AWS Academy Cloud Foundations — Module 10: Auto Scaling and Monitoring

Module Objective: Configure the components of an Amazon EC2 Auto Scaling group, describe the available scaling policies, and explain how Amazon CloudWatch, AWS CloudTrail, and AWS Trusted Advisor provide visibility into a running AWS environment.

Builds on Module 6, which introduced Auto Scaling and Elastic Beanstalk briefly; this module goes deeper into scaling mechanics and pairs it with monitoring.

Amazon EC2 Auto Scaling in Depth

An Auto Scaling group (ASG) manages a collection of EC2 instances as a single unit, launching new instances from a template and terminating unneeded ones automatically to match capacity to demand.

Component	What It Defines
Launch template	The AMI, instance type, and configuration used whenever the group launches a new instance
Minimum capacity	The fewest instances the group will ever run
Maximum capacity	The most instances the group is allowed to run
Desired capacity	The number of instances the group tries to maintain right now, adjustable manually or automatically

🔵 Note An Auto Scaling group is typically spread across multiple Availability Zones and paired with a load balancer (Module 5) — the group decides how many instances exist, while the load balancer decides how traffic reaches them.

Auto Scaling Policies

A scaling policy tells an Auto Scaling group when and how to change its desired capacity. AWS supports several approaches, which can be combined.

Policy Type	How It Decides to Scale
Manual scaling	An administrator directly changes the desired capacity
Dynamic scaling	Reacts in real time to a CloudWatch metric, e.g. adding instances when average CPU utilization crosses a threshold
Scheduled scaling	Changes capacity at specific, known times, e.g. scaling up before a predictable daily peak
Predictive scaling	Uses machine learning to forecast future traffic and schedule capacity ahead of demand

✅ Tip — Combine Policy Types It's common to combine scheduled scaling for known daily/weekly patterns with dynamic scaling to handle unexpected spikes on top of that baseline — the two aren't mutually exclusive.

Health Checks and Instance Replacement

An Auto Scaling group continuously checks the health of its instances and automatically replaces any that fail, keeping the group's capacity at its desired level without manual intervention.

Health Check Type	What It Verifies
EC2 status checks	Whether the underlying instance and its system are running correctly
Elastic Load Balancing health checks	Whether the application on the instance is actually responding correctly, as seen by the attached load balancer

⚠️ Warning — An Instance Can Be "Running" but Unhealthy An instance can pass basic EC2 status checks while its application has crashed or hung. Using ELB health checks in addition to EC2 status checks catches this kind of failure that infrastructure-level checks alone would miss.

Amazon CloudWatch Fundamentals

Amazon CloudWatch is AWS's monitoring and observability service, collecting metrics, logs, and events from AWS resources and applications into one place.

Data Type	What It Captures
Metrics	Time-ordered numeric data points, e.g. CPU utilization, request count, queue depth
Logs (CloudWatch Logs)	Application and system log data collected and stored centrally for search and analysis
Events	Near real-time notifications of changes in AWS resources, often used to trigger automated responses

🔵 Note Most AWS services automatically publish basic metrics to CloudWatch at no additional cost — dynamic scaling policies (this module) commonly react to exactly these built-in metrics, such as an ASG's average CPU utilization.

CloudWatch Alarms and Dashboards

Collecting data is only useful if something acts on it. CloudWatch turns metrics into action through alarms, and into visibility through dashboards.

Feature	What It Does
CloudWatch Alarm	Watches a metric against a threshold and triggers an action — such as an SNS notification (Module 9) or a scaling policy — when it's breached
CloudWatch Dashboard	A customizable, visual display of selected metrics and alarms in one view

✅ Tip — Alarms Are the Trigger for Dynamic Scaling A dynamic scaling policy in this module is really just an Auto Scaling group configured to react to a CloudWatch alarm — the alarm-and-action pattern is the same mechanism whether the action is a notification or a scaling event.

AWS CloudTrail

AWS CloudTrail records API calls made within an AWS account — who did what, when, and from where — providing an audit trail for governance, compliance, and troubleshooting.

Property	Detail
What it logs	The identity of the caller, the API action, the time, source IP, and request/response details
Enabled by default	Basic event history is available automatically; a Trail can be configured for continuous delivery of logs to Amazon S3

🔵 Note — CloudWatch vs. CloudTrail These two are easy to confuse by name: CloudWatch answers "what is my system doing right now?" (performance and health), while CloudTrail answers "who did what to my account?" (activity and governance).

AWS Trusted Advisor

AWS Trusted Advisor inspects an AWS account and offers recommendations across several categories, comparing the account's configuration against AWS best practices.

Category	Example Check
Cost Optimization	Identifying idle or underutilized resources
Performance	Flagging service usage approaching a limit
Security	Checking for open security group ports or MFA not enabled on the root user (Module 4)
Fault Tolerance	Identifying single points of failure, such as an Auto Scaling group in only one AZ
Service Limits	Warning when usage is approaching an account's service quota

⚠️ Warning — Check Depth Depends on Support Plan Every account gets a core set of Trusted Advisor checks for free, but the full set of checks across all categories requires a Business, Enterprise On-Ramp, or Enterprise Support plan (Module 2).

Bringing Scaling and Monitoring Together

In a typical production architecture, these services work together as a closed loop: CloudWatch observes resource behavior, alarms detect when action is needed, and Auto Scaling responds automatically — while CloudTrail and Trusted Advisor provide oversight of the account as a whole.

Question	Service to Reach For
Is my application's CPU or memory usage too high right now?	Amazon CloudWatch
Should I add or remove instances based on that usage?	Amazon EC2 Auto Scaling
Who deleted that S3 bucket, and when?	AWS CloudTrail
Am I following AWS best practices across my whole account?	AWS Trusted Advisor

🔵 Note This closed-loop pattern — observe, alarm, react — is a concrete implementation of the Reliability and Operational Excellence pillars of the Well-Architected Framework covered in Module 9.

Key Terms for Module 10

Auto Scaling group (ASG): A collection of EC2 instances managed as a unit, with a defined minimum, maximum, and desired capacity
launch template: Defines the AMI, instance type, and configuration an Auto Scaling group uses to launch new instances
dynamic scaling: A scaling policy that reacts in real time to a CloudWatch metric
scheduled scaling: A scaling policy that changes capacity at specific, known times
predictive scaling: A scaling policy that uses machine learning to forecast demand and schedule capacity ahead of it
Amazon CloudWatch: AWS's monitoring and observability service, collecting metrics, logs, and events
CloudWatch alarm: Watches a metric against a threshold and triggers an action when it's breached
AWS CloudTrail: Records API calls made within an AWS account for auditing and governance
AWS Trusted Advisor: Inspects an account and offers recommendations across cost, performance, security, fault tolerance, and service limits

Review Questions

What is the difference between an Auto Scaling group's minimum, maximum, and desired capacity?
What is the difference between dynamic, scheduled, and predictive scaling policies, and when might a workload use more than one at once?
Why might an instance pass its EC2 status checks but still fail its Elastic Load Balancing health check?
What are the three main types of data Amazon CloudWatch collects?
How does a CloudWatch alarm relate to a dynamic scaling policy?
What is the key difference in purpose between Amazon CloudWatch and AWS CloudTrail?
What categories of recommendations does AWS Trusted Advisor provide, and how does the depth of those checks depend on an account's Support plan?