AWS CloudWatch

The Integration Poller pulls metrics from AWS CloudWatch on a fixed interval and feeds them into InfraSage for anomaly detection and RCA.

Supported AWS services

Service	Metrics pulled
EC2	CPUUtilization, NetworkIn/Out, DiskReadBytes/WriteBytes, StatusCheckFailed
RDS	CPUUtilization, DatabaseConnections, FreeStorageSpace, ReadLatency, WriteLatency
Lambda	Duration, Errors, Throttles, ConcurrentExecutions, Iterator Age
ALB	RequestCount, TargetResponseTime, HTTPCode_Target_5XX_Count, HealthyHostCount
DynamoDB	ConsumedReadCapacityUnits, ConsumedWriteCapacityUnits, SuccessfulRequestLatency
S3	BucketSizeBytes, NumberOfObjects, AllRequests, 4xxErrors, 5xxErrors
SNS	NumberOfMessagesPublished, NumberOfNotificationsFailed

Configuration

Prerequisites

The Integration Poller needs AWS credentials with cloudwatch:GetMetricData and cloudwatch:ListMetrics permissions.

Using IAM role (recommended for EC2/ECS/EKS):

Attach this policy to your instance/task role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    }
  ]
}

Using access keys (for non-AWS environments):

AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Polling configuration

# How often to poll CloudWatch (seconds)
CLOUDWATCH_POLL_INTERVAL_SECONDS=60

# AWS region
AWS_REGION=us-east-1

# Optional: filter to specific namespaces
CLOUDWATCH_NAMESPACES=AWS/EC2,AWS/RDS,AWS/Lambda

What gets ingested

For each CloudWatch metric, InfraSage creates a telemetry record with:

• service_id: derived from the AWS resource identifier, for example ec2-i-0abc12345 or rds-mydb
• metric_name: the CloudWatch metric name in snake_case, for example cpu_utilization
• value: the metric value at the polling timestamp
• attributes: the AWS resource dimensions (InstanceId, DBInstanceIdentifier, FunctionName, and so on)

SNS subscriptions (push mode)

Instead of polling, you can push CloudWatch alarms to InfraSage via SNS:

1. Create an SNS topic in your AWS account
2. Subscribe the InfraSage webhook endpoint:

   https://your-infrasage-host:9093/api/v1/alerts/webhook

3. Configure CloudWatch Alarms to publish to the SNS topic
4. InfraSage receives alarm state changes in real time

Example: monitoring an EC2 fleet

Once the CloudWatch integration is running, InfraSage detects anomalies on your EC2 instances on its own:

# View CloudWatch-sourced metrics in ClickHouse
docker exec infrasage-clickhouse clickhouse-client \
  --user infrasage --password infrasage-dev \
  --query "
    SELECT service_id, metric_name, avg(value) AS avg, max(value) AS peak
    FROM infrasage.infrasage_raw_firehose
    WHERE attributes LIKE '%AWS/EC2%'
    AND timestamp > now() - INTERVAL 1 HOUR
    GROUP BY service_id, metric_name
    ORDER BY peak DESC
    LIMIT 20
  "

Verification

# Check poller is running
docker logs infrasage-integration-poller -f | grep -i cloudwatch

# Verify data flowing in
curl -s '$PROMETHEUS_URL/api/v1/query?query=infrasage_cloudwatch_metrics_total'