Amazon CloudWatch Internet Monitor Diagnostics
When to use
Any CloudWatch Internet Monitor investigation — monitor creation, configuration, health event analysis, availability score issues, traffic insights, city-network analysis, CloudFront/VPC integrations, log delivery, or threshold configuration.
Investigation workflow
Step 1 — Collect and triage
aws internetmonitor list-monitors --query 'Monitors[*].{Name:MonitorName,Status:Status,ProcessingStatus:ProcessingStatus}'
aws internetmonitor get-monitor --monitor-name <name> --query '{Status:Status,Resources:Resources,MaxCityNetworksToMonitor:MaxCityNetworksToMonitor}'
aws internetmonitor list-health-events --monitor-name <name> --event-status ACTIVE
Step 2 — Domain deep dive
aws internetmonitor get-health-event --monitor-name <name> --event-id <event-id>
aws internetmonitor get-internet-event --event-id <event-id>
aws internetmonitor get-query-results --monitor-name <name> --query-id <query-id>
Step 3 — Detailed investigation
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=internetmonitor.amazonaws.com --max-results 20
aws internetmonitor list-internet-events --query 'InternetEvents[*].{EventId:EventId,Status:Status,StartedAt:StartedAt}'
aws logs describe-log-groups --log-group-name-prefix /aws/internetmonitor
Read references/guardrails.md before concluding on any Internet Monitor issue.
Tool quick reference
| Tool / API |
When to use |
internetmonitor list-monitors |
List all monitors |
internetmonitor get-monitor |
Get monitor details and configuration |
internetmonitor list-health-events |
List health events for a monitor |
internetmonitor get-health-event |
Get health event details |
internetmonitor get-internet-event |
Get global internet event details |
internetmonitor start-query |
Start a data query for traffic insights |
internetmonitor get-query-results |
Retrieve query results |
Gotchas: CloudWatch Internet Monitor
- Internet Monitor requires at least one monitored resource (CloudFront distribution or VPC). A monitor with no resources will show INACTIVE status.
- MaxCityNetworksToMonitor controls how many city-networks are tracked. The default is 500,000. Higher values increase cost but improve coverage.
- Health events are generated when performance or availability drops below thresholds. Default thresholds are availability < 96% and performance < 95%.
- Internet Monitor uses passive traffic analysis — it does NOT send synthetic probes. It analyzes existing application traffic patterns.
- Availability scores and performance scores are calculated per city-network pair. A single city-network issue may not affect the overall score significantly.
- S3 and CloudWatch Logs delivery must be configured explicitly. They are not enabled by default.
- Internet Monitor is regional. Each monitor operates in the region where it is created and monitors resources in that region.
Anti-hallucination rules
- Always cite specific monitor names, event IDs, or API responses as evidence.
- Internet Monitor uses passive traffic analysis, NOT synthetic monitoring. Never claim it sends probes.
- Health events reflect observed degradation, not predicted issues. Never claim predictive capability.
- Availability and performance scores are per city-network. Never present a single city-network score as the overall score.
- Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.
12 runbooks
| Category |
IDs |
Covers |
| A — Monitor Setup |
A1–A2 |
Creation failures, configuration |
| B — Health Events |
B1–B2 |
Health event analysis, availability score issues |
| C — Traffic Insights |
C1–C2 |
Traffic insights errors, city-network analysis |
| D — Integrations |
D1–D2 |
CloudFront integration, VPC integration |
| E — Log Delivery |
E1–E2 |
S3 log delivery, CloudWatch log delivery |
| F — Thresholds |
F1 |
Threshold configuration |
| Z — Catch-All |
Z1 |
General troubleshooting |
1---2name: internetmonitor-diagnostics3description: Use this skill to investigate and troubleshoot Amazon CloudWatch Internet Monitor problems by analyzing monitor creation, configuration, health events, availability scores, traffic insights, city-network analysis, CloudFront/VPC integrations, log delivery, threshold configuration, and following structured runbooks. Activate when: monitor creation failures, health event analysis issues, availability score problems, traffic insight errors, integration failures, log delivery issues, threshold configuration problems, or the user says something is wrong with Internet Monitor.4---56# Amazon CloudWatch Internet Monitor Diagnostics78## When to use910Any CloudWatch Internet Monitor investigation — monitor creation, configuration, health event analysis, availability score issues, traffic insights, city-network analysis, CloudFront/VPC integrations, log delivery, or threshold configuration.1112## Investigation workflow1314### Step 1 — Collect and triage1516```17aws internetmonitor list-monitors --query 'Monitors[*].{Name:MonitorName,Status:Status,ProcessingStatus:ProcessingStatus}'18aws internetmonitor get-monitor --monitor-name <name> --query '{Status:Status,Resources:Resources,MaxCityNetworksToMonitor:MaxCityNetworksToMonitor}'19aws internetmonitor list-health-events --monitor-name <name> --event-status ACTIVE20```2122### Step 2 — Domain deep dive2324```25aws internetmonitor get-health-event --monitor-name <name> --event-id <event-id>26aws internetmonitor get-internet-event --event-id <event-id>27aws internetmonitor get-query-results --monitor-name <name> --query-id <query-id>28```2930### Step 3 — Detailed investigation3132```33aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=internetmonitor.amazonaws.com --max-results 2034aws internetmonitor list-internet-events --query 'InternetEvents[*].{EventId:EventId,Status:Status,StartedAt:StartedAt}'35aws logs describe-log-groups --log-group-name-prefix /aws/internetmonitor36```3738Read `references/guardrails.md` before concluding on any Internet Monitor issue.3940## Tool quick reference4142| Tool / API | When to use |43|------------|-------------|44| `internetmonitor list-monitors` | List all monitors |45| `internetmonitor get-monitor` | Get monitor details and configuration |46| `internetmonitor list-health-events` | List health events for a monitor |47| `internetmonitor get-health-event` | Get health event details |48| `internetmonitor get-internet-event` | Get global internet event details |49| `internetmonitor start-query` | Start a data query for traffic insights |50| `internetmonitor get-query-results` | Retrieve query results |5152## Gotchas: CloudWatch Internet Monitor5354- Internet Monitor requires at least one monitored resource (CloudFront distribution or VPC). A monitor with no resources will show INACTIVE status.55- MaxCityNetworksToMonitor controls how many city-networks are tracked. The default is 500,000. Higher values increase cost but improve coverage.56- Health events are generated when performance or availability drops below thresholds. Default thresholds are availability < 96% and performance < 95%.57- Internet Monitor uses passive traffic analysis — it does NOT send synthetic probes. It analyzes existing application traffic patterns.58- Availability scores and performance scores are calculated per city-network pair. A single city-network issue may not affect the overall score significantly.59- S3 and CloudWatch Logs delivery must be configured explicitly. They are not enabled by default.60- Internet Monitor is regional. Each monitor operates in the region where it is created and monitors resources in that region.6162## Anti-hallucination rules63641. Always cite specific monitor names, event IDs, or API responses as evidence.652. Internet Monitor uses passive traffic analysis, NOT synthetic monitoring. Never claim it sends probes.663. Health events reflect observed degradation, not predicted issues. Never claim predictive capability.674. Availability and performance scores are per city-network. Never present a single city-network score as the overall score.685. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.6970## 12 runbooks7172| Category | IDs | Covers |73|----------|-----|--------|74| A — Monitor Setup | A1–A2 | Creation failures, configuration |75| B — Health Events | B1–B2 | Health event analysis, availability score issues |76| C — Traffic Insights | C1–C2 | Traffic insights errors, city-network analysis |77| D — Integrations | D1–D2 | CloudFront integration, VPC integration |78| E — Log Delivery | E1–E2 | S3 log delivery, CloudWatch log delivery |79| F — Thresholds | F1 | Threshold configuration |80| Z — Catch-All | Z1 | General troubleshooting |
aws-samples