CloudWatch Security Monitoring
Monitoring & DetectionCloudWatch Security Monitoring uses CloudWatch metrics, logs, and alarms to detect and respond to security events across your AWS environment.
Security Metric Alarms
- Root account usage (any API call by root triggers alarm)
- Console sign-in failures (potential brute force)
- Unauthorized API calls (
AccessDeniedcount above threshold) - IAM policy changes (potential privilege escalation)
- Security group changes (network exposure risk)
- CloudTrail configuration changes (tamper detection)
CloudWatch Logs Insights
- Query CloudTrail logs for specific API calls, IP addresses, or user agents
- Investigate security incidents with SQL-like query language
- Dashboard visualizations for security metrics
CloudWatch Anomaly Detection
- ML-based anomaly detection on any CloudWatch metric
- Automatically learns normal patterns and alerts on deviations
- Useful for detecting unusual data transfer, API call volumes, or error rates
Related AWS Services
Related Content
Related Terms
AWS service that records every API call made in your account, providing an audit trail of who did what, when, and from where.
A chronological record of all activities in an AWS account (API calls, logins, configuration changes) used for security investigation and compliance evidence.
The process of identifying potential security threats, malicious activity, and anomalous behavior in your AWS environment using automated monitoring tools.
AWS service that aggregates security findings from GuardDuty, Inspector, Macie, and third-party tools into a single dashboard with compliance scoring.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.