Monitor VPC interface endpoints with CloudWatch metrics and alarms

Michael Wittig – 29 Aug 2022

Many VPC designs make use of private subnets. To communicate with AWS APIs, you either need a NAT gateway or VPC endpoints. S3 and DynamoDB are special because they support gateway endpoints. All other AWS services support interface endpoints.

Monitor VPC interface endpoints with CloudWatch metrics and alarms

A VPC interface endpoint is a finite resource that can be exhausted. That’s why you need to add monitoring to be alerted if the interface endpoint gets a bottleneck.

CloudWatch metrics

Each interface endpoint sends metrics to CloudWatch that we can monitor with CloudWatch alarms. We recommend creating alarms for the following metrics:

  • PacketsDropped: The number of packets dropped by the interface endpoint (Increasing values could indicate that the endpoint or endpoint service is unhealthy).
  • RstPacketsReceived: The number of RST packets received by the interface endpoint (Increasing values could indicate that the endpoint service is unhealthy).

Monitoring throughput utilization

Unfortunately, interface endpoints do not report a single metric on the throughput utilization of bandwidth. The maximum bandwidth is 100 Gbit/second. Luckily, we can calculate throughput by using CloudWatch metric math.

To calculate the bandwidth utilization, we use the following metrics:

ID metric statistic period
bytesProcessed BytesProcessed Sum 60

And the following expressions:

ID expression comment
bandwidth bytesProcessed/60*8/1000/1000/1000 Bytes/min to Gbit/s
utilization bandwidth/45*100 to %; 45 Gbit/s is the hard limit

Set up instructions

Monitoring Setup Assistant
CloudWatch metric math sounds complicated? We have you covered! Monitor VPC interface endpoints and receive alerts in Slack or Microsoft Teams!

  1. Add marbot to Slack or Microsoft Teams.
  2. Invite marbot to a channel.
  3. In the channel, type:
    @marbot Monitor interface endpoint
  4. Hit enter and follow the wizard.
Michael Wittig

Michael Wittig

Consultant focusing on Amazon Web Services (AWS). Entrepreneur building marbot.io. Author of Amazon Web Services in Action, Rapid Docker on AWS, and cloudonaut.io.

You can contact me via Email, Twitter, and LinkedIn.

Published on

marbot teaser

Chatbot for AWS Monitoring

Configure monitoring for Amazon Web Services: CloudWatch, EC2, RDS, EB, Lambda, and more. Receive and manage alerts via Slack. Solve incidents as a team.

Slack
Add to Slack
Microsoft Teams
Add to Teams