AWS Cloud Monitoring
MCP Server
- Command:
uvx awslabs.cloudwatch-mcp-server@latest(stdio transport) - Requires:
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_REGION(orAWS_PROFILE)
Key Capabilities
- Metrics: Query CloudWatch metrics for any AWS service (EC2, ELB, TGW, NAT GW, VPN)
- Alarms: List and inspect CloudWatch alarms and their states
- Logs: Run CloudWatch Logs Insights queries across any log group
- Flow Logs: Analyze VPC and TGW flow logs for traffic patterns and dropped connections
Workflow: Network Monitoring Dashboard
When a user asks "how is our AWS network performing?":
- Check alarms: List CloudWatch alarms in ALARM state
- VPN metrics: Tunnel state, bytes in/out for site-to-site VPNs
- NAT Gateway metrics: Active connections, packets dropped, bytes processed
- Transit Gateway metrics: Bytes in/out, packets dropped per attachment
- ELB metrics: Healthy/unhealthy targets, latency, 5xx errors
- Report: Network health dashboard with any issues flagged
Workflow: Flow Log Analysis
When investigating traffic patterns or security events:
- Query VPC flow logs: Filter by source IP, destination IP, port, action (ACCEPT/REJECT)
- Identify rejected traffic: Find REJECT entries to see blocked connections
- Top talkers: Aggregate by source/destination to find heaviest traffic flows
- Time correlation: Narrow to specific time windows around incidents
- Report: Traffic analysis with recommendations
Common CloudWatch Network Metrics
| Service | Metric | What It Tells You |
|---|---|---|
| VPN | TunnelState | 0=down, 1=up for each tunnel |
| VPN | TunnelDataIn/Out | Bytes through each VPN tunnel |
| NAT GW | ActiveConnectionCount | Active NAT connections |
| NAT GW | PacketsDropCount | Packets dropped (capacity issue) |
| NAT GW | BytesProcessed | Traffic volume through NAT |
| TGW | BytesIn/BytesOut | Traffic per TGW attachment |
| TGW | PacketDropCountBlackhole | Blackhole route drops |
| ELB | HealthyHostCount | Healthy targets behind ALB/NLB |
| ELB | TargetResponseTime | Backend latency |
| EC2 | NetworkIn/NetworkOut | Instance network throughput |
| EC2 | NetworkPacketsIn/Out | Instance packet rate |
Flow Log Query Examples
# Top rejected connections in last hour
fields @timestamp, srcAddr, dstAddr, dstPort, action
| filter action = "REJECT"
| stats count() as rejections by srcAddr, dstAddr, dstPort
| sort rejections desc
| limit 20
# Traffic from specific source
fields @timestamp, srcAddr, dstAddr, dstPort, bytes, action
| filter srcAddr = "10.0.1.50"
| sort @timestamp desc
# Top talkers by bytes
fields srcAddr, dstAddr, bytes
| stats sum(bytes) as totalBytes by srcAddr, dstAddr
| sort totalBytes desc
| limit 10Important Rules
- CloudWatch Logs Insights queries have a cost — be mindful of time range and data volume
- Region-specific — metrics and logs are scoped to the configured region
- Record in GAIT — log monitoring investigations for audit trail
Environment Variables
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_REGION(orAWS_PROFILE)