Amazon CloudWatch

I think like I've used Sentry before to like check for exceptions, but there could be errors that are not exceptions or they don't make it to the try catch kind of area that you'd normally report like capture exception if you've manually done like your own configured catch block.

A lot of times I'll monitor, I'll have Sentry and Ground Cover, which is a logging system, I don't know if you've used that one, like CloudWatch essentially.

So I'll check both whenever I deploy something and I'm like, keeping an eye on the sentry channel make sure there's any there's no new exceptions and I'll keep an eye on the ground cover logs to see if there's I'll just kind of refresh and see like the last five minutes is there anything odd here and I usually see like an error whenever there's like a deploy and the session dies and reboots or whatever something like that and that's in the obvious like this is this is fine but then I'll just look and inspect especially like any of the the files that I edited you know if they're a very common like this like oh The webhooks repo I was working on recently is a good example of this.

There's a bunch of new webhooks that I've added or a bunch of webhooks code that I've edited recently that gets hit frequently.

Tell me which endpoints we never hit because if we haven't hit them in 90 days, it's probably dead code.

And it found all of them for me.

But the idea of what you're talking about here is almost like an NCP connector to CloudWatch or to GroundCover that it could feed it right into it.

Or some kind of real-time or nearly real-time thing.

Start in alert mode, sometimes called count mode, where the firewall logs what it would have blocked without actually dropping it.

Ship those logs to CloudWatch or S3.

Run them for at least a full business cycle, ideally including a deploy day, a patch day, and a batch job day, because those all have different egress patterns.

Build your domain allow list from that real traffic, not from what people think they're calling.

I'm amused that the URL slug for this thing is dated back in July, so I'm wondering why it was held back.

CloudWatch now supports warm-up periods for alarms.

It took 17 years, but finally CloudWatch won't start off by screaming for help before it checks the metrics it's supposed to alert on.

Good work.

Kinesis Data Streams announces data delivery to general-purpose S3 buckets.

Option C, AWS Config.

and option D, Amazon CloudWatch.

Let's pause here.

The correct answer is option B, that's AWS CloudFormation.

AWS Network Firewall now tracks rules hit counts showing which stateful rules are actively matching traffic versus sitting unused, addressing a longstanding visibility gap for security teams managing complex rule sets.

The feature is enabled by default at no additional cost, though standard CloudWatch logs or S3 Athena charges apply for storing and querying the underlying log data.

Practical use cases include identifying stale rules for cleanup, validating the newly deployed controls like geofencing or AIML domain blocking are actually functioning, and accelerating incident response by quickly spotting suspicious traffic patterns like OAST domain hits.

This directly supports compliance requirements like PCI 4.0 and DORA, which require organizations to prove security controls are actively working rather than just configured.

So I will have had an observation that pulled me to it.

So maybe it's like an AWS CloudWatch alert or something.

I might like copy the text of that and just paste it in and say, go.

And I don't bother to do much theorizing at that stage.

The cloud makes compliance easier.

So we've relied heavily on a security hub and using security hub and the related products and also the help of AWS support and Blue Ball, we've been able to very quickly achieve our ISO 27001 accreditation and various tools, Inspector, Config and GuardDuty, they all play a significant part in identifying threats ensuring there's no drift in your environment, and it gives a good audit log for CloudWatch that we could easily then all provide as evidence to the auditors.

And that really has helped us to get to our ISO 27001 a lot faster.

So I really think AWS and the innovation and pace that they do things at, that really helped us to achieve that a lot faster.

deployed outside AWS.

Solution requires three components, a auto instrumentation for agent framework, IAM credentials for SIGV4 authentication, and specific open telemetry environment variables to route telemetry to the CloudWatch OTLP endpoint, giving a unified observability dashboard regardless of where the agents run.

Ado has validated the approach on both on-premise setups and Google Cloud Shell, confirming identical telemetry output, including sessions, traces, span metrics, token usage, and latency, where the agent runs on agent core runtime or a competitor's cloud.

This matters for multi-cloud and hybrid AI deployments where visibility into agent reasoning chains, tool evocations, and model outputs is needed to detect hallucinations, monitor for harmful outputs, and track token usage for cost governments across distributed environments.