Management and governance
Monitor (CloudWatch), audit (CloudTrail, Config), automate (CloudFormation, Systems Manager) and govern many accounts (Control Tower).
CloudWatch
Amazon CloudWatch
Monitoring and observability for resources and applications: metrics, logs, events and alarms.
Key points
- Performance metrics (e.g. CPU usage).
- Alarms that notify or trigger actions, such as scaling.
- Centralized logs and dashboards.
On the exam
Performance and alarms: CloudWatch. Who did what: CloudTrail.
CloudTrail
AWS CloudTrail
Records API calls and actions in the account: who did what, on which resource and when.
Key points
- The basis for auditing, compliance and incident investigation.
- Keeps an event history.
- Logs can be delivered to S3 and CloudWatch Logs.
On the exam
"Find out who deleted a resource" or auditing API calls: CloudTrail.
Config
AWS Config
Continuously records resource configurations and evaluates their compliance against rules.
Key points
- A history of how each resource was configured.
- Rules check compliance automatically.
- Helps with audits and change analysis.
On the exam
"How was this resource configured last month?" or "is it compliant?": Config.
CloudFormation
AWS CloudFormation
Infrastructure as code: describes resources in templates and creates them as stacks.
Key points
- Versioned JSON or YAML templates.
- Creates, updates and deletes resources repeatably.
- No extra charge for the service itself.
On the exam
Provision the same infrastructure repeatedly from templates: CloudFormation.
Systems Manager
AWS Systems Manager
An operations hub to manage instances and servers on AWS and on premises.
Key points
- Patch Manager: applies patches at scale.
- Session Manager: instance access without opening SSH ports.
- Parameter Store: stores configuration and secrets.
On the exam
"Apply patches to a fleet of servers" or reach them without SSH: Systems Manager.
Control Tower
AWS Control Tower
Sets up and governs a multi-account environment following best practices (landing zone).
Key points
- Builds the landing zone on top of AWS Organizations.
- Preventive and detective controls (guardrails).
- A compliance dashboard for the accounts.
On the exam
"Quickly set up a secure, governed multi-account environment": Control Tower.
Trusted Advisor
AWS Trusted Advisor
Inspects your environment and recommends improvements based on AWS best practices.
Key points
- Categories: cost optimization, performance, security, fault tolerance, service limits and operational excellence.
- On Basic: all service limits checks and some security checks (e.g. MFA on the root account).
- Paid plans unlock the full set of checks.
On the exam
Automatic recommendations on cost, security and limits: Trusted Advisor.
Health Dashboard
AWS Health Dashboard
Shows the status of AWS services and the events affecting your account.
Key points
- A general view of service status across all Regions.
- A personalized view of events affecting your resources.
- The AWS Health API lets you automate the response.
On the exam
"Know whether an AWS issue is affecting my resources": AWS Health Dashboard.
Compute Optimizer
AWS Compute Optimizer
Analyzes historical usage with machine learning and recommends the right size for resources.
Key points
- Covers EC2, Auto Scaling groups, EBS, Lambda and ECS on Fargate.
- Flags over-provisioned and under-provisioned resources.
- Helps cut cost and improve performance.
On the exam
"Rightsizing recommendations for EC2 instances": Compute Optimizer.
Service Catalog
AWS Service Catalog
A catalog of approved IT products (infrastructure templates) that users can deploy on their own.
Key points
- Administrators define what can be deployed.
- Enforces configuration standards and compliance.
- Products are based on CloudFormation templates.
On the exam
"Let teams deploy only approved resources": Service Catalog.
Shows and manages the quotas (limits) of every service in one place.
Key points
- See current and default quota values.
- Request quota increases from the console or the API.
- CloudWatch alarms warn when usage nears the limit.
On the exam
"Request a limit increase for a service": Service Quotas.
License Manager
AWS License Manager
Manages software licenses from vendors such as Microsoft, Oracle and SAP, on AWS and on premises.
Key points
- Defines licensing rules and tracks usage.
- Prevents exceeding the number of purchased licenses.
- Useful with the BYOL model.
On the exam
"Track software license usage (BYOL)": License Manager.