Observability & Cost

A review defines a workload in the AWS Well-Architected Tool, applies one or more lenses, and answers each lens design question by selecting the best practices you follow. Unselected practices become rated risks in an improvement plan; a milestone freezes that state as an immutable snapshot.

AWS Trusted Advisor runs curated checks over an account's configuration and usage across categories including cost optimization, performance, security, fault tolerance, service limits and operational excellence. Basic and Developer Support see only a subset; the full catalogue needs Business, Enterprise On-Ramp or Enterprise Support.

X-Amzn-Trace-Id carries Root (the X-Ray trace id), Parent (the caller's segment or subsegment id) and Sampled (1, 0 or ?). AWS entry points such as an Application Load Balancer or a REST API Gateway stage add it; every hop must forward it or the trace breaks.

CloudWatch Application Signals auto-instruments supported runtimes to emit standardised latency, error and fault metrics per service and operation, plus a service map and dependency view. Its SLO object tracks a goal over an interval, reporting attainment and remaining error budget rather than just a threshold breach.

CloudWatch cross-account observability designates a monitoring account that creates an Observability Access Manager sink; each source account creates a link to that sink naming the resource types it shares. The monitoring account then reads metrics, log groups and traces in place — one console, no role hopping.

CloudWatch Logs charges mainly for ingestion per GB, with much cheaper per-GB-month storage on compressed data. Levers: ingest less, route high-volume vended logs to S3 instead, use the Infrequent Access log class, and shorten retention — which only touches storage.

CloudWatch charges Logs Insights per gigabyte of log data scanned, and scan volume is set by the log groups and time range selected — not by how selective the filter is. Narrow the selection, not the query.

A subscription filter is a standing rule on a log group that pushes matching events, as they arrive, to Lambda, Kinesis Data Streams, Amazon Data Firehose, or a cross-account destination. Firehose suits bulk delivery to storage; Lambda suits per-event transformation.

A static alarm compares a metric statistic to a fixed number. An anomaly-detection alarm compares it to a band that CloudWatch learns from the metric's own history. A composite alarm evaluates no metric at all — it is a boolean rule over the states of other alarms.

Alarm on a ratio rather than a count: use CloudWatch metric math to divide the 5xx count by the request count and threshold the percentage. Then guard the expression so that zero traffic produces a defined value instead of a gap that leaves the alarm unevaluated.

The Cost and Usage Report delivers the raw billing line items to an S3 bucket you own, at hourly granularity with activated tags and optionally resource IDs as columns. You query it with Athena over the S3 data, which gives detail and joins the console cannot express.

An Organizations tag policy standardises tag keys and allowed values and reports non-compliance; with enforcement enabled for named resource types it blocks non-compliant tagging operations. It never blocks creating an untagged resource — that needs a deny policy on the aws:RequestTag condition key.

AWS Cost Anomaly Detection learns each monitored dimension's normal spend pattern and alerts on unexpected deviation, catching a spike days before a monthly threshold. It cannot see spend that has always been high, or a slow creep that resembles growth.

A NAT Gateway bills an hourly rate plus a per-GB data-processing fee on everything it forwards — including in-Region AWS traffic. Route S3 and DynamoDB through free gateway VPC endpoints and other services through interface endpoints so that bulk traffic never touches the NAT.

Utilization is the share of your committed hourly spend that eligible usage actually consumed; coverage is the share of eligible compute usage that a commitment discounted. Full utilization with low coverage means the commitment is sound but too small — most compute is still billing at On-Demand rates.

The SDK does not call X-Ray directly: it sends segments over UDP to a local collector — the X-Ray daemon or an ADOT collector sidecar on port 2000 — which batches them and calls PutTraceSegments. Check that the sidecar exists, that the app points at it, and that the task role grants X-Ray write.

Keep management events everywhere because the first trail copy is free and the record is irreplaceable. Treat data events as a per-workload decision scoped by resource and write-only. Hold one durable copy in S3 with a lifecycle policy, and size any hot query or alerting surface separately.

Make the account boundary carry most of the allocation, since all spend in an account belongs to it without tagging discipline, then use a small mandatory tag set inside accounts. Split genuinely shared cost by rule, and start with showback before charging anyone.

Commit only to the part of the baseline that survives every plausible roadmap outcome, prefer Compute Savings Plans because they follow workloads across families and into Fargate and Lambda, ladder shorter terms over the uncertain portion, and buy in tranches rather than one irreversible purchase.

CloudWatch dashboard variables add a control at the top of a dashboard that rewrites its widgets on selection. A property variable swaps a value such as a dimension, region or account across all widgets; a pattern variable substitutes a matched string anywhere in the dashboard JSON.

Associate a symmetric KMS key with the log group at creation or with AssociateKmsKey. The key policy must let the logs.<region>.amazonaws.com service principal use the key, normally scoped by a condition on the kms:EncryptionContext:aws:logs:arn context key.

A Cost Category is a billing dimension you define with rules over accounts, tags, services, regions and charge types, rather than one that resources carry. It groups spend that tags cannot reach, and its split charge rules distribute shared costs across the teams that caused them.

Athena over the trail's S3 objects is cheap to store and pay-per-query on bytes scanned, but you own the table and its partitioning. CloudTrail Lake is a managed event data store queried with SQL, priced on ingestion and retention, and needs no plumbing. Query volume and setup effort decide it.

A Contributor Insights rule evaluates log events as they arrive and produces a continuously updated ranking of top contributors by a key you choose, plus graphable metrics you can alarm on — unlike a query, which reads history once.

Utilization is the share of a purchased commitment that was actually used; coverage is the share of eligible on-demand usage that a commitment discounted. Low utilization means you are paying for unused commitment; low coverage means discountable usage is still billed at On-Demand rates.

A commitment discounts the fleet you have, so buying first locks in three years of existing waste. Rightsizing and moving eligible workloads to cheaper Graviton instance types lower the baseline first; AWS Compute Optimizer supplies the per-resource evidence for those changes.

An X-Ray sampling rule matches requests by service, host, method and URL path, then traces a per-second reservoir of them and a fixed percentage of the rest. Rules are evaluated by priority, lowest number first, and the reservoir is handed out to instances as quotas by the X-Ray service.

Metric Streams push metric updates continuously through Amazon Data Firehose with near-real-time latency and a per-update charge. Polling GetMetricData pulls on your schedule, costs per API request and throttles as the account count grows. Volume, latency and cost decide it.

Zone-local routing removes a real per-gigabyte charge but trades away the load spreading and headroom that multi-AZ deployment buys. Quantify the saving first, then require per-zone capacity headroom and an automatic fallback to remote zones before accepting it.

Tie reviews to lifecycle events rather than a calendar, encode organisation-specific standards as custom lenses, save milestones so progress is measurable, and require that high risk issues become funded, owned backlog items. A review nobody is resourced to act on produces documents, not change.