Monitor AWS Infrastructure with Crowswatch

• EC2 metrics: CPU, memory, network, and disk utilisation per instance
• RDS health: database connections, query latency, and storage usage
• CloudFront: request volume, error rates, and cache performance
• S3: request counts, data transfer, and error rates
• Lambda: invocations, duration, error rate, and throttles
• ELB / ALB: request counts, latency, and unhealthy host counts
• CloudWatch alarms: current alarm state across your account
• Billing: estimated monthly charges by service

Create a dedicated IAM user:

1. Log in to the AWS Management Console
2. Go to IAM → Users → Create user
3. Name the user (e.g. crowswatch-monitor)
4. Select Attach policies directly and attach:
   • CloudWatchReadOnlyAccess
   • AWSBillingReadOnlyAccess (optional, for cost metrics)
5. Click Create user
6. Open the user → Security credentials → Create access key
7. Select Third-party service as the use case
8. Copy the Access Key ID and Secret Access Key. The secret is only shown once

AWS Account ID

1. Click your account name in the top-right of the AWS Console
2. The Account ID (12-digit number) is shown in the dropdown

Region

1. The active region is shown in the top-right of the AWS Console (e.g. eu-west-1)
2. Select the region where your primary resources are deployed

Navigate to: Crowswatch → Add Service → AWS

1. Enter your Access Key ID, Secret Access Key, Region, and Account ID
2. Click Verify to test the connection
3. Select the services and metrics to track
4. Click Connect

• Never use root account credentials. Always create a dedicated IAM user
• Grant only the permissions listed above. No write access is required
• Enable MFA on the IAM user for additional security
• Rotate access keys periodically
• Consider using IAM roles with cross-account trust if monitoring multiple accounts
• Restrict the IAM policy to specific resource ARNs where possible