Amazon Web Services Monitoring

ComponentsEngine

Availability2025.1 or later

What Is Monitored

Vulnerabilities, storage, email

How It Works

AWS CLI on the Engine

Deploy

IAM access and monitors

KPIs

13 KPIs, default SLAs

Overview

GermainUX shows how many critical, high and medium vulnerabilities Amazon Inspector has found on each EC2 instance and each container image in Amazon ECR. It tracks how full your Amazon RDS storage is, and how many emails Amazon SES sent, bounced, rejected or drew complaints for in the last hour. Default SLAs come with every KPI, so you get an alert when a new critical vulnerability appears, RDS storage passes 80%, or a recipient marks your email as spam. Security, database and email teams watch these signals next to the rest of their monitoring, instead of checking three AWS consoles.

Vulnerabilities by Instance and Image

Critical, high and medium Amazon Inspector findings for each EC2 instance and each ECR image, with the AMI, operating system and image tag.

RDS Storage Headroom

The share of allocated RDS storage that is in use, with an alert before a database runs out of space.

Email Delivery Health

Sent, bounced, rejected and complaint counts from Amazon SES every hour, so a sending problem shows up before it affects your sender reputation.

Suppressed Recipients

The number of addresses on the SES account-level suppression list because of bounces or complaints, and which addresses they are.

Questions It Answers

Which EC2 instances have critical vulnerabilities right now?
Which container images in ECR need patching before the next release?
How close is our RDS storage to full?
Did Amazon SES stop sending email in the last hour?
Are bounces or complaints rising after a campaign?
Which recipients are suppressed because of complaints?

What Is Monitored

Area	What GermainUX monitors
EC2 vulnerabilities	The number of critical, high and medium Amazon Inspector findings on each EC2 instance, with the instance ID, its `Name` tag, the AMI ID and the operating system
Container image vulnerabilities	The number of critical, high and medium Amazon Inspector findings on each ECR container image, with the repository, the first image tag and the image resource ID
RDS storage	The percentage of allocated Amazon RDS storage in use, with the allocated and free storage in MB
SES sending statistics	Delivery attempts, bounces, complaints and rejects in the last hour
SES suppression list	The number of addresses on the account-level suppression list because of bounces, and because of complaints, with the list of addresses
EC2 Burst Balance	The AWS Inspector Monitor also collects the EC2 Burst Balance KPI. See Configure Monitoring for Amazon EC2.

For EC2 instance metrics such as CPU, network and status checks, see Amazon EC2.

Analytics, Alerts and Automation

Dashboards and Reports

Build dashboards and reports on the AWS KPIs: open vulnerabilities by instance, image or operating system, RDS storage use over time, and SES bounces and complaints by hour. GermainUX ships the AWS Overview dashboard as a starting point. In the left menu, go to Dashboards > All, and then open AWS Overview in the AWS folder. It shows RDS storage use, the burst balance of each EC2 instance, critical, high and medium vulnerabilities on EC2 instances and container images, critical vulnerabilities by instance and by repository, SES sent, bounced, complaint and rejected mails, and suppressed addresses.

AWS Overview dashboard showing RDS storage, EC2 burst balance by instance, EC2 and container image vulnerabilities, critical vulnerabilities by instance and by repository, SES mail counts and SES suppressed addresses — AWS Overview Dashboard - GermainUX

Maximize a chart to see it at full width. EC2 Burst Balance by Instance shows the lowest burst balance of each instance, so an instance that runs out of burst credits stands out.

EC2 Burst Balance by Instance chart at full width, with one instance dropping to about 18% while the others stay between 77% and 96% — EC2 Burst Balance by Instance - GermainUX

Analysis

Click a value on the dashboard to open it in the Analysis screen. The aggregate view compares a KPI with the previous period and the last quarter, and shows its daily trend. It charts related KPIs, such as EC2 High Vulnerability Count next to EC2 Critical Vulnerability Count, and breaks the value down by AMI and by instance.

SLAs and Alerts

Every KPI ships with a default SLA, listed under KPIs. Send its violations as an alert by email, SMS, Slack or Teams. Outlier detection flags unusual spikes in bounces or complaints, and predictive SLAs forecast when RDS storage will cross its threshold.

Automation

When an SLA is breached, an automated action can open a ticket in ServiceNow, call an HTTP endpoint or run a script.

How It Works

AWS CLI on the EngineAWS APIsRulesKPIsSLAs and alerts

Each monitor is a Local Executor component that runs AWS CLI commands on the GermainUX Engine host, on the schedule you set when you deploy it. The AWS CLI uses the credentials and default region of the account the Engine runs as. A rule then turns the JSON output into KPI values.

Component	AWS calls	What it does
AWS Inspector Monitor	`inspector2 list-finding-aggregations` for EC2 instances and ECR containers	Stores the critical, high and medium finding counts for each instance and image. It also runs the CloudWatch calls for EC2 Burst Balance.
AWS RDS Monitor	`cloudwatch get-metric-statistics` for `FreeStorageSpace` over the last 5 minutes, and `rds describe-db-instances`	Compares free storage with allocated storage and stores the percentage in use
AWS SES Monitor	`ses get-send-statistics` and `sesv2 list-suppressed-destinations`	Adds up the four most recent 15-minute SES data points into last-hour counts, and counts the suppressed addresses by reason

Before You Start

A GermainUX Engine is deployed. See GermainUX Engine.
The AWS CLI v2 is installed on the Engine host and is on the PATH of the Engine’s account.
The Engine’s account has AWS credentials and a default region. See Configure the AWS CLI.
The Engine host can reach the AWS API endpoints over HTTPS.
For vulnerabilities: Amazon Inspector scans EC2 and ECR in the account. See Getting Started with Amazon Inspector.
For RDS: the Engine runs on Linux, because the AWS RDS Monitor uses bash and GNU date.

Deploy

Give the Engine read-only AWS access

Attach a policy with these read-only actions to the IAM role or user that the Engine’s AWS CLI profile uses. Keep only the statements for the monitors you deploy.

IAM Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GermainUXAwsMonitoring",
      "Effect": "Allow",
      "Action": [
        "inspector2:ListFindingAggregations",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricStatistics",
        "rds:DescribeDBInstances",
        "ses:GetSendStatistics",
        "ses:ListSuppressedDestinations"
      ],
      "Resource": "*"
    }
  ]
}

When the Engine runs on EC2, use an instance role instead of access keys.

Test the AWS CLI as the Engine's account

On the Engine host, as the account the Engine runs as, run the commands for the monitors you plan to deploy:

aws sts get-caller-identity
aws inspector2 list-finding-aggregations --aggregation-type AWS_EC2_INSTANCE
aws rds describe-db-instances
aws ses get-send-statistics
aws sesv2 list-suppressed-destinations

Each command returns JSON. An AccessDenied error means the policy is missing an action.

Open the Local Executor Deployment wizard

In the left menu, go to Settings > Wizards. On the Local Executor Deployment card, click Add.

Choose the monitor

On the Monitoring step, fill in the fields, and then click Next.

Field	Value
Component Type	AWS Inspector Monitor, AWS RDS Monitor or AWS SES Monitor
Source Host	The Engine host
Monitored Application	The application to file the data under, for example one named `AWS`
Read Timeout	How long to wait for the AWS CLI, in seconds. The default is `180`.

Deploy it to the Engine

On the Deployment step, enter a Monitor Name, select the Monitoring Node and Engine, and set the schedule. The default, 0 0 * * * *, runs the monitor at the top of every hour, which matches the last-hour SES counts. Finish the wizard.

Repeat for the other monitors

Run the wizard once for each monitor you want. GermainUX starts each one on its schedule.

Validate

Check that the monitors are deployed

In the left menu, go to Settings > Wizards. On the Local Executor Deployment card, click Manage, and check that your AWS monitors are listed.

Wait for the first run

With the default schedule, the monitors run at the top of the next hour.

Find the values in GermainUX

Open the KPIs for the monitors you deployed. EC2 Critical Vulnerability Count shows one value per instance, RDS Used Storage shows a percentage, and AWS SES Sent Mails shows the emails sent in the last hour. Compare them with the Amazon Inspector, RDS and SES consoles.

Troubleshooting

No AWS data appears

Run the commands from the test step on the Engine host, as the Engine’s account. If aws isn’t found, add it to that account’s PATH. If a command fails with an access or region error, fix the credentials, the default region or the IAM policy. Then wait for the next scheduled run.

The vulnerability KPIs stay empty

Check that Amazon Inspector scanning is turned on for EC2 and ECR in the account and region that the AWS CLI uses. Inspector returns no aggregation for resources it doesn’t scan.

RDS values don't appear on a Windows Engine

The AWS RDS Monitor runs its command through bash with GNU date. Deploy it to an Engine on Linux.

SES counts are zero, but email is being sent

SES statistics are per region. Set the AWS CLI’s default region for the Engine’s account to the region you send email from.

The monitor times out

Increase Read Timeout on the Monitoring step and redeploy. Large accounts with many findings take longer to return.

Security and Privacy

AWS monitoring data includes personal data:

Identity data: the email addresses on the SES suppression list, in the details of AWS SES Suppressed Addresses
Resource names: EC2 instance Name tags, AMI IDs and ECR repository names and tags, which can reveal internal system or customer names

The monitors only read from AWS. Give the Engine’s AWS identity the read-only policy above, and no write permissions. To mask, anonymize or exclude this data, see Data Privacy.

KPIs

All KPIs use the GenericMetric data model. Each default SLA raises an alert after 5 violations in a row.

Monitor	KPI	Value	Default SLA
AWS Inspector Monitor	EC2 Critical Vulnerability Count	Critical findings per instance	Default: violated when above `0`
	EC2 High Vulnerability Count	High findings per instance	Default: violated when above `0`
	EC2 Medium Vulnerability Count	Medium findings per instance	Default: violated when above `0`
	Docker Image Critical Vulnerability Count	Critical findings per ECR image	Default: violated when above `0`
	Docker Image High Vulnerability Count	High findings per ECR image	Default: violated when above `0`
	Docker Image Medium Vulnerability Count	Medium findings per ECR image	Default: violated when above `0`
AWS RDS Monitor	RDS Used Storage	Percentage of allocated storage in use	RDS Usage Default SLA: violated above `80`%
	RDS Free Storage	Free storage, in MB	Default SLA: violated below `10240` MB
AWS SES Monitor	AWS SES Sent Mails	Delivery attempts in the last hour	Mail SLA: violated when `0`
	AWS SES Bounced Mails	Bounces in the last hour	Mail SLA: violated when above `0`
	AWS SES Rejected Mails	Rejects in the last hour	Mail SLA: violated when above `0`
	AWS SES Complaint Mails	Complaints in the last hour	Mail SLA: violated when above `0`
	AWS SES Suppressed Addresses	Suppressed addresses, named `Bounced` or `Complaints`	Bounced SLA: violated at `1000` bounced addresses. Complaint SLA: violated at `1` complaint address.

The pack also includes scheduled SLAs that check the past 24 hours for critical or high findings at 10:00 on weekdays: EC2 Critical Vulnerabilities SLA, EC2 High Vulnerability Count SLA and Docker Image Critical Vulnerabilities SLA. They’re turned off by default. Turn them on for a daily vulnerability check. See SLAs and KPIs.

Amazon EC2

EC2 and EBS metrics from CloudWatch

SLAs

Thresholds and violations

Automation

More Automation Features

Get Help

The GermainUX team can help you monitor several AWS accounts or regions, or add other AWS services through the AWS CLI.

Contact GermainUX Support

The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes.

Can't Find What You Need?

Search all GermainUX docs with Ctrl + K, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.

What Is Monitored

How It Works

Deploy

KPIs

Overview

Vulnerabilities by Instance and Image

RDS Storage Headroom

Email Delivery Health

Suppressed Recipients

Questions It Answers

What Is Monitored

Analytics, Alerts and Automation

Dashboards and Reports

Analysis

SLAs and Alerts

Automation

How It Works

Before You Start

Deploy

Validate

Troubleshooting

Security and Privacy

KPIs

Related Documentation

Amazon EC2

SLAs

Automation

Get Help

Contact GermainUX Support

Can't Find What You Need?