How do you monitor and troubleshoot applications on AWS?

CloudWatch is the foundation, collecting metrics (numeric time series, with basic EC2 metrics free at five-minute intervals and detailed monitoring at one), logs (via the CloudWatch agent or natively from Lambda and ECS), and alarms that trigger notifications or actions such as Auto Scaling.

The rest of the toolkit:

• CloudWatch Logs Insights — a query language for searching and aggregating across log groups, which is how you actually investigate rather than scrolling.
• X-Ray — distributed tracing. In a system of many services, this is what tells you which downstream call made a request slow. Essential once you pass a handful of services.
• CloudTrail — an audit log of every API call: who did what, when, and from where. The first place to look when something changed unexpectedly, and a security-critical record that should be shipped to a separate account.
• VPC Flow Logs for network-level troubleshooting and detecting unexpected traffic.
• AWS Health Dashboard for platform-side events affecting your resources — check this early.

Practices that matter: structured JSON logging so logs are queryable; a correlation id propagated across services; custom business metrics alongside infrastructure metrics; and log retention set deliberately, because CloudWatch Logs ingestion and storage is a common surprise on the bill.

Note: Alarm on user-visible symptoms — error rate, latency, availability — rather than on CPU. Alerting on causes produces noise.