Observability questions often present four services that all appear to “monitor” something. Separate the data model.
| Service | Primary question |
|---|---|
| CloudWatch | What is the workload doing now? |
| EventBridge | Which event occurred, and where should it route? |
| CloudTrail | Who called which AWS API, when and from where? |
| AWS Config | What was the resource configuration, and was it compliant? |
CloudWatch stores metrics, logs, alarms, dashboards, and synthetic canaries. The agent is required for guest-OS data such as memory usage that EC2 does not publish by default. Metric filters turn matching log patterns into metrics. Subscription filters stream logs continuously; export tasks are batch-oriented.
CloudTrail records management events and optional data events; a trail delivers durable history beyond the event-history window. EventBridge can react to AWS service events or CloudTrail-backed API activity. Config records configuration history, evaluates rules, and can trigger remediation; it does not inspect application performance.
For multiple accounts, Organizations and Control Tower establish account structure and guardrails. IAM Identity Center centralizes workforce access. CloudFormation makes infrastructure repeatable; drift detection and Config answer different questions about declared versus observed state.
Exam lens: choose the service from the evidence requested: performance signal, routable event, API audit, or configuration compliance.
Review card
- Metrics/logs: CloudWatch.
- API history: CloudTrail.
- Resource configuration/compliance: Config.
- Event routing: EventBridge.
- Governance combines account structure, preventive guardrails, detective controls, and remediation.