For operations and auditing, AWS CloudTrail records every API call in the account, including identity, time, source IP, and request and response details, and stores the events in S3, with optional integration into CloudWatch Logs. CloudWatch, by contrast, focuses on operational telemetry: it collects metrics, logs, and events, ingests log files from EC2, Lambda, VPC Flow Logs, CloudTrail, Route 53, and custom sources, and supports configurable log retention from 1 day to indefinitely. CloudWatch metrics are uniquely identified by namespace, metric name, and dimensions; standard resolution is 1 minute, detailed resolution is 1 second. Standard-resolution metrics are kept for 15 months, with 1-minute data available for the first 15 days and aggregated to 5-minute and 1-hour granularity afterwards, while 1-second detailed metrics expire after 3 hours. A CloudWatch alarm watches a single metric over a period and triggers one or more actions (SNS notification, Auto Scaling, EC2 stop or terminate) when the threshold is crossed for a configured number of evaluation periods. For containerized workloads, CloudWatch Container Insights collects and summarizes metrics and logs from ECS, EKS, Fargate, and Kubernetes. AWS X-Ray adds distributed tracing, capturing traces, segments, and errors with a service map and SDKs for the most common languages.
On the security side, AWS KMS creates and controls customer master keys used to encrypt data across most AWS services, supporting symmetric and asymmetric keys, key policies, aliases, rotation, and cross-account access. The distinction between AWS managed and customer managed CMKs is important: AWS managed CMKs are created and managed by AWS services on your behalf and cannot be manually rotated or shared, while customer managed CMKs are created and managed by you and can be rotated, aliased, and shared across accounts. Envelope encryption, where a data key encrypts the data and a KMS CMK encrypts the data key, reduces KMS API calls and lets you encrypt large payloads efficiently.
Secrets handling is split between AWS Secrets Manager and SSM Parameter Store. Parameter Store, free in its standard tier, holds configuration and secrets, with optional KMS-encrypted SecureString values and versioning. Secrets Manager is paid, designed specifically for secrets, integrates with RDS, Redshift, and DocumentDB, and adds automatic rotation via Lambda and cross-region replication. In front of APIs and web apps, AWS WAF inspects HTTP/S requests for common exploits such as SQL injection, XSS, bad bots, and IP-based rate limiting and attaches to CloudFront, ALB, API Gateway, AppSync, and Cognito User Pools. AWS Shield protects against DDoS attacks: Shield Standard is free for all customers and defends against common network and transport layer attacks, while Shield Advanced adds detection, mitigation, cost protection, and 24/7 access to the DDoS Response Team.
Finally, infrastructure and deployment on AWS are modeled declaratively. AWS CloudFormation provisions resources from JSON or YAML templates and extends to multiple accounts and regions via StackSets, with drift detection, change sets, and nested stacks. SAM is a CloudFormation extension with simplified syntax for serverless resources, transformed into standard CloudFormation at deploy time, while the AWS CDK lets developers define cloud resources in TypeScript, Python, Java, Go, or .NET and synthesize them into CloudFormation templates. With application code, the AWS SDK applies exponential backoff with jitter for retryable errors such as throttling and 5xx responses with a default of 3 retries, and supports automatic pagination via continuation tokens like NextToken, Marker, and NextContinuationToken, exposed as paginators and async iterators. Together, these observability, security, and DevOps tools complete the picture of building, deploying, and operating production applications on AWS.