AWS Cloud Monitoring
MCP Server
- Command:
uvx awslabs.cloudwatch-mcp-server@latest (stdio transport)
- Requires:
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)
Key Capabilities
- Metrics: Query CloudWatch metrics for any AWS service (EC2, ELB, TGW, NAT GW, VPN)
- Alarms: List and inspect CloudWatch alarms and their states
- Logs: Run CloudWatch Logs Insights queries across any log group
- Flow Logs: Analyze VPC and TGW flow logs for traffic patterns and dropped connections
Workflow: Network Monitoring Dashboard
When a user asks "how is our AWS network performing?":
- Check alarms: List CloudWatch alarms in ALARM state
- VPN metrics: Tunnel state, bytes in/out for site-to-site VPNs
- NAT Gateway metrics: Active connections, packets dropped, bytes processed
- Transit Gateway metrics: Bytes in/out, packets dropped per attachment
- ELB metrics: Healthy/unhealthy targets, latency, 5xx errors
- Report: Network health dashboard with any issues flagged
Workflow: Flow Log Analysis
When investigating traffic patterns or security events:
- Query VPC flow logs: Filter by source IP, destination IP, port, action (ACCEPT/REJECT)
- Identify rejected traffic: Find REJECT entries to see blocked connections
- Top talkers: Aggregate by source/destination to find heaviest traffic flows
- Time correlation: Narrow to specific time windows around incidents
- Report: Traffic analysis with recommendations
Common CloudWatch Network Metrics
| Service |
Metric |
What It Tells You |
| VPN |
TunnelState |
0=down, 1=up for each tunnel |
| VPN |
TunnelDataIn/Out |
Bytes through each VPN tunnel |
| NAT GW |
ActiveConnectionCount |
Active NAT connections |
| NAT GW |
PacketsDropCount |
Packets dropped (capacity issue) |
| NAT GW |
BytesProcessed |
Traffic volume through NAT |
| TGW |
BytesIn/BytesOut |
Traffic per TGW attachment |
| TGW |
PacketDropCountBlackhole |
Blackhole route drops |
| ELB |
HealthyHostCount |
Healthy targets behind ALB/NLB |
| ELB |
TargetResponseTime |
Backend latency |
| EC2 |
NetworkIn/NetworkOut |
Instance network throughput |
| EC2 |
NetworkPacketsIn/Out |
Instance packet rate |
Flow Log Query Examples
# Top rejected connections in last hour
fields @timestamp, srcAddr, dstAddr, dstPort, action
| filter action = "REJECT"
| stats count() as rejections by srcAddr, dstAddr, dstPort
| sort rejections desc
| limit 20
# Traffic from specific source
fields @timestamp, srcAddr, dstAddr, dstPort, bytes, action
| filter srcAddr = "10.0.1.50"
| sort @timestamp desc
# Top talkers by bytes
fields srcAddr, dstAddr, bytes
| stats sum(bytes) as totalBytes by srcAddr, dstAddr
| sort totalBytes desc
| limit 10
Important Rules
- CloudWatch Logs Insights queries have a cost — be mindful of time range and data volume
- Region-specific — metrics and logs are scoped to the configured region
- Record in GAIT — log monitoring investigations for audit trail
Environment Variables
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)
1---2name: aws-cloud-monitoring3description: AWS CloudWatch monitoring — metrics, alarms, log queries, VPC flow log analysis, network performance. Use when checking AWS alarms, analyzing VPC flow logs, investigating network latency, or monitoring VPN and NAT Gateway metrics.4license: Apache-2.05---6
7# AWS Cloud Monitoring
8
9## MCP Server
10
11- **Command**: `uvx awslabs.cloudwatch-mcp-server@latest` (stdio transport)
12- **Requires**: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` (or `AWS_PROFILE`)
13
14## Key Capabilities
15
16- **Metrics**: Query CloudWatch metrics for any AWS service (EC2, ELB, TGW, NAT GW, VPN)
17- **Alarms**: List and inspect CloudWatch alarms and their states
18- **Logs**: Run CloudWatch Logs Insights queries across any log group
19- **Flow Logs**: Analyze VPC and TGW flow logs for traffic patterns and dropped connections
20
21## Workflow: Network Monitoring Dashboard
22
23When a user asks "how is our AWS network performing?":
24
251. **Check alarms**: List CloudWatch alarms in ALARM state
262. **VPN metrics**: Tunnel state, bytes in/out for site-to-site VPNs
273. **NAT Gateway metrics**: Active connections, packets dropped, bytes processed
284. **Transit Gateway metrics**: Bytes in/out, packets dropped per attachment
295. **ELB metrics**: Healthy/unhealthy targets, latency, 5xx errors
306. **Report**: Network health dashboard with any issues flagged
31
32## Workflow: Flow Log Analysis
33
34When investigating traffic patterns or security events:
35
361. **Query VPC flow logs**: Filter by source IP, destination IP, port, action (ACCEPT/REJECT)
372. **Identify rejected traffic**: Find REJECT entries to see blocked connections
383. **Top talkers**: Aggregate by source/destination to find heaviest traffic flows
394. **Time correlation**: Narrow to specific time windows around incidents
405. **Report**: Traffic analysis with recommendations
41
42## Common CloudWatch Network Metrics
43
44| Service | Metric | What It Tells You |
45|---------|--------|-------------------|
46| VPN | `TunnelState` | 0=down, 1=up for each tunnel |
47| VPN | `TunnelDataIn/Out` | Bytes through each VPN tunnel |
48| NAT GW | `ActiveConnectionCount` | Active NAT connections |
49| NAT GW | `PacketsDropCount` | Packets dropped (capacity issue) |
50| NAT GW | `BytesProcessed` | Traffic volume through NAT |
51| TGW | `BytesIn/BytesOut` | Traffic per TGW attachment |
52| TGW | `PacketDropCountBlackhole` | Blackhole route drops |
53| ELB | `HealthyHostCount` | Healthy targets behind ALB/NLB |
54| ELB | `TargetResponseTime` | Backend latency |
55| EC2 | `NetworkIn/NetworkOut` | Instance network throughput |
56| EC2 | `NetworkPacketsIn/Out` | Instance packet rate |
57
58## Flow Log Query Examples
59
60```
61# Top rejected connections in last hour
62fields @timestamp, srcAddr, dstAddr, dstPort, action
63| filter action = "REJECT"
64| stats count() as rejections by srcAddr, dstAddr, dstPort
65| sort rejections desc
66| limit 20
67
68# Traffic from specific source
69fields @timestamp, srcAddr, dstAddr, dstPort, bytes, action
70| filter srcAddr = "10.0.1.50"
71| sort @timestamp desc
72
73# Top talkers by bytes
74fields srcAddr, dstAddr, bytes
75| stats sum(bytes) as totalBytes by srcAddr, dstAddr
76| sort totalBytes desc
77| limit 10
78```
79
80## Important Rules
81
82- **CloudWatch Logs Insights queries have a cost** — be mindful of time range and data volume
83- **Region-specific** — metrics and logs are scoped to the configured region
84- **Record in GAIT** — log monitoring investigations for audit trail
85
86## Environment Variables
87
88- `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` (or `AWS_PROFILE`)
gabrielmoreira