AWS CloudWatch Monitoring

Purpose

This skill provides guidance for monitoring the CIA platform using AWS CloudWatch, including metrics collection, alarm configuration, dashboard creation, log analysis, and performance troubleshooting. Ensures proactive detection of issues and compliance with monitoring requirements.

When to Use

✅ Use this skill when:

Setting up monitoring for new services or features
Creating custom metrics for business KPIs
Configuring alarms for critical thresholds
Building operational dashboards
Analyzing application logs for errors
Troubleshooting performance issues
Implementing distributed tracing
Meeting compliance monitoring requirements

❌ Don't use this skill for:

Application code implementation (use stack-specialist)
Security incident response (use threat-modeling)
Database performance tuning (use postgresql-operations)
CI/CD pipeline configuration (use github-actions-workflows)

Patterns & Examples

Custom Metrics for Political Data

// Spring Boot - Micrometer integration with CloudWatch
@Service
public class PoliticianMetricsService {
    private final MeterRegistry meterRegistry;
    
    @Autowired
    public PoliticianMetricsService(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
    }
    
    public void recordRiskScoreCalculation(String politicianId, double score) {
        // Custom metric: risk score distribution
        meterRegistry.gauge("cia.politician.risk_score", 
            Tags.of("politician_id", politicianId), 
            score);
            
        // Counter: total risk calculations
        meterRegistry.counter("cia.risk_calculations.total",
            Tags.of("result", score > 70 ? "high" : "normal"))
            .increment();
    }
    
    public void recordDataSourceRefresh(String source, boolean success) {
        // Timer: data source refresh duration
        Timer.builder("cia.datasource.refresh.duration")
            .tag("source", source)
            .tag("status", success ? "success" : "failure")
            .register(meterRegistry)
            .record(() -> {
                // Refresh logic here
            });
    }
}

CloudWatch Alarms Configuration

# CloudFormation/Terraform - Critical Alarms
Resources:
  HighErrorRateAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIA-HighErrorRate
      AlarmDescription: Alert when error rate exceeds 5%
      MetricName: Errors
      Namespace: AWS/Lambda
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 2
      Threshold: 50
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - !Ref SNSTopicARN
      
  DatabaseConnectionPoolExhausted:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIA-DBConnectionPoolExhausted
      MetricName: DatabaseConnectionsInUse
      Namespace: CIA/Database
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 90  # 90% of max connections
      ComparisonOperator: GreaterThanThreshold
      
  RiskScoreCalculationLatency:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIA-RiskScoreHighLatency
      MetricName: RiskScoreCalculationDuration
      Namespace: CIA/Application
      Statistic: p99
      Period: 300
      EvaluationPeriods: 2
      Threshold: 5000  # 5 seconds
      ComparisonOperator: GreaterThanThreshold

CloudWatch Dashboard

{
  "widgets": [
    {
      "type": "metric",
      "properties": {
        "title": "CIA Platform Health",
        "metrics": [
          [ "CIA/Application", "RequestCount", { "stat": "Sum" } ],
          [ ".", "ErrorCount", { "stat": "Sum", "color": "#d62728" } ],
          [ ".", "ResponseTime", { "stat": "Average" } ]
        ],
        "period": 300,
        "region": "eu-north-1",
        "yAxis": {
          "left": { "min": 0 }
        }
      }
    },
    {
      "type": "metric",
      "properties": {
        "title": "Political Data Processing",
        "metrics": [
          [ "CIA/DataIngestion", "RiksdagenAPICallsTotal" ],
          [ ".", "ValDataRefreshSuccess" ],
          [ ".", "WorldBankDataSync" ]
        ]
      }
    },
    {
      "type": "log",
      "properties": {
        "title": "Recent Errors",
        "query": "SOURCE '/aws/lambda/cia-app' | fields @timestamp, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 20",
        "region": "eu-north-1"
      }
    }
  ]
}

Log Insights Queries

-- Top 10 slowest API endpoints
fields @timestamp, request.path, request.duration_ms
| filter request.duration_ms > 1000
| sort request.duration_ms desc
| limit 10

-- Error rate by endpoint
fields request.path, response.status_code
| filter response.status_code >= 500
| stats count() as error_count by request.path
| sort error_count desc

-- Risk score calculation performance
fields @timestamp, politician_id, calculation_duration_ms
| filter event_type = "risk_score_calculated"
| stats avg(calculation_duration_ms) as avg_duration, 
        max(calculation_duration_ms) as max_duration,
        count() as total_calculations
  by bin(5m)

ISMS Compliance Mapping

ISO 27001:2022 Annex A Controls

A.8.16 - Monitoring activities

Continuous monitoring of system activities
Log aggregation and analysis
Anomaly detection and alerting

A.8.15 - Logging

Centralized log management
Log retention policies (90 days minimum)
Log integrity and protection

A.8.8 - Management of technical vulnerabilities

Performance degradation monitoring
Capacity planning metrics
Availability tracking

NIST Cybersecurity Framework 2.0

Detect (DE)

DE.CM-01: Network monitored for anomalous activity
DE.CM-07: Monitoring for unauthorized activity
DE.AE-03: Event data aggregated and correlated

Respond (RS)

RS.AN-03: Analysis performed to establish impact
RS.CO-02: Incidents reported per established criteria

CIS Controls v8

Control 8: Audit Log Management

8.2: Collect audit logs
8.3: Standardize time synchronization
8.11: Conduct audit log reviews

Control 12: Network Infrastructure Management

12.8: Establish and maintain dedicated network infrastructure

Hack23 ISMS Policy References

Secure Development Policy - Section on Monitoring
Information Security Policy - Continuous monitoring requirements

References

Internal CIA Documentation

SECURITY_ARCHITECTURE.md - Monitoring architecture
ARCHITECTURE.md - System components to monitor

AWS Documentation

Remember

Proactive monitoring: Set alarms before incidents occur
Context-rich metrics: Tag metrics with relevant dimensions
Cost optimization: Use metric filters to reduce costs
Log retention: Comply with 90-day minimum retention
Dashboard visibility: Operational dashboards for NOC
Alerting hygiene: Reduce false positives, tune thresholds

aws-cloudwatch-monitoring