Working with Your AWS Resources

Lesson purpose

Lessons 1–5 described what AWS is and how to secure an account. This lesson is about the tools used every day to work with resources: the web console (and its mobile app), the command line, and the SDKs developers build with. It then covers the services that watch an account: CloudWatch (performance and logs), CloudTrail (who did what), Cost Explorer (what it costs), AWS Config (how resources were configured over time), and the governance tools Control Tower and License Manager. It supports CLF-C02 objectives 2.2, 2.4, 3.1, 3.3–3.6, and 4.2.

Learning objectives

• Sign in to the AWS Management Console as root or as an IAM user and navigate service consoles, shortcuts, Regions, and the account menu.
• Use resource tags, Tag Editor, and resource groups, and describe common tagging strategies.
• Describe what the AWS Console Mobile Application can and cannot do.
• Install and configure the AWS CLI and explain when the CLI is better than the console.
• Explain the purpose of the AWS SDKs, including mobile and IoT SDKs.
• Use CloudWatch metrics, alarms, dashboards, logs, metric filters, and events.
• Explain what CloudTrail records, the difference between management and data events, and when to create a trail.
• Use Cost Explorer reports and describe AWS Billing Conductor.
• Explain how AWS Config, Control Tower, and License Manager support governance and compliance.

1. The AWS Management Console

The AWS Management Console (also called the AWS Console or Web Console) is the browser-based, point-and-click way to manage AWS. Every service has its own service console. Some consoles, such as CloudWatch and Billing and Cost Management, show visual graphs and reports that you can only see in the console. Nearly every setting can be changed in the console; a few advanced options require the CLI.

Supported browsers are current versions of Chrome, Firefox, Edge, and Safari. (The book also lists Internet Explorer, which Microsoft has retired; tell students not to use it.)

Signing in

Go to console.aws.amazon.com. There are two ways to sign in:

• Root user — enter the account email address and password. Use only for the few tasks that require it (Lesson 5).
• IAM user — enter the account ID (12 digits) or account alias, then the IAM user name and password, plus an MFA code if MFA is enabled.

A console session stays active for up to 12 hours, then expires and requires signing in again. This limits the damage from an unattended, signed-in browser.

Navigating

• Services menu and search — search by service name or browse by category (compute, storage, database, and so on). Clicking a service opens its service console. New services appear in the console within 180 days of launch, usually immediately.
• Shortcuts (favorites) — pin frequently used services to the navigation bar.
• Region selector — most services are regional; EC2 in US East is separate from EC2 in US West. Global services such as IAM and Route 53 show Global instead of a Region. (S3 bucket names are global, but each bucket lives in a Region.)

Troubleshooting tip to repeat often: if resources seem to be missing, check the Region selector first.

The account name menu

The account menu shows who you are signed in as (IAM user with account alias or ID, or the account name for root). Its options:

• Account — account information in the Billing console.
• Organization — the AWS Organizations console.
• Billing Dashboard — Billing and Cost Management.
• Security credentials — change your password, manage MFA and access keys.
• Switch role — assume an IAM role and work as a different principal with different permissions.
• Sign out.

Menu names change slightly over time; teach the purpose of each rather than the exact wording.

2. Tags, Tag Editor, and resource groups

Resource tags

A tag is optional metadata attached to a resource. Each tag has a key (required) and an optional value, for example Environment = Production.

• Up to 50 tags per resource.
• Keys and values are case-sensitive (production and Production are different), and so are tag queries.
• Allowed characters include letters, numbers, spaces, and + - = . _ : / @.

Resource groups

A resource group is a collection of resources in the same Region that match a query. Resource groups let you view, manage, and automate tasks on many resources at once — ideal for “everything that makes up this application.” Create a group from:

• a tag-based query (tag key only, or key and value), or
• an AWS CloudFormation stack (all resources in the stack, or filtered by type). CloudFormation is covered in Lesson 11.

Tag Editor

Tag Editor (under Resource Groups) finds resources and tags them in bulk. Build a query by choosing at least one Region and one or more resource types (or all types). You can also filter to resources that already have a tag, or that are missing one. Results can be edited individually or in bulk, and new tags can be added.

Tagging strategies

Organizations usually combine several approaches:

Strategy	Purpose	Example tags
Technical	Identify and describe a resource	Name = webserver01, Environment = Development, Application role = web server
Automation	Include or exclude resources from automated jobs (patching, backups, snapshot cleanup, after-hours shutdown)	Date/Time schedule tags, Opt in / Opt out flags
Business	Billing, ownership, and reporting	Owner, Cost Center or Business Unit, Project, Customer
Security	Access decisions and data classification	Confidentiality = PHI, Compliance = HIPAA or PCI DSS

Points to stress:

• Name tags do not have to be unique, so two resources can accidentally share a name.
• IAM policy conditions can check tags. Example: an EC2 instance may reach the production database only if it has Environment = Production; anything else is denied.
• Business tags feed Cost Explorer grouping (Section 8), which is how departments get charged for what they use.

3. The AWS Console Mobile Application

The AWS Console Mobile Application (iOS and Android) lets you check on an account from a phone. Its dashboard shows:

• Service health — current AWS service issues by Region.
• CloudWatch alarms — alarm graphs and status.
• Billing — current balance and usage charges.

It supports limited changes, such as viewing or editing a CloudWatch alarm, changing EC2 security groups, and stopping or rebooting an EC2 instance. It covers a subset of services, including Billing and Cost Management, CloudFormation, CloudWatch, DynamoDB, EC2, Elastic Beanstalk, Elastic Load Balancing, Health Dashboard, RDS, Route 53, S3, and VPC.

You can add multiple identities (useful for several accounts) using root credentials (avoid), an IAM user name and password, or an access key. The app is best for quick look-ups and emergencies, not for building infrastructure.

4. The AWS Command Line Interface (CLI)

The AWS CLI is a single command-line tool for every AWS service. AWS exposes a public API for every service (within 180 days of launch), so anything done in the console can be done with the CLI.

Why use it:

• Repetitive tasks — launching instances, taking EBS snapshots, attaching policies.
• Scripting and automation — for example, a report of all S3 buckets or all running instances.
• Speed — one command instead of many clicks.

Requirements

• Windows, macOS, or Linux.
• Outbound internet access on TCP port 443 (HTTPS).
• Credentials — traditionally an IAM access key ID and secret access key (Lesson 5). AWS CloudShell, a browser-based shell in the console, comes with the CLI already installed and signed in as the current console user, which avoids storing keys on a laptop.

Installation

• Amazon Linux images already include the CLI.
• Current practice (CLI version 2): use the official installer for your OS from the AWS documentation — a .pkg for macOS, an .msi for Windows, and a bundled zip installer for Linux. Version 2 includes its own runtime, so Python is not required.
• Book method (CLI version 1): install with Python and pip, or use the stand-alone bundled installer for offline installs. Students may see this on older material; version 2 is what they should install today.

Configuring and testing

aws --version
aws configure
aws iam list-access-keys

• aws --version confirms the CLI is installed and shows its version.
• aws configure prompts for four values: access key ID, secret access key, default Region (such as us-east-1), and default output format.
• aws iam list-access-keys is a safe read-only test; it returns the caller’s access keys.

Sample aws configure session:

AWS Access Key ID [None]: AKIAEXAMPLEKEYID
AWS Secret Access Key [None]: ****************************************
Default region name [None]: us-east-1
Default output format [None]: json

Output formats are json, text, or table (lowercase — the value is case-sensitive). Sample JSON response:

{
  "AccessKeyMetadata": [
    {
      "UserName": "Ben",
      "Status": "Active",
      "CreateDate": "2023-09-08T13:37:00Z",
      "AccessKeyId": "AKIAEXAMPLEKEYID"
    }
  ]
}

Safety reminder: aws configure saves keys in a plain-text file in the user’s home folder. Never paste real keys into slides, chats, or screenshots, and never use root keys.

Book exercise (6.1): install the CLI, create an access key for an IAM user, run aws configure, then run aws iam list-access-keys.

5. Software development kits (SDKs)

An SDK is a library that lets a program call AWS services without writing low-level API code. SDKs handle request signing (authentication), formatting data, retries, and connections, so developers focus on the application. Students won’t write SDK code in this course, but should know what SDKs are for.

• Language SDKs: Java, .NET, Node.js, JavaScript, Python (Boto3), PHP, Ruby, Go, C++, and others.
• Mobile development: the book lists Mobile SDKs for Android, iOS, Unity, and .NET/Xamarin. Today, AWS Amplify is the main AWS framework for web and mobile apps; it builds a backend on AWS (authentication, notifications, offline data sync, analytics) and connects Android, iOS, web, and React Native front ends to it.
• IoT device SDKs: for sensors, microcontrollers, smart appliances, and similar devices. AWS IoT services onboard, manage, and monitor devices and let them work with S3, DynamoDB, Kinesis, Lambda, SNS, and SQS. IoT SDKs are optimized for low memory, network, and power use and are available for Embedded C, JavaScript, Python, Java, C++, and Arduino.

Quick comparison:

Tool	Best for
Console	Learning, one-off tasks, visual reports
CLI	Repetitive tasks, scripts, bulk information
SDK	Applications that use AWS services in code

6. Amazon CloudWatch

CloudWatch collects, searches, and visualizes monitoring data as metrics, logs, and events. Common use cases:

• Infrastructure monitoring and troubleshooting — spot trends and outliers; correlate metrics and logs to find root causes.
• Resource optimization — find over- or under-used resources; drive Auto Scaling.
• Application monitoring — alarms when utilization, performance, or health crosses a threshold.
• Log analytics — search and correlate logs from many sources.

Metrics

A metric is a time-ordered set of data points. Each data point has a timestamp, a value, and optionally a unit. Example: EC2 CPUUtilization, value 75, unit Percent. AWS services send metrics automatically (EC2 CPU, S3 bucket size, DynamoDB capacity used), and you can send custom metrics from on-premises servers or applications. CloudWatch keeps metrics for up to 15 months and can graph them to show trends.

Alarms

An alarm watches one metric. When the metric crosses a threshold and stays there for the period you set (for example, average CPU above 80 percent for 5 minutes), the alarm acts:

• SNS notification — Simple Notification Service uses publish/subscribe. A publisher sends a message to a topic; subscribers receive it by HTTP/HTTPS, SQS, Lambda, mobile push, email, email-JSON, or SMS text.
• EC2 Auto Scaling action — add or remove instances to match demand.
• EC2 action — stop, terminate, reboot, or recover an instance. Recover moves the instance to new host hardware after a physical problem.

Dashboards

Dashboards combine graphs, latest values, and alarms on one page. They can be saved, shared, and can show metrics from multiple Regions for a global view.

Logs

CloudWatch Logs collects and stores log files from AWS and non-AWS sources.

• Log event — one line of a log: a timestamp and a message.
• Log stream — log events from one source (for example, one web server’s access log).
• Log group — a collection of related streams (for example, access logs from all web servers).

Services can send their own vended logs — Route 53 DNS query logs, VPC Flow Logs, CloudTrail logs — and applications can send custom logs. Logs are kept forever by default; set a log group’s retention (1 day to 10 years) or export to S3 for archiving.

Metric filters turn log data into numeric CloudWatch metrics — either by extracting a number (such as query time in milliseconds) or by counting matches (such as the number of 403 Forbidden errors every 5 minutes). Metrics are always numbers; a text value such as an IP address cannot be stored in a metric.

Events (now Amazon EventBridge)

CloudWatch Events watches for specific changes to resources — such as an instance moving from running to stopped, or a user signing in to the console — and immediately triggers a target: a Lambda function, EC2 instance action, SQS queue, SNS topic, or ECS task. You define a rule that selects the events and the target. Rules can also run on a schedule, such as stopping development instances every day at 7 p.m. to save money.

Modern note: CloudWatch Events is now Amazon EventBridge, which uses the same rules and adds more event sources. Students may see either name.

Key distinction: alarms react to a metric crossing a numeric threshold over time; events react immediately to something specific happening.

7. AWS CloudTrail

CloudTrail records the actions taken in an account — the audit trail of who did what, when, and from where. Each event includes:

• the service endpoint (for example, iam.amazonaws.com)
• the API action (for example, RunInstances, CreateUser, PutObject)
• the Region (global services are recorded as us-east-1)
• response elements (for example, the new instance ID and private IP address)
• the principal that made the request (user or role, its ARN, and name)
• the date and time in UTC
• the requester’s IP address

Event types

• API vs. non-API events — API events include launching instances, creating buckets or users, and taking snapshots, no matter whether done in the console, CLI, or SDK. Non-API events include things like signing in to the console.
• Management events (control plane) — operations on resources. Write events change or might change something (RunInstances); read-only events only look (DescribeInstances).
• Data events — high-volume activity such as S3 object reads and writes (GetObject, PutObject, DeleteObject) and Lambda function runs. These are logged separately and are off by default.

CloudTrail records API calls whether they succeed or fail — failed attempts are often the most interesting security evidence.

Event history vs. trails

• Event history — on automatically for every account; keeps 90 days of management events per Region; searchable and downloadable; no data events. Global service events (IAM, Route 53) appear in every Region’s history.
• Trail — a configuration you create to keep events longer or customize them. A trail writes JSON log files to an S3 bucket, can cover one Region or all Regions, and can include management events, data events, or both (read, write, or both). Trail files are not searchable in CloudTrail itself; send them to CloudWatch Logs to search, set retention, and create metric filters.

Log file integrity validation

When enabled, CloudTrail stores a cryptographic hash of each log file. If anyone changes the file, even by one bit, the hash no longer matches. Validation shows that a file was changed or deleted, not how. Log files can be encrypted with SSE-S3 or SSE-KMS (Lesson 5).

CloudWatch vs. CloudTrail — a comparison students need:

	CloudWatch	CloudTrail
Answers	How is it performing?	Who did what?
Data	Metrics, logs, events	API activity records
Typical use	Alarms, dashboards, troubleshooting	Security auditing, investigations, compliance

8. AWS Cost Explorer and Billing Conductor

Cost Explorer (part of Billing and Cost Management, introduced in Lesson 2) turns billing data into graphs and reports. Data is updated at least every 24 hours.

Cost and usage reports

• Daily or monthly costs and usage for up to the past year.
• Forecasts for the current month, 3 months, and 12 months.
• Filter or group by service, Availability Zone, Region, instance type, usage type, tag, API operation, charge type, platform, and more.

Built-in reports:

• Monthly costs by service — top five services over six months; the rest combined.
• Monthly costs by linked account — top five accounts in an organization.
• Monthly EC2 running hours costs and usage.
• Daily costs — with a forecast for the current month.
• AWS Marketplace — spending on third-party products bought through AWS (Lesson 7).

Reservation reports and recommendations

Reserved Instances (Lesson 7) mean committing in advance to compute capacity in exchange for a lower price (EC2, RDS, ElastiCache, Redshift, OpenSearch).

• RI Utilization — how much of the reservations you bought you are actually using, and your net savings or overspend.
• RI Coverage — how many running hours were covered by reservations, what on-demand hours cost, and what reservations could have saved.
• Recommendations — Cost Explorer looks at the past 7, 30, or 60 days of on-demand usage (ignoring usage already covered) and recommends the most cost-effective reservations for each service. You can pick the term and payment option.

Modern note: Cost Explorer also offers the same kind of utilization, coverage, and recommendation reports for Savings Plans, AWS’s more flexible commitment model.

AWS Billing Conductor

Companies that resell AWS-based services to their own customers need custom bills. Billing Conductor puts each customer’s accounts into a billing group and applies pricing rules to mark up or discount the real AWS cost automatically, instead of calculating it by hand from tags.

9. Governance: AWS Config, Control Tower, and License Manager

AWS Config

AWS Config records how resources are configured and how that changes over time — a configuration “time machine.” It also records relationships (for example, which instance an EBS volume was attached to and when it was detached).

Uses:

• Security — notifications when configurations change; see what permissions looked like at a given time.
• Audit reports — show how resources were configured at any point.
• Troubleshooting — see the configuration when a problem began.
• Change management — see what depends on a resource before changing it (for example, every instance using a security group).

Vocabulary:

• Configuration recorder — discovers resources, records their settings, and tracks changes.
• Configuration item — one resource’s settings at one moment, plus type, ARN, creation time, and relationships. Items are kept even after the resource is deleted.
• Configuration history — all items for one resource over time; delivered to S3 and viewable in the console, with optional SNS notification of each change.
• Configuration snapshot — a backup of the configuration of all recorded resources, delivered to S3 on a schedule for offline auditing.
• Rules — managed (predefined) or custom checks against a desired baseline, such as “every EC2 instance has a CPU alarm” or “root has MFA.” Noncompliant resources are flagged and can trigger SNS notifications.

AWS Config vs. CloudTrail: Config shows what the resource looked like; CloudTrail shows who changed it. They are used together in investigations.

AWS Control Tower

Control Tower sets up and governs a multi-account AWS environment. It creates a landing zone — a well-structured set of accounts (including a management account and a log archive account) across one or more Regions — and applies controls (the book calls them blueprints; AWS formerly called them guardrails) that enforce security, compliance, and operational best practices. It also simplifies ongoing monitoring of new and existing accounts.

AWS License Manager

License Manager tracks software licenses (such as Microsoft or Oracle) for AWS and on-premises servers. It tracks usage, monitors compliance, and enforces license rules to prevent violations. License Manager itself has no charge.

Classroom application

Suggested demonstration and lab sequence (free-tier friendly):

1. Sign in as an IAM user using the account alias; point out the 12-hour session and the account menu.
2. Change Regions and show that EC2 resources “disappear”; switch back.
3. In Tag Editor, find all EC2 and S3 resources in one Region and add Environment and Owner tags. Build a tag-based resource group.
4. Open AWS CloudShell (or a local terminal with the CLI) and run aws --version, aws sts get-caller-identity, and aws s3 ls. Compare the time to the console.
5. In CloudWatch, graph CPUUtilization for an instance and create an alarm that sends an email through an SNS topic.
6. In CloudTrail event history, filter by user name and find the actions just performed, including the tag changes.
7. In Cost Explorer, group the last six months by service, then by tag.

Discussion prompts:

• A manager wants a text message when a web server’s CPU stays above 90 percent. (CloudWatch alarm → SNS.)
• An S3 bucket was made public last night. Who did it? (CloudTrail.) What did the bucket policy look like before? (AWS Config.)
• Development servers should shut down at 7 p.m. every day. (EventBridge/CloudWatch Events schedule, using an automation tag to select servers.)
• Finance wants each department’s monthly AWS cost. (Business tags + Cost Explorer grouping.)

Common misconceptions

• “My resources were deleted.” Usually the wrong Region is selected.
• “The CLI can do less than the console.” Every service has an API; the CLI can do anything the console can, and some advanced settings are CLI-only.
• “Tags are just labels.” Tags drive cost reporting, automation, resource groups, and even IAM permission decisions — and they are case-sensitive.
• “CloudWatch and CloudTrail do the same thing.” CloudWatch is performance and logs; CloudTrail is an audit record of API activity.
• “CloudTrail keeps everything forever.” Event history keeps only 90 days of management events; a trail is required for longer retention and for data events.
• “An alarm fires the instant a metric spikes.” The metric must cross the threshold and stay there for the evaluation period. Events, not alarms, react immediately.
• “Metric filters can store any value from a log.” Metrics are numeric only.
• “AWS Config prevents bad changes.” Config records and evaluates configurations; it flags noncompliance rather than blocking changes (preventive controls come from IAM policies and Control Tower).

Lesson summary

The AWS Management Console is the point-and-click interface: sign in as root with an email address or as an IAM user with an account ID or alias, choose services and Regions carefully, and use the account menu to switch roles or reach billing. Tags (key plus optional value, case-sensitive) organize resources for technical, automation, business, and security purposes, and resource groups gather tagged resources or CloudFormation stacks into one view; Tag Editor applies tags in bulk. The Console Mobile Application gives quick, limited access on the go. The AWS CLI performs any console task from a terminal and is essential for scripting; SDKs let applications, mobile apps, and IoT devices use AWS in code. CloudWatch collects metrics (kept 15 months), triggers alarms that notify through SNS or take Auto Scaling and EC2 actions, displays dashboards, stores logs organized into streams and groups, derives metrics with metric filters, and reacts to events (now EventBridge). CloudTrail records account activity: 90 days of management events by default, with trails for longer storage, data events, and CloudWatch Logs integration, protected by log file integrity validation. Cost Explorer reports and forecasts cost and usage and analyzes reservations, while Billing Conductor produces custom bills for resellers. AWS Config records configuration history and checks rules, Control Tower governs multi-account landing zones, and License Manager tracks software license compliance.