AWS monitoring tools: what each kind actually tells you

Most comparisons of AWS monitoring tools are a feature grid where the author's product wins every row. This is not that, because the tools below mostly are not competing with each other — they answer different questions, and the useful exercise is working out which question you have not asked.

The three kinds

1. Metric pipelines — "what happened?"

CloudWatch, Datadog, New Relic, Grafana Cloud, SigNoz.

These collect and chart. CloudWatch is the source; the commercial platforms are pipelines on top of it — New Relic's AWS integration, for example, is CloudWatch into Kinesis Firehose into their endpoint, arriving in their UI at roughly two minutes' latency, with API polling for services Metric Streams does not cover.

What they are outstanding at: incident forensics, correlation across services, latency breakdowns, and knowing what a normal Tuesday looks like.

What they do not do, by design, is judge a configuration. Their job is ingestion. A chart of CPU is not an opinion about whether your Auto Scaling group is set up correctly, and no amount of charting turns into one.

The pricing shape is worth knowing: per host or per metric, which punishes small estates with many small things.

2. Configuration checkers — "does this match a best practice?"

Trusted Advisor, AWS Config, and the CSPM tools (Wiz, Orca, Cloud Conformity).

These read how a resource is set up and compare it against a rule. Trusted Advisor gives every account 56 checks and 482 on Business Support+ at a $29 per-month minimum — a lower price umbrella than most people evaluating this space assume. We wrote it up properly in what Trusted Advisor checks and what it structurally cannot.

What they are excellent at: breadth, service limits, and security posture. If something is misconfigured against a known standard, this is the category that finds it.

Their boundary is the same for all of them: they evaluate a resource against a rule, one resource at a time.

3. Cost tools — "where did the money go?"

Cost Explorer, Compute Optimizer, Cost Optimization Hub, and the FinOps vendors.

AWS keeps building here, and it owns the billing data, which is not a fight worth picking. If your question is genuinely "why did my bill go up last month", use AWS's own tooling first — it has the Cost and Usage Report and nobody else does.

Two things to know when comparing vendors in this category. Several are free to the user because they are commitment brokers — they buy Reserved Instances and Savings Plans in bulk and take a margin on the savings they pass through. That is a financial arrangement with a product attached, and it requires considerably deeper access to your billing and commitments than a read-only monitoring role. That may be fine. It should be a decision rather than a surprise, and it is worth reading what a read-only cross-account role can and cannot see to know where the line normally sits.

The question none of the three asks

Does the configuration agree with the behaviour?

A metric pipeline sees behaviour and not configuration. A configuration checker sees configuration and not behaviour. A cost tool sees spend. The defects that live in between are invisible to all three, not through any deficiency but because none of them is looking at both halves at once.

A worked example, from an account that had a commercial APM installed on it for years:

capacity provider   managed scaling ENABLED     ← the configuration
Auto Scaling group  min 2, max 2                ← also the configuration
CPU during peak     charted, unremarkable       ← the behaviour

The APM charted CPU and it charted the group's capacity. Both facts were on a dashboard. Nothing joined them into "scaling is switched on and cannot act", because that join is not something a metrics platform does. The configuration checker did not flag it either — both settings are individually valid.

That tier could not scale for years, and every runbook said it could.

The same shape covers a health check whose matcher accepts 4xx (a broken target stays in rotation and reports healthy), a CDN with no minimum TTL (one origin header turns it into a pass-through), and an instance that fell out of its Auto Scaling group and kept billing while no longer being replaced when it fails.

So what should you actually run?

Honestly, for most teams:

1. CloudWatch alarms on the handful of signals that mean customer pain. Free, and the thing most estates under-invest in.
2. Trusted Advisor, and Business Support+ if $29/month is affordable — the breadth and the service-limit checks are worth it on their own.
3. A metric platform if you have the budget and enough services that correlation during an incident is hard. Not before.
4. Something that checks the joins, which is the category this product is in and the one we would argue is most often missing.

You can plausibly run all four. They are adjacent rather than overlapping, and a vendor telling you to rip out a tool your team already likes is optimising for their invoice rather than your estate.

The short version

• Metric pipelines answer what happened; they do not judge configuration
• Configuration checkers answer whether a setting is wrong; one resource at a time
• Cost tools answer where the money went; AWS owns that data and is hard to beat
• Nothing in those three catches valid settings that contradict each other
• That gap is real, it is cheap to check with Describe* calls, and it is worth knowing about whether or not you buy anything