AWS Cloud Monitoring
MCP Server
- Command:
uvx awslabs.cloudwatch-mcp-server@latest (stdio transport)
- Requires:
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)
Key Capabilities
- Metrics: Query CloudWatch metrics for any AWS service (EC2, ELB, TGW, NAT GW, VPN)
- Alarms: List and inspect CloudWatch alarms and their states
- Logs: Run CloudWatch Logs Insights queries across any log group
- Flow Logs: Analyze VPC and TGW flow logs for traffic patterns and dropped connections
Workflow: Network Monitoring Dashboard
When a user asks "how is our AWS network performing?":
- Check alarms: List CloudWatch alarms in ALARM state
- VPN metrics: Tunnel state, bytes in/out for site-to-site VPNs
- NAT Gateway metrics: Active connections, packets dropped, bytes processed
- Transit Gateway metrics: Bytes in/out, packets dropped per attachment
- ELB metrics: Healthy/unhealthy targets, latency, 5xx errors
- Report: Network health dashboard with any issues flagged
Workflow: Flow Log Analysis
When investigating traffic patterns or security events:
- Query VPC flow logs: Filter by source IP, destination IP, port, action (ACCEPT/REJECT)
- Identify rejected traffic: Find REJECT entries to see blocked connections
- Top talkers: Aggregate by source/destination to find heaviest traffic flows
- Time correlation: Narrow to specific time windows around incidents
- Report: Traffic analysis with recommendations
Common CloudWatch Network Metrics
| Service |
Metric |
What It Tells You |
| VPN |
TunnelState |
0=down, 1=up for each tunnel |
| VPN |
TunnelDataIn/Out |
Bytes through each VPN tunnel |
| NAT GW |
ActiveConnectionCount |
Active NAT connections |
| NAT GW |
PacketsDropCount |
Packets dropped (capacity issue) |
| NAT GW |
BytesProcessed |
Traffic volume through NAT |
| TGW |
BytesIn/BytesOut |
Traffic per TGW attachment |
| TGW |
PacketDropCountBlackhole |
Blackhole route drops |
| ELB |
HealthyHostCount |
Healthy targets behind ALB/NLB |
| ELB |
TargetResponseTime |
Backend latency |
| EC2 |
NetworkIn/NetworkOut |
Instance network throughput |
| EC2 |
NetworkPacketsIn/Out |
Instance packet rate |
Flow Log Query Examples
# Top rejected connections in last hour
fields @timestamp, srcAddr, dstAddr, dstPort, action
| filter action = "REJECT"
| stats count() as rejections by srcAddr, dstAddr, dstPort
| sort rejections desc
| limit 20
# Traffic from specific source
fields @timestamp, srcAddr, dstAddr, dstPort, bytes, action
| filter srcAddr = "10.0.1.50"
| sort @timestamp desc
# Top talkers by bytes
fields srcAddr, dstAddr, bytes
| stats sum(bytes) as totalBytes by srcAddr, dstAddr
| sort totalBytes desc
| limit 10
Important Rules
- CloudWatch Logs Insights queries have a cost — be mindful of time range and data volume
- Region-specific — metrics and logs are scoped to the configured region
- Record in GAIT — log monitoring investigations for audit trail
Environment Variables
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)
1---
2name: aws-cloud-monitoring
3description: "AWS CloudWatch monitoring — metrics, alarms, log queries, VPC flow log analysis, network performance. Use when checking AWS alarms, analyzing VPC flow logs, investigating network latency, or monitoring VPN and NAT Gateway metrics."
4version: 1.0.0
5license: Apache-2.0
6tags: [aws, cloudwatch, monitoring, metrics, alarms, logs, flow-logs]
7---
8
9# AWS Cloud Monitoring
10
11## MCP Server
12
13- **Command**: `uvx awslabs.cloudwatch-mcp-server@latest` (stdio transport)
14- **Requires**: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` (or `AWS_PROFILE`)
15
16## Key Capabilities
17
18- **Metrics**: Query CloudWatch metrics for any AWS service (EC2, ELB, TGW, NAT GW, VPN)
19- **Alarms**: List and inspect CloudWatch alarms and their states
20- **Logs**: Run CloudWatch Logs Insights queries across any log group
21- **Flow Logs**: Analyze VPC and TGW flow logs for traffic patterns and dropped connections
22
23## Workflow: Network Monitoring Dashboard
24
25When a user asks "how is our AWS network performing?":
26
271. **Check alarms**: List CloudWatch alarms in ALARM state
282. **VPN metrics**: Tunnel state, bytes in/out for site-to-site VPNs
293. **NAT Gateway metrics**: Active connections, packets dropped, bytes processed
304. **Transit Gateway metrics**: Bytes in/out, packets dropped per attachment
315. **ELB metrics**: Healthy/unhealthy targets, latency, 5xx errors
326. **Report**: Network health dashboard with any issues flagged
33
34## Workflow: Flow Log Analysis
35
36When investigating traffic patterns or security events:
37
381. **Query VPC flow logs**: Filter by source IP, destination IP, port, action (ACCEPT/REJECT)
392. **Identify rejected traffic**: Find REJECT entries to see blocked connections
403. **Top talkers**: Aggregate by source/destination to find heaviest traffic flows
414. **Time correlation**: Narrow to specific time windows around incidents
425. **Report**: Traffic analysis with recommendations
43
44## Common CloudWatch Network Metrics
45
46| Service | Metric | What It Tells You |
47|---------|--------|-------------------|
48| VPN | `TunnelState` | 0=down, 1=up for each tunnel |
49| VPN | `TunnelDataIn/Out` | Bytes through each VPN tunnel |
50| NAT GW | `ActiveConnectionCount` | Active NAT connections |
51| NAT GW | `PacketsDropCount` | Packets dropped (capacity issue) |
52| NAT GW | `BytesProcessed` | Traffic volume through NAT |
53| TGW | `BytesIn/BytesOut` | Traffic per TGW attachment |
54| TGW | `PacketDropCountBlackhole` | Blackhole route drops |
55| ELB | `HealthyHostCount` | Healthy targets behind ALB/NLB |
56| ELB | `TargetResponseTime` | Backend latency |
57| EC2 | `NetworkIn/NetworkOut` | Instance network throughput |
58| EC2 | `NetworkPacketsIn/Out` | Instance packet rate |
59
60## Flow Log Query Examples
61
62```
63# Top rejected connections in last hour
64fields @timestamp, srcAddr, dstAddr, dstPort, action
65| filter action = "REJECT"
66| stats count() as rejections by srcAddr, dstAddr, dstPort
67| sort rejections desc
68| limit 20
69
70# Traffic from specific source
71fields @timestamp, srcAddr, dstAddr, dstPort, bytes, action
72| filter srcAddr = "10.0.1.50"
73| sort @timestamp desc
74
75# Top talkers by bytes
76fields srcAddr, dstAddr, bytes
77| stats sum(bytes) as totalBytes by srcAddr, dstAddr
78| sort totalBytes desc
79| limit 10
80```
81
82## Important Rules
83
84- **CloudWatch Logs Insights queries have a cost** — be mindful of time range and data volume
85- **Region-specific** — metrics and logs are scoped to the configured region
86- **Record in GAIT** — log monitoring investigations for audit trail
87
88## Environment Variables
89
90- `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` (or `AWS_PROFILE`)
gabrielmoreira