☁️ Monitoring & Management

CloudWatch, CloudTrail, AWS Config, Systems Manager, Trusted Advisor

AWS Cloud Practitioner · CLF-C02 · ⏱️ 22 min · ❓ 5 savol

📊 Amazon CloudWatch

Metrics — CPU, Network, Disk I/O va h.k. (EC2, RDS, Lambda avtomatik). Alarms — metric threshold oshganda SNS/Auto Scaling trigger. Logs — application va OS loglarini to'plash (CloudWatch Agent orqali). Dashboards — custom vizualizatsiya. Events/EventBridge — AWS eventlarga reaksiya (Lambda trigger).

🔍 AWS CloudTrail

Barcha AWS API calllarini log qiladi (kim, qachon, qayerdan, nima). Management Events — resurs yaratish/o'zgartirish (default yoqiq). Data Events — S3 object-level, Lambda invocation (qo'shimcha to'lov). Trail — loglarni S3 ga saqlash. CloudTrail Insights — anomalous API activity detection. 90 kun Event History bepul.

⚙️ AWS Config

Resurs konfiguratsiyalarini vaqt bo'yicha track qiladi. Config Rules — compliance check (masalan, "S3 bucket public bo'lmasin"). Configuration Timeline — qachon nima o'zgardi. Remediation — noncompliant resursni avtomatik tuzatish. CloudTrail (API kim qildi) + Config (resurs holati nima bo'ldi) birgalikda ishlatiladi.

🛠️ Systems Manager (SSM)

Session Manager — SSH/RDP o'rniga brauzer orqali EC2 ga kirish (SSH key yoki open port kerak emas!). Parameter Store — konfigurasiya va secret saqlash (KMS bilan shifrlash). Patch Manager — OS patch avtomatlashtirish. Run Command — fleetga buyruq yuborish.

📊 Monitoring Xizmatlar Taqqoslash

Xizmat	Nima monitoring qiladi	Asosiy use case
CloudWatch	Metrics, logs, alarms	Performance monitoring, alerting, dashboards
CloudTrail	API calls (kim, nima, qachon)	Security audit, compliance, forensics
AWS Config	Resource configuration history	Compliance, drift detection, change tracking
GuardDuty	Threat intelligence, anomalies	Security threat detection, malicious activity
Trusted Advisor	Best practice checks	Cost, security, performance recommendations

💡 Asosiy nuqtalar

CloudWatch = metrics + logs + alarms + dashboards
CloudTrail = API audit (kim, nima, qachon) — compliance uchun
Config = resurs holati tarixi + compliance rules
SSM Session Manager = SSH kerak emas, security yaxshi
CloudTrail ≠ CloudWatch: Trail=audit, Watch=monitoring

🎯 Imtihon maslahatlari

CloudTrail vs CloudWatch — CLF-C02 da ENG KO'P chalkashadigan juft: Trail=audit log, Watch=metrics
GuardDuty — ML based threat detection, CloudTrail/VPC Flow Logs/DNS Logs tahlil qiladi
SSM Session Manager = bastion host emas, port 22 ochmaymiz, IAM role orqali kirish
CloudWatch Alarm states: OK → ALARM → INSUFFICIENT_DATA
AWS Config bepul emas — har resurs konfiguratsiya yozuvi uchun to'lanadi

⚠️ Ko'p adashadigan

CloudTrail = real-time monitoring deb o'ylash. CloudTrail — audit/log, real-time uchun CloudWatch Events
Trusted Advisor barcha planlarda to'liq ishlaydi deb hisoblash — Basic=7 check, Business+=barcha
Config Rules = firewall rules deb o'ylash. Config Rules = compliance check, firewall emas

🧠 Eslab qolish: "Watch the Metrics, Trail the People, Config the Resources" — CloudWatch=Performance, CloudTrail=Audit, Config=Compliance