> ## Documentation Index > Fetch the complete documentation index at: https://docs.germainux.com/llms.txt > Use this file to discover all available pages before exploring further. # Amazon Web Services Monitoring > Track open vulnerabilities on EC2 instances and container images, RDS storage headroom, and SES bounces and complaints, with alerts built in. Components [`Engine`](https://docs.germainux.com/deploy/germain-ux-engine) Availability 2025.1 or later > [card] [What Is Monitored](#what-is-monitored) > > Vulnerabilities, storage, email > [card] [How It Works](#how-it-works) > > AWS CLI on the Engine > [card] [Deploy](#deploy) > > IAM access and monitors > [card] [KPIs](#kpis) > > 13 KPIs, default SLAs ## Overview GermainUX shows how many critical, high and medium vulnerabilities Amazon Inspector has found on each EC2 instance and each container image in Amazon ECR. It tracks how full your Amazon RDS storage is, and how many emails Amazon SES sent, bounced, rejected or drew complaints for in the last hour. Default SLAs come with every KPI, so you get an alert when a new critical vulnerability appears, RDS storage passes 80%, or a recipient marks your email as spam. Security, database and email teams watch these signals next to the rest of their monitoring, instead of checking three AWS consoles. > [card] Vulnerabilities by Instance and Image > > Critical, high and medium Amazon Inspector findings for each EC2 instance and each ECR image, with the AMI, operating system and image tag. > [card] RDS Storage Headroom > > The share of allocated RDS storage that is in use, with an alert before a database runs out of space. > [card] Email Delivery Health > > Sent, bounced, rejected and complaint counts from Amazon SES every hour, so a sending problem shows up before it affects your sender reputation. > [card] Suppressed Recipients > > The number of addresses on the SES account-level suppression list because of bounces or complaints, and which addresses they are. ### Questions It Answers * Which EC2 instances have critical vulnerabilities right now? * Which container images in ECR need patching before the next release? * How close is our RDS storage to full? * Did Amazon SES stop sending email in the last hour? * Are bounces or complaints rising after a campaign? * Which recipients are suppressed because of complaints? ## What Is Monitored | Area | What GermainUX monitors | | - | - | | **EC2 vulnerabilities** | The number of critical, high and medium Amazon Inspector findings on each EC2 instance, with the instance ID, its `Name` tag, the AMI ID and the operating system | | **Container image vulnerabilities** | The number of critical, high and medium Amazon Inspector findings on each ECR container image, with the repository, the first image tag and the image resource ID | | **RDS storage** | The percentage of allocated Amazon RDS storage in use, with the allocated and free storage in MB | | **SES sending statistics** | Delivery attempts, bounces, complaints and rejects in the last hour | | **SES suppression list** | The number of addresses on the account-level suppression list because of bounces, and because of complaints, with the list of addresses | | **EC2 Burst Balance** | The **AWS Inspector Monitor** also collects the **EC2 Burst Balance** KPI. See [Configure Monitoring for Amazon EC2](https://docs.germainux.com/integrations/amazon-ec2-observability/amazon-ec2-monitoring-configuration.md#configure-ebs-burst-balance-monitoring). | For EC2 instance metrics such as CPU, network and status checks, see [Amazon EC2](https://docs.germainux.com/integrations/amazon-ec2-observability.md). ## Analytics, Alerts and Automation ### Dashboards and Reports Build [dashboards and reports](https://docs.germainux.com/dashboards/dashboard-and-report.md) on the AWS KPIs: open vulnerabilities by instance, image or operating system, RDS storage use over time, and SES bounces and complaints by hour. GermainUX ships the **AWS Overview** dashboard as a starting point. In the left menu, go to **Dashboards > All**, and then open **AWS Overview** in the **AWS** folder. It shows RDS storage use, the burst balance of each EC2 instance, critical, high and medium vulnerabilities on EC2 instances and container images, critical vulnerabilities by instance and by repository, SES sent, bounced, complaint and rejected mails, and suppressed addresses. ![AWS Overview dashboard showing RDS storage, EC2 burst balance by instance, EC2 and container image vulnerabilities, critical vulnerabilities by instance and by repository, SES mail counts and SES suppressed addresses](https://mintcdn.com/germain-ux/ezLKxJg-TX3Gg02X/images/main/aws-monitoring/aws-overview-dashboard.png?fit=max\&auto=format\&n=ezLKxJg-TX3Gg02X\&q=85\&s=7154a48397aef85e9196a222cea95433) AWS Overview Dashboard - GermainUX Maximize a chart to see it at full width. **EC2 Burst Balance by Instance** shows the lowest burst balance of each instance, so an instance that runs out of burst credits stands out. ![EC2 Burst Balance by Instance chart at full width, with one instance dropping to about 18% while the others stay between 77% and 96%](https://mintcdn.com/germain-ux/ezLKxJg-TX3Gg02X/images/main/aws-monitoring/aws-ec2-burst-balance-by-instance.png?fit=max\&auto=format\&n=ezLKxJg-TX3Gg02X\&q=85\&s=e7f0f9b499ccec5f00e356ab02a49554) EC2 Burst Balance by Instance - GermainUX ### Analysis Click a value on the dashboard to open it in the [Analysis](https://docs.germainux.com/dashboards/analytics-dashboard/4-analysis-dashboard.md) screen. The aggregate view compares a KPI with the previous period and the last quarter, and shows its daily trend. It charts related KPIs, such as **EC2 High Vulnerability Count** next to **EC2 Critical Vulnerability Count**, and breaks the value down by AMI and by instance. ![Analysis screen for EC2 Critical Vulnerability Count, comparing the overall value with the recent period, with the daily trend, the relationships chart, related metrics and the segmentation breakdown by AMI and instance](https://mintcdn.com/germain-ux/ezLKxJg-TX3Gg02X/images/main/aws-monitoring/aws-ec2-critical-vulnerability-aggregate-analysis.png?fit=max\&auto=format\&n=ezLKxJg-TX3Gg02X\&q=85\&s=0c8392f706b63b5c98be966df2471e10) Aggregate Analysis of EC2 Critical Vulnerabilities - GermainUX ### SLAs and Alerts Every KPI ships with a default [SLA](https://docs.germainux.com/analytics/slas.md), listed under [KPIs](#kpis). Send its violations as an [alert](https://docs.germainux.com/automation/notifications.md) by email, SMS, Slack or Teams. [Outlier detection](https://docs.germainux.com/analytics/outlier-detection.md) flags unusual spikes in bounces or complaints, and [predictive SLAs](https://docs.germainux.com/analytics/slas.md) forecast when RDS storage will cross its threshold. ### Automation When an SLA is breached, an [automated action](https://docs.germainux.com/automation/automated-actions.md) can open a ticket in [ServiceNow](https://docs.germainux.com/automation/servicenow.md), call an HTTP endpoint or run a script. ## How It Works AWS CLI on the Engine AWS APIs Rules KPIs SLAs and alerts Each monitor is a Local Executor component that runs AWS CLI commands on the GermainUX Engine host, on the schedule you set when you deploy it. The AWS CLI uses the credentials and default region of the account the Engine runs as. A rule then turns the JSON output into KPI values. | Component | AWS calls | What it does | | - | - | - | | **AWS Inspector Monitor** | `inspector2 list-finding-aggregations` for EC2 instances and ECR containers | Stores the critical, high and medium finding counts for each instance and image. It also runs the CloudWatch calls for **EC2 Burst Balance**. | | **AWS RDS Monitor** | `cloudwatch get-metric-statistics` for `FreeStorageSpace` over the last 5 minutes, and `rds describe-db-instances` | Compares free storage with allocated storage and stores the percentage in use | | **AWS SES Monitor** | `ses get-send-statistics` and `sesv2 list-suppressed-destinations` | Adds up the four most recent 15-minute SES data points into last-hour counts, and counts the suppressed addresses by reason | ## Before You Start * A GermainUX Engine is deployed. See [GermainUX Engine](https://docs.germainux.com/deploy/germain-ux-engine.md). * The AWS CLI v2 is installed on the Engine host and is on the `PATH` of the Engine's account. * The Engine's account has AWS credentials and a default region. See [Configure the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html). * The Engine host can reach the AWS API endpoints over HTTPS. * For vulnerabilities: Amazon Inspector scans EC2 and ECR in the account. See [Getting Started with Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/getting_started_tutorial.html). * For RDS: the Engine runs on Linux, because the **AWS RDS Monitor** uses `bash` and GNU `date`. ## Deploy **1. Give the Engine read-only AWS access** Attach a policy with these read-only actions to the IAM role or user that the Engine's AWS CLI profile uses. Keep only the statements for the monitors you deploy. ```json IAM Policy theme={null} { "Version": "2012-10-17", "Statement": [ { "Sid": "GermainUXAwsMonitoring", "Effect": "Allow", "Action": [ "inspector2:ListFindingAggregations", "cloudwatch:ListMetrics", "cloudwatch:GetMetricStatistics", "rds:DescribeDBInstances", "ses:GetSendStatistics", "ses:ListSuppressedDestinations" ], "Resource": "*" } ] } ``` When the Engine runs on EC2, use an instance role instead of access keys. **2. Test the AWS CLI as the Engine's account** On the Engine host, as the account the Engine runs as, run the commands for the monitors you plan to deploy: ```bash theme={null} aws sts get-caller-identity aws inspector2 list-finding-aggregations --aggregation-type AWS_EC2_INSTANCE aws rds describe-db-instances aws ses get-send-statistics aws sesv2 list-suppressed-destinations ``` Each command returns JSON. An `AccessDenied` error means the policy is missing an action. **3. Open the Local Executor Deployment wizard** In the left menu, go to **Settings > Wizards**. On the **Local Executor Deployment** card, click **Add**. **4. Choose the monitor** On the **Monitoring** step, fill in the fields, and then click **Next**. | Field | Value | | - | - | | **Component Type** | **AWS Inspector Monitor**, **AWS RDS Monitor** or **AWS SES Monitor** | | **Source Host** | The Engine host | | **Monitored Application** | The application to file the data under, for example one named `AWS` | | **Read Timeout** | How long to wait for the AWS CLI, in seconds. The default is `180`. | **5. Deploy it to the Engine** On the **Deployment** step, enter a **Monitor Name**, select the **Monitoring Node** and Engine, and set the schedule. The default, `0 0 * * * *`, runs the monitor at the top of every hour, which matches the last-hour SES counts. Finish the wizard. **6. Repeat for the other monitors** Run the wizard once for each monitor you want. GermainUX starts each one on its schedule. ## Validate **1. Check that the monitors are deployed** In the left menu, go to **Settings > Wizards**. On the **Local Executor Deployment** card, click **Manage**, and check that your AWS monitors are listed. **2. Wait for the first run** With the default schedule, the monitors run at the top of the next hour. **3. Find the values in GermainUX** Open the KPIs for the monitors you deployed. **EC2 Critical Vulnerability Count** shows one value per instance, **RDS Used Storage** shows a percentage, and **AWS SES Sent Mails** shows the emails sent in the last hour. Compare them with the Amazon Inspector, RDS and SES consoles. ## Troubleshooting > [accordion] No AWS data appears > > Run the commands from the test step on the Engine host, as the Engine's account. If `aws` isn't found, add it to that account's `PATH`. If a command fails with an access or region error, fix the credentials, the default region or the IAM policy. Then wait for the next scheduled run. > [accordion] The vulnerability KPIs stay empty > > Check that Amazon Inspector scanning is turned on for EC2 and ECR in the account and region that the AWS CLI uses. Inspector returns no aggregation for resources it doesn't scan. > [accordion] RDS values don't appear on a Windows Engine > > The **AWS RDS Monitor** runs its command through `bash` with GNU `date`. Deploy it to an Engine on Linux. > [accordion] SES counts are zero, but email is being sent > > SES statistics are per region. Set the AWS CLI's default region for the Engine's account to the region you send email from. > [accordion] The monitor times out > > Increase **Read Timeout** on the **Monitoring** step and redeploy. Large accounts with many findings take longer to return. ## Security and Privacy AWS monitoring data includes personal data: * **Identity data**: the email addresses on the SES suppression list, in the details of **AWS SES Suppressed Addresses** * **Resource names**: EC2 instance `Name` tags, AMI IDs and ECR repository names and tags, which can reveal internal system or customer names The monitors only read from AWS. Give the Engine's AWS identity the read-only policy above, and no write permissions. To mask, anonymize or exclude this data, see [Data Privacy](https://docs.germainux.com/management/compliance-privacy-and-security/data-privacy.md). ## KPIs All KPIs use the `GenericMetric` data model. Each default SLA raises an alert after 5 violations in a row. | Monitor | KPI | Value | Default SLA | | - | - | - | - | | **AWS Inspector Monitor** | **EC2 Critical Vulnerability Count** | Critical findings per instance | **Default**: violated when above `0` | | | **EC2 High Vulnerability Count** | High findings per instance | **Default**: violated when above `0` | | | **EC2 Medium Vulnerability Count** | Medium findings per instance | **Default**: violated when above `0` | | | **Docker Image Critical Vulnerability Count** | Critical findings per ECR image | **Default**: violated when above `0` | | | **Docker Image High Vulnerability Count** | High findings per ECR image | **Default**: violated when above `0` | | | **Docker Image Medium Vulnerability Count** | Medium findings per ECR image | **Default**: violated when above `0` | | **AWS RDS Monitor** | **RDS Used Storage** | Percentage of allocated storage in use | **RDS Usage Default SLA**: violated above `80`% | | | **RDS Free Storage** | Free storage, in MB | **Default SLA**: violated below `10240` MB | | **AWS SES Monitor** | **AWS SES Sent Mails** | Delivery attempts in the last hour | **Mail SLA**: violated when `0` | | | **AWS SES Bounced Mails** | Bounces in the last hour | **Mail SLA**: violated when above `0` | | | **AWS SES Rejected Mails** | Rejects in the last hour | **Mail SLA**: violated when above `0` | | | **AWS SES Complaint Mails** | Complaints in the last hour | **Mail SLA**: violated when above `0` | | | **AWS SES Suppressed Addresses** | Suppressed addresses, named `Bounced` or `Complaints` | **Bounced SLA**: violated at `1000` bounced addresses. **Complaint SLA**: violated at `1` complaint address. | The pack also includes scheduled SLAs that check the past 24 hours for critical or high findings at 10:00 on weekdays: **EC2 Critical Vulnerabilities SLA**, **EC2 High Vulnerability Count SLA** and **Docker Image Critical Vulnerabilities SLA**. They're turned off by default. Turn them on for a daily vulnerability check. See [SLAs](https://docs.germainux.com/analytics/slas.md) and [KPIs](https://docs.germainux.com/analytics/kpis.md). ## Related Documentation > [card] [Amazon EC2](https://docs.germainux.com/integrations/amazon-ec2-observability.md) > > EC2 and EBS metrics from CloudWatch > [card] [SLAs](https://docs.germainux.com/analytics/slas.md) > > Thresholds and violations > [card] [Automation](https://docs.germainux.com/automation.md) > > More Automation Features ## Get Help The GermainUX team can help you monitor several AWS accounts or regions, or add other AWS services through the AWS CLI. > [card] [Contact GermainUX Support](https://docs.germainux.com/getting-started/support.md) > > The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes. > [card] Can't Find What You Need? > > Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing. The content of this document is proprietary to GERMAIN SOFTWARE. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.