AWS Cloud Monitoring

MCP Server

• Command: uvx awslabs.cloudwatch-mcp-server@latest (stdio transport)
• Requires: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)

Key Capabilities

• Metrics: Query CloudWatch metrics for any AWS service (EC2, ELB, TGW, NAT GW, VPN)
• Alarms: List and inspect CloudWatch alarms and their states
• Logs: Run CloudWatch Logs Insights queries across any log group
• Flow Logs: Analyze VPC and TGW flow logs for traffic patterns and dropped connections

Workflow: Network Monitoring Dashboard

When a user asks "how is our AWS network performing?":

1. Check alarms: List CloudWatch alarms in ALARM state
2. VPN metrics: Tunnel state, bytes in/out for site-to-site VPNs
3. NAT Gateway metrics: Active connections, packets dropped, bytes processed
4. Transit Gateway metrics: Bytes in/out, packets dropped per attachment
5. ELB metrics: Healthy/unhealthy targets, latency, 5xx errors
6. Report: Network health dashboard with any issues flagged

Workflow: Flow Log Analysis

When investigating traffic patterns or security events:

1. Query VPC flow logs: Filter by source IP, destination IP, port, action (ACCEPT/REJECT)
2. Identify rejected traffic: Find REJECT entries to see blocked connections
3. Top talkers: Aggregate by source/destination to find heaviest traffic flows
4. Time correlation: Narrow to specific time windows around incidents
5. Report: Traffic analysis with recommendations

Common CloudWatch Network Metrics

| Service | Metric | What It Tells You | |---------|--------|-------------------| | VPN | TunnelState | 0=down, 1=up for each tunnel | | VPN | TunnelDataIn/Out | Bytes through each VPN tunnel | | NAT GW | ActiveConnectionCount | Active NAT connections | | NAT GW | PacketsDropCount | Packets dropped (capacity issue) | | NAT GW | BytesProcessed | Traffic volume through NAT | | TGW | BytesIn/BytesOut | Traffic per TGW attachment | | TGW | PacketDropCountBlackhole | Blackhole route drops | | ELB | HealthyHostCount | Healthy targets behind ALB/NLB | | ELB | TargetResponseTime | Backend latency | | EC2 | NetworkIn/NetworkOut | Instance network throughput | | EC2 | NetworkPacketsIn/Out | Instance packet rate |

Flow Log Query Examples

# Top rejected connections in last hour
fields @timestamp, srcAddr, dstAddr, dstPort, action
| filter action = "REJECT"
| stats count() as rejections by srcAddr, dstAddr, dstPort
| sort rejections desc
| limit 20

# Traffic from specific source
fields @timestamp, srcAddr, dstAddr, dstPort, bytes, action
| filter srcAddr = "10.0.1.50"
| sort @timestamp desc

# Top talkers by bytes
fields srcAddr, dstAddr, bytes
| stats sum(bytes) as totalBytes by srcAddr, dstAddr
| sort totalBytes desc
| limit 10

Important Rules

• CloudWatch Logs Insights queries have a cost — be mindful of time range and data volume
• Region-specific — metrics and logs are scoped to the configured region
• Record in GAIT — log monitoring investigations for audit trail

Environment Variables

• AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)