activations for patching where helpful.
- If you need full SIEM correlation for security operations, CloudWatch Logs Insights is not a SIEM; send CloudTrail and VPC Flow Logs to Amazon OpenSearch Service security analytics or your SIEM.
AWS Operations Toolkit: CloudWatch Application Signals, CloudTrail, Systems Manager, Config and X-Ray
| Service | Role in the architecture | Choose it when |
|---|---|---|
| Amazon CloudWatch with Application Signals and Container Insights | Collects metrics, logs and alarms, while Application Signals auto-instruments services on EKS, ECS, EC2 and Lambda to produce latency, error and availability metrics with SLOs, and Container Insights adds pod and node-level telemetry. | You need to know whether a business journey such as login, search or checkout is meeting its target, not just whether a host is busy. |
| AWS X-Ray with OpenTelemetry (ADOT) | Stores and visualizes distributed traces across services, with applications instrumented through the AWS Distro for OpenTelemetry because the X-Ray SDKs and daemon entered maintenance mode in February 2026. | A slow request crosses four or more services or external APIs and nobody can say which hop added the latency. |
| AWS CloudTrail with Amazon Athena | Records every API call across the organization, with Amazon Athena providing SQL query over the CloudTrail logs in S3 (CloudTrail Lake closed to new customers in May 2026) retained for years. | An incident or audit needs to answer who changed a security group, deleted a table or modified an IAM policy, and when. |
| AWS Systems Manager (Patch Manager, Session Manager, Automation) | Patch Manager applies baselines through patch policies and maintenance windows, Session Manager gives logged shell and RDP access without open ports, and Automation runbooks execute repeatable remediation. | Patch compliance is below 80 percent, engineers or vendors SSH in with shared keys, or the same fix is applied by hand every week. |
| AWS Config | Records resource configuration history and evaluates it against managed and custom rules or conformance packs, aggregated across accounts and Regions. | You need continuous evidence that encryption, tagging, public access or backup policies hold, rather than point-in-time checks before an audit. |
| Amazon Managed Grafana | Hosts Grafana workspaces that query CloudWatch, Amazon Managed Service for Prometheus, X-Ray and Athena in place, with access through IAM Identity Center or SAML. | Teams already think in Grafana dashboards or need one view across CloudWatch, Prometheus and business data without running Grafana servers. |
SLO-driven observability and keyless operations across a central monitoring account
SLO-driven observability and keyless operations across a central monitoring account
User requests flow through ALB into services on EKS or EC2, where the CloudWatch agent and ADOT collector emit Application Signals metrics, traces and logs into each workload account and share them with a central monitoring account. SLO burn-rate alarms and composite alarms trigger notifications and Systems Manager Automation runbooks, while Config and CloudTrail record every change for audit.
Select any component
SLO-driven observability and keyless operations across a central monitoring account: click any of its 9 components to see its role and the design choice NTSPL makes for it, or trace the 6-step primary path.
Observability Engineering Decisions: SLO-Based Alarms, Log Classes, Tracing and Patch Policies
Alarm on SLO burn, not on CPU
We define three to six SLOs per product, each tied to a user journey, and alarm on error-budget burn rate. A fast-burn alarm, about 14 times the budget rate over 1 hour, pages; a slow-burn alarm, about 2 times over 6 hours, opens a ticket. CPU, memory and disk alarms remain, but route to tickets unless they predict an SLO breach. This usually cuts paging volume by 70 to 90 percent while catching user impact earlier.
Log classes, retention and what not to log
CloudWatch Logs bills ingestion per GB, so the cheapest log is the one not written. We drop health-check access logs, cap debug logging in production, and move audit-style logs to the Infrequent Access class, which halves ingestion cost but does not support metric filters or live tail. Retention defaults to 30 days for application logs and 180 days or more where CERT-In requires; long-term copies go to S3 through subscription filters or export.
Tracing with OpenTelemetry rather than X-Ray SDKs
New instrumentation uses the AWS Distro for OpenTelemetry, since the X-Ray SDKs and daemon have been in maintenance mode since February 2026. OpenTelemetry also keeps you vendor-neutral if you later add another backend. We set head sampling at 5 to 10 percent with error and slow-request capture in the collector; tracing every request on a high-volume API inflates X-Ray and log costs without improving diagnosis.
Patch policy design by environment
Use Patch Manager patch policies through Quick Setup so new accounts inherit baselines automatically. Baselines approve security and critical patches 3 days after release for development, 7 days for UAT and 14 days for production, with emergency approval for actively exploited CVEs. Maintenance windows use rate controls, such as 20 percent concurrency and a 5 percent error threshold, so one bad patch cannot take down a whole Auto Scaling group.
Where to place Grafana
Amazon Managed Grafana removes Grafana server operations, but check Region availability: at the time of writing it is not offered in the Indian Regions, so a workspace typically runs in Singapore and queries CloudWatch in Mumbai in place. Metric data is not stored there, but query results transit. If residency policy forbids that, run open-source Grafana on ECS or EKS in ap-south-1, or use CloudWatch dashboards.
How NTSPL Builds an SLO-Driven Monitoring and Patching Operation on AWS
Alert and log inventory
Export every alarm, notification target and log group with ingestion volume and retention, and tag each alarm as page, ticket or delete based on 30 days of history.
Journey SLO definition
Workshop with product owners to define three to six SLOs per product, then enable Application Signals and ADOT on the services behind those journeys.
Burn-rate and composite alarms
Create fast and slow burn alarms, composite alarms that suppress dependent noise, and routing to the on-call tool through SNS and EventBridge.
Session Manager cutover
Install or verify the SSM Agent, attach instance profiles, enable session logging to S3 and close inbound 22 and 3389 in security groups environment by environment.
Patch policies and maintenance windows
Deploy organization patch policies, run a scan-only cycle to baseline compliance, then switch to install with rate controls in development, UAT and production.
Config conformance and audit queries
Deploy the Config aggregator and conformance packs, set up organization CloudTrail trails to S3 with Athena tables, and publish saved audit queries for the compliance team.
What you receive
Securing Operations Access: Session Manager, CloudTrail Integrity and Least-Privilege Runbooks
Operations tooling holds the keys to production, so it is a prime target. A compromised engineer laptop with an SSH key, or an over-permissive Automation runbook that can run arbitrary commands, gives an attacker a quiet path to every server. We remove inbound management ports, make every human session attributable and recorded, restrict which IAM roles can run which documents, and protect the audit trail itself from deletion or edit.
- Session Manager with KMS-encrypted sessions and transcripts logged to S3, replacing SSH keys and RDP passwords
- IAM conditions restricting ssm:StartSession and ssm:SendCommand to tagged instances per team
- CloudTrail log file validation and an organization trail that member accounts cannot stop
- CloudWatch Logs data protection policies that mask PAN, Aadhaar-like and email patterns in log events
- Config rules detecting security groups that reopen ports 22 or 3389 to 0.0.0.0/0
CloudWatch and Config Pricing: Log Ingestion, Custom Metrics, Configuration Items and Grafana Seats
Observability cost grows silently with traffic. CloudWatch bills log ingestion and storage per GB, custom metrics per metric per month, alarms per alarm, and Logs Insights per GB scanned; high-cardinality custom metrics are a common surprise. AWS Config bills per configuration item recorded and per rule evaluation, so continuously recording short-lived containers is expensive. Managed Grafana bills per active editor and viewer user per workspace.
- Infrequent Access log class for audit and debug logs, at half the Standard ingestion price
- Retention policies on every log group, with exports to S3 Glacier for long-term needs
- Embedded Metric Format with bounded dimensions instead of high-cardinality custom metrics
- AWS Config periodic recording for non-production and for resource types that change often
- Trace sampling at 5 to 10 percent with errors kept, rather than tracing all requests
CloudWatch vs Datadog or New Relic vs open-source Prometheus and Grafana: which should we use on AWS?
Choose by estate mix, team skills and cost model. CloudWatch with Application Signals is the default for AWS-centric estates: no agents to license, data stays in your account and Indian Regions, native integration with Systems Manager and Config, and pay-per-use pricing. Choose Datadog or New Relic when you run material multi-cloud or on-premises workloads and want one polished APM and log experience, accepting per-host and per-GB licence costs that often exceed CloudWatch at scale. Choose Prometheus with Amazon Managed Service for Prometheus and Grafana when your teams run Kubernetes heavily and already use PromQL. Many NTSPL clients mix them: Prometheus metrics for EKS, CloudWatch for AWS services and logs, and Grafana as the shared view.
Key facts about monitoring & operations on AWS
Monitoring & Operations on AWS in Practice
3 monitoring & operations scenarios from Telecom value-added services, Online travel, FMCG distribution: the starting position, the services chosen, the architecture, the rollout and the measured outcome.
Telecom VAS provider cuts daily pages from 2,300 alerts to 9 actionable incidents
Online travel agency traces booking-path latency to two hidden dependencies
FMCG distributor lifts DMS patch compliance from 41% to 97% and passes audit
Urban cooperative bank maps AWS controls to RBI cyber security framework levels
Monitoring & Operations on AWS: Frequently Asked Questions
Why is our CloudWatch bill so high, and how much can we save?
In most estates, log ingestion is 60 to 80 percent of the CloudWatch bill, followed by custom metrics. Dropping health-check and debug logs, moving audit logs to Infrequent Access and setting retention typically cuts CloudWatch cost by 30 to 50 percent. For a mid-size estate spending INR 4 lakh a month on CloudWatch, that is often INR 1.2 to 2 lakh saved monthly.
We use Nagios and Zabbix on-premises. How do we move to CloudWatch?
Run both for one or two months. We map each Nagios check to a CloudWatch alarm, an Application Signals SLO or a deliberate deletion, deploy the CloudWatch agent through Systems Manager, and compare alert timelines during the overlap. Once CloudWatch catches every incident the old tool caught, with fewer false alarms, we decommission Nagios checks group by group.
Can Systems Manager patch servers in our Indian data centre as well as on AWS?
Yes. Systems Manager hybrid activations register on-premises Windows and Linux servers as managed nodes, so the same patch policies, maintenance windows and compliance reports apply. Servers need outbound HTTPS to Systems Manager endpoints in Mumbai, either over the internet or through Direct Connect with VPC endpoints. Advanced-tier pricing applies to some hybrid features such as Session Manager on on-premises nodes.
How long should we keep logs to meet CERT-In directions?
CERT-In's April 2022 directions require logs of ICT systems to be maintained for 180 days within Indian jurisdiction. We set CloudWatch log groups and CloudTrail storage in ap-south-1 or ap-south-2 to at least 180 days for in-scope systems, and archive older logs to S3 if your sector regulator, such as RBI or SEBI, expects longer retention.
Will Session Manager slow down our engineers compared with SSH?
Rarely, after the first week. Engineers use the AWS CLI with the Session Manager plugin, which supports port forwarding and SSH tunnelling through Session Manager, so tools such as database clients still work. Access becomes faster for new joiners because nobody needs to distribute keys or manage bastion hosts, and every session is logged automatically.
What does AWS Config cost, and is it worth it?
AWS Config charges per configuration item recorded and per rule evaluation, plus conformance pack evaluations. For a 15-account estate with mostly stable infrastructure, NTSPL typically sees INR 25,000 to 80,000 a month. Cost spikes come from recording ephemeral resources continuously; periodic recording for those types keeps it in check while preserving audit history.