Observability questions often present four services that all appear to “monitor” something. Separate the data model.
| Service | Primary question |
|---|---|
| CloudWatch | What is the workload doing now? |
| EventBridge | Which event occurred, and where should it route? |
| CloudTrail | Who called which AWS API, when and from where? |
| AWS Config | What was the resource configuration, and was it compliant? |
CloudWatch stores metrics, logs, alarms, dashboards, and synthetic canaries. The agent is required for guest-OS data such as memory usage that EC2 does not publish by default. Metric filters turn matching log patterns into metrics. Subscription filters stream logs continuously; export tasks are batch-oriented.
CloudTrail records management events and optional data events; a trail delivers durable history beyond the event-history window. EventBridge can react to AWS service events or CloudTrail-backed API activity. Config records configuration history, evaluates rules, and can trigger remediation; it does not inspect application performance.
For multiple accounts, Organizations and Control Tower establish account structure and guardrails. IAM Identity Center centralizes workforce access. CloudFormation makes infrastructure repeatable; drift detection and Config answer different questions about declared versus observed state.
Exam lens: choose the service from the evidence requested: performance signal, routable event, API audit, or configuration compliance.
Review card
- Metrics/logs: CloudWatch.
- API history: CloudTrail.
- Resource configuration/compliance: Config.
- Event routing: EventBridge.
- Governance combines account structure, preventive guardrails, detective controls, and remediation.
可觀測性題常把四個都像在「monitor」的服務放在一起。不要背 slogan，要分 data model。
| 服務 | 主要回答 |
|---|---|
| CloudWatch | Workload 現在怎麼了？ |
| EventBridge | 哪個 event 發生，要 route 去哪？ |
| CloudTrail | 誰在何時、從哪裡呼叫什麼 AWS API？ |
| AWS Config | Resource 當時如何設定，是否 compliant？ |
CloudWatch 有 metrics、logs、alarms、dashboards 與 synthetic canaries。EC2 預設不發布 memory 等 guest-OS metric，需 agent。Metric filter 把 log pattern 轉 metric。Subscription filter 連續 stream log；export task 偏 batch。
CloudTrail 記 management events 與可選 data events；trail 可保留超過 event-history window 的歷史。EventBridge 可對 AWS service event 或 CloudTrail-backed API activity 反應。Config 記 configuration history、evaluate rule、trigger remediation，不觀測 app performance。
Multi-account 治理中，Organizations/Control Tower 建 account structure/guardrail；IAM Identity Center 管 workforce access；CloudFormation 讓 infrastructure repeatable。Drift detection 與 Config 分別回答 declared state 和 observed state 的問題。
考試視角： 題目要的 evidence 是 performance signal、routable event、API audit 或 configuration compliance？答案就在這裡。
複習卡
- Metrics/logs：CloudWatch。
- API history：CloudTrail。
- Configuration/compliance：Config。
- Event routing：EventBridge。
- Governance = account structure + preventive guardrail + detective control + remediation。