Observability in AWS splits naturally between what happened and how the system is behaving. CloudTrail records the API audit trail: who called which API on which resource. By default, events are retained 90 days in the console, and you should ship them to S3 for long-term retention, where a lifecycle rule can move them to Glacier. CloudWatch, by contrast, collects operational metrics and logs and supports alarms, dashboards, and Insights queries for ad-hoc log analysis. For end-to-end latency tracing, AWS X-Ray follows requests across services and surfaces bottlenecks and errors.
For data and infrastructure protection, the line between snapshots, AMIs, and AWS Backup often appears in the exam. An EBS snapshot is a point-in-time copy of a volume, an AMI is a snapshot plus launch metadata, and AWS Backup is a cross-service policy engine that schedules and tracks backups for EBS, RDS, DynamoDB, EFS, and more. CloudFormation Drift Detection compares deployed resources against your template to surface out-of-band changes, and the AWS CDK lets you author IaC in TypeScript or Python that compiles to CloudFormation.
Disaster recovery is described by two numbers. RPO is the maximum data loss you can tolerate, and RTO is the maximum downtime. AWS classifies DR strategies from cheapest and slowest to most expensive and fastest: Backup and Restore (high RPO/RTO, low cost), Pilot Light (minimal always-on core, scaled out at recovery), Warm Standby (a scaled-down but running environment), and Multi-Site Active/Active (full capacity in two regions, near-zero RPO and RTO). Choosing among them is a business decision driven by cost versus the value of avoiding downtime.
Day-to-day cost and operational governance round out the picture. AWS Cost Anomaly Detection uses machine learning to alert on unusual spend, and the AWS Pricing Calculator gives a pre-deployment estimate of monthly bills. Service Quotas are tracked in a dedicated console where you can request increases. To replace SSH bastions, SSM Session Manager provides IAM-controlled, audit-logged shell access through the SSM agent with no inbound ports open. And for cheap long-term log archival, a CloudWatch Logs subscription filter can stream into Kinesis Data Firehose, which writes to S3 with a lifecycle rule transitioning old data into Glacier.