CloudWatch Metric Guide

DatabaseConnections

DatabaseConnections counts the number of client network connections open to the RDS instance at the time of sampling. It reflects both active and idle connections held by your application's connection pool.

Threshold

≥ 80% of your RDS instance's max_connections parameter value

FreeableMemory

FreeableMemory reports the amount of available random access memory on the RDS instance, in bytes. It includes memory in the OS free pool plus reclaimable cached and buffered memory.

Threshold

< 25% of total instance RAM (or a specific byte floor for your instance class)

CPUUtilization

CPUUtilization measures the percentage of CPU capacity consumed by the RDS instance across all available vCPUs. It is the aggregate across all cores.

Threshold

> 80% sustained for 5 minutes or more

FreeStorageSpace

FreeStorageSpace reports the available storage capacity on the RDS instance's EBS volume, in bytes. When this reaches zero, the database stops accepting writes.

Threshold

< 20% of total allocated storage, or < 5 GB absolute floor (whichever is larger)

LAMBDA

AWS Lambda

4 metrics covered

Errors

Errors counts the number of Lambda invocations that resulted in a function error — including exceptions thrown by the function code and runtime errors (timeout, out-of-memory, handler not found).

Threshold

> 0 in any 5-minute window for critical functions; > N errors/minute for high-volume functions (set N based on your acceptable error rate)

Duration

Duration measures the elapsed wall-clock time from when the Lambda function handler begins executing to when it returns or times out. CloudWatch publishes minimum, maximum, average, and percentile statistics.

Threshold

p99 Duration > 80% of the function's configured timeout

Throttles

Throttles counts invocation requests that Lambda rejected because concurrent execution limits were reached. A throttled invocation was not executed — the caller receives a 429 TooManyRequestsException.

Threshold

> 0 for critical functions; for high-volume functions, a low absolute count threshold based on your acceptable drop rate

ConcurrentExecutions

ConcurrentExecutions reports the number of Lambda function instances actively processing events at any given time, across the entire account or per function when filtered by function name.

Threshold

> 800 concurrent executions at the account level (for accounts at the default 1,000 limit)

ECS

Amazon ECS

3 metrics covered

AWS/ECS

CPUUtilization

CPUUtilization for ECS measures the percentage of CPU units reserved by the tasks in a service that are in use, averaged across the tasks in the service.

Threshold

> 85% sustained for 3 minutes

AWS/ECS

MemoryUtilization

MemoryUtilization for ECS measures the percentage of memory reserved by the tasks in a service that is in use, averaged across the running tasks.

Threshold

> 85% averaged across the service

AWS/ECS

RunningTaskCount

RunningTaskCount reports the number of tasks in the RUNNING state for an ECS service. Tasks not in RUNNING are either pending, provisioning, deprovisioning, or stopped.

Threshold

< desired task count for the service

ALB

Application Load Balancer

3 metrics covered

AWS/ApplicationELB

HTTPCode_ELB_5XX_Count

HTTPCode_ELB_5XX_Count counts HTTP 5XX response codes generated by the load balancer itself — not by the registered targets. These indicate the ALB could not deliver the request to a healthy target.

Threshold

> 0 in any 5-minute window

AWS/ApplicationELB

TargetResponseTime

Seconds

TargetResponseTime measures the time elapsed from when the ALB sent the request to a registered target until the target started sending a response, in seconds. CloudWatch exposes this as p50, p90, p95, and p99 percentiles.

Threshold

p99 TargetResponseTime > your defined SLA threshold (typically 1s for APIs, 3s for pages)

AWS/ApplicationELB

UnHealthyHostCount

UnHealthyHostCount reports the number of targets (EC2 instances, ECS tasks, Lambda functions) registered with the ALB target group that are currently failing health checks.

Threshold

> 0 (any unhealthy host in a production target group)

EC2

Amazon EC2

4 metrics covered

CPUUtilization

CPUUtilization measures the percentage of allocated EC2 compute units (vCPUs) that are in use on the instance, as reported by the hypervisor.

Threshold

> 80% for 15 consecutive minutes

NetworkIn

NetworkIn measures the number of bytes received by the instance on all network interfaces during the CloudWatch measurement period.

Threshold

Anomaly detection recommended over fixed threshold — alert when NetworkIn exceeds 3 standard deviations above the historical baseline for the same time of day

NetworkOut

NetworkOut measures the number of bytes sent by the instance on all network interfaces during the CloudWatch measurement period.

Threshold

Anomaly detection recommended — alert when NetworkOut exceeds 3 standard deviations above baseline for the same time of day and day of week

StatusCheckFailed

StatusCheckFailed combines the results of both the instance status check (instance software and network configuration) and the system status check (underlying AWS host hardware). A value of 1 means at least one of these checks has failed.

Threshold

> 0 — alarm immediately

DYNAMODB

Amazon DynamoDB

4 metrics covered

ConsumedReadCapacityUnits

ConsumedReadCapacityUnits reports the number of read capacity units consumed over the specified time period for a DynamoDB table or global secondary index.

Threshold

> 80% of provisioned read capacity (for provisioned mode tables)

ThrottledRequests

ThrottledRequests counts requests to DynamoDB that were throttled because the request rate exceeded the provisioned throughput limits for the table or index.

Threshold

> 0 for provisioned capacity tables; > 0 as a cost and latency alert for on-demand tables

ConsumedWriteCapacityUnits

ConsumedWriteCapacityUnits reports the number of write capacity units consumed over the specified time period for a DynamoDB table or global secondary index, for both provisioned and on-demand capacity modes.

Threshold

> 80% of provisioned write capacity (for provisioned mode tables)

SuccessfulRequestLatency

SuccessfulRequestLatency measures the elapsed time for successful requests to DynamoDB or DynamoDB Streams, broken down by the TableName and Operation dimensions. It reflects latency inside DynamoDB only — not network or client-side time.

Threshold

p99 SuccessfulRequestLatency for a given Operation sustained noticeably above that operation's own rolling baseline (e.g., 2–3x the typical p99 for 5+ minutes)

SQS

Amazon SQS

3 metrics covered

AWS/SQS

ApproximateAgeOfOldestMessage

Seconds

ApproximateAgeOfOldestMessage reports how many seconds have passed since the oldest non-deleted message in the queue was sent. It measures processing lag directly, independent of how many messages are queued.

Threshold

≥ 50% of MessageRetentionPeriod (early warning), ≥ 80% of MessageRetentionPeriod (critical)

AWS/SQS

ApproximateNumberOfMessagesVisible

ApproximateNumberOfMessagesVisible reports the number of messages currently available to be received from the queue — the standard "queue depth" metric most SQS dashboards lead with.

Threshold

Sustained upward trend over 15+ minutes, evaluated with metric math against a rolling baseline rather than a fixed count

AWS/SQS

ApproximateNumberOfMessagesNotVisible

ApproximateNumberOfMessagesNotVisible reports the number of messages currently in flight — received by a consumer and hidden from other consumers for the duration of the visibility timeout, but not yet deleted.

Threshold

Flat and elevated for longer than your configured VisibilityTimeout, rather than a fixed count

APIGATEWAY

Amazon API Gateway

4 metrics covered

Latency

Latency measures the total time between when API Gateway receives a request from a client and when it returns a response. This includes the backend integration time (IntegrationLatency) plus API Gateway's own overhead — authorizers, request/response mapping templates, and throttling checks.

Threshold

p99 Latency > 3,000 ms (3 seconds) for 5 consecutive minutes

5XXError

5XXError counts server-side errors returned by API Gateway in a given period — responses indicating the backend integration failed, timed out, or API Gateway itself hit an internal problem. The Sum statistic gives the raw count; the Average statistic gives the error rate (5XXError count divided by total Count).

Threshold

Average (error rate) ≥ 1% over 5 minutes, OR any 5XXError on low-traffic APIs

4XXError

4XXError counts client-side errors captured by API Gateway in a given period — including throttling (429), authentication/authorization failures (401/403), and modified gateway responses. The Sum statistic gives the raw count; the Average statistic gives the error rate (4XXError count divided by total Count).

Threshold

Average (error rate) rises more than 3x above its trailing 24-hour baseline, sustained for 10 minutes

Count

Count is the total number of API requests API Gateway received in a given period, across all response codes. AWS represents this metric with the SampleCount statistic.

Threshold

Count drops below 50% of its trailing same-hour-of-week baseline for 10 consecutive minutes

Amazon S3

4 metrics covered

BucketSizeBytes

BucketSizeBytes reports the total size, in bytes, of all objects stored in a bucket for a given storage class — including current and noncurrent object versions, object metadata, and the parts of any incomplete multipart uploads. It is a free, always-on storage metric published once per day.

Threshold

Alarm on a >20% day-over-day increase (or use CloudWatch Anomaly Detection) rather than an absolute byte value

NumberOfObjects

NumberOfObjects reports the total count of objects in a general purpose bucket across all storage classes — including current and noncurrent versions, delete markers, and the parts of incomplete multipart uploads. Like BucketSizeBytes, it is a free storage metric published once per day, filtered with StorageType=AllStorageTypes.

Threshold

Alarm on a >20% day-over-day increase (or use CloudWatch Anomaly Detection) rather than an absolute count

4xxErrors

4xxErrors reports HTTP 4xx client error status codes returned for requests to a bucket, published as 0 or 1 per request. The Sum statistic gives the error count for the period; the Average statistic gives the error rate.

Threshold

Average (error rate) > 5% sustained for 5 minutes — or Sum-based, scaled to your normal request volume

5xxErrors

5xxErrors reports HTTP 5xx server error status codes returned by S3 for requests to a bucket, published as 0 or 1 per request. The Sum statistic gives the error count for the period; the Average statistic gives the error rate.

Threshold

Average (error rate) > 1% sustained for 5 minutes — or Sum > 0 sustained across periods for low-traffic buckets

CLOUDFRONT

Amazon CloudFront

4 metrics covered

Requests

None

Requests counts the total number of viewer requests received by CloudFront for a distribution, across all HTTP methods and both HTTP and HTTPS. Per AWS documentation, CloudWatch reports this metric with Unit set to "None" rather than "Count."

Threshold

Anomaly detection recommended over a fixed threshold — alarm when Requests falls more than 50% below the expected baseline for the same time of day, sustained for 3 consecutive 5-minute periods

5xxErrorRate

5xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 5xx range, indicating a server-side error at the origin or within CloudFront itself.

Threshold

> 1% sustained for 3 consecutive 5-minute periods (Average statistic)

4xxErrorRate

4xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 4xx range, indicating a client-side or request-validation error such as a missing resource or a denied request.

Threshold

> 5% sustained for 3 consecutive 5-minute periods (Average statistic)

OriginLatency

OriginLatency measures the total time, in milliseconds, from when CloudFront receives a request to when it starts sending a response back toward the network — but only for requests served from the origin (a cache miss), not from CloudFront's cache. Also known as first-byte latency or time-to-first-byte.

Threshold

p90 > 1000 ms sustained for 3 consecutive 5-minute periods (ExtendedStatistics p90)

ELASTICACHE

Amazon ElastiCache

4 metrics covered

CPUUtilization

CPUUtilization measures the percentage of CPU used by the entire cache node host, across all vCPUs — including the engine process plus OS and background management processes.

Threshold

> (90 ÷ number of vCPUs on the node)% sustained for 5 minutes — e.g. 45% on a 2-vCPU node

Evictions

Evictions counts the number of keys removed from the cache because the node hit its maxmemory limit — the engine had to make room for new writes by forcibly discarding existing data (distinct from keys expiring naturally via TTL).

Threshold

> 0, sustained for 5 minutes

CurrConnections

CurrConnections reports the number of client connections open to the node at the moment it's sampled. For Redis/Valkey it excludes read-replica connections and a handful (4–6) of connections ElastiCache itself uses to monitor the cluster; for Memcached the reserved/internal count differs slightly.

Threshold

> 80% of the cluster parameter group's maxclients value, sustained for 5 minutes

DatabaseMemoryUsagePercentage

DatabaseMemoryUsagePercentage reports the percentage of the engine's configured maxmemory currently in use, calculated as used_memory ÷ maxmemory from the Redis/Valkey INFO command. It is Redis/Valkey-specific — Memcached clusters do not emit this metric.

Threshold

> 90%, sustained for 5 minutes

EKS

Amazon EKS

4 metrics covered

pod_cpu_utilization

pod_cpu_utilization reports the percentage of CPU units used by a pod (or aggregated by Namespace, Service, or ClusterName, depending on which dimension set you query), calculated as pod_cpu_usage_total ÷ node_cpu_limit — the node's total CPU capacity, not the pod's own CPU limit.

Threshold

> 80% sustained for 5+ minutes at the PodName+Namespace+ClusterName dimension for critical workloads

pod_memory_utilization

pod_memory_utilization reports the percentage of memory used by a pod (or aggregated by Namespace, Service, or ClusterName), calculated as pod_memory_working_set ÷ node_memory_limit — the node's total memory capacity, not the pod's own memory limit.

Threshold

Namespace or ClusterName aggregate > 75% sustained for 10+ minutes; per-pod, pair with pod_memory_utilization_over_pod_limit for OOM-kill-specific alerting

node_cpu_utilization

node_cpu_utilization reports the total percentage of CPU units in use on a worker node (or aggregated across all nodes at the ClusterName dimension), calculated as node_cpu_usage_total ÷ node_cpu_limit — the node's total allocatable CPU capacity.

Threshold

> 80% sustained for 15 minutes, evaluated per NodeName

cluster_failed_node_count