> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CloudWatch and CloudTrail Alert Control Challenge

> Hands-on lab · 25m

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.

<a className="ip-lab-portal-btn" href="https://labs.intellectualpoint.com/labs/cloudwatch-and-cloudtrail-alert-control-challenge" target="_blank" rel="noreferrer">
  Open IP Lab Portal
</a>

## Overview

### Prerequisites

1. Good knowledge of AWS service

* Cloudwatch
* CloudTrail
* Elastic Compute (EC2)

2. Laptop/Desktop
3. Internet Browser
4. Internet connection

### Challenge Instructions

1. **Region** : Make sure to use **us-east-1** region to create all the resources.
2. You will be provided with the requirements of the challenge. If you are new to AWS Cloud, we recommend you go through our hands-on Labs before taking this challenge.
3. **Challenge Duration**: 25 min

### How to submit the challenge

1. After building the infrastructure, click on the **Check my work** button, to validate if you have built the required infrastructure and completed the challenge successfully.
2. Validation status:

* **Success** - You have completed the challenge successfully.
* **Failed** - You have failed to complete the challenge.

3. Once you have successfully validated the challenge, click on **End lab** button to end the challenge.

### Launching Challenge Environment

1. To launch the challenge environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Challenge is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.

**Note** : You can only start one challenge at any given time

## Lab guide

### Sign in to AWS Management Console

1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page, leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the challenge.
3. Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
4. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**

### Cloud Challenge Details

In this challenge, your Cloudwatch skills are put to the test. You'll be given a requirement and you have to reach it using your knowledge of CloudTrail which will be used in this challenge. This Challenge will help you understand the real-time scenarios.

### Architecture diagram

<img src="https://mintcdn.com/ip-cloud-architect-pathway/2u36x6URmH9hJ3QL/images/labs/cloudwatch-and-cloudtrail-alert-control-challenge/001.png?fit=max&auto=format&n=2u36x6URmH9hJ3QL&q=85&s=a255ba0e9731b1a26da147859f623cd2" alt="" width="1530" height="839" data-path="images/labs/cloudwatch-and-cloudtrail-alert-control-challenge/001.png" />

**A Company XYZ wants to setup AWS monitoring by creating CloudTrail and CloudWatch log groups, along with a metric filter in CloudWatch to trigger alarms through an SNS topic. The below are the tasks that need to be performed by you in order to create the stack.**

1. Create CloudTrail make sure to **Uncheck** Log file SSE-KMS encryption and **check** CloudWatch Logs

   > **Note :** Select existing IAM role while creating cloudtrail. Role name starts with **whiz\_role\<random.numbers>**
2. Create Metric filters for the created CloudWatch log groups by cloud trail to detect **StopInstances.**
3. Create Alarm and **check** your mail from AWS Configuration.
4. Create **EC2 Instance** to Trigger the Alarm:

* Create security group and give **open** access to SSH.

5. Check Alarm.
6. Click on the **Validate** to complete the challenge.
7. **Delete** the resources after Validation.

### End lab

1. Sign out of the AWS Account.
2. You have successfully completed the challenge.
3. Click on **End lab** button in the IP Lab Portal and wait till the process gets completed.

## What gets checked

When you press **Check my work**, the platform verifies each of these:

* **Check Log Group** — Check whether a CloudWatch log group exists.
* **Check Log Stream** — Check whether the CloudWatch log stream is created.
* **Create an Amazon SNS Topic** — Check If SNS Topic created or not
* **Check CloudWatch Alarm Creation** — Check whether at least one CloudWatch alarm exists or not.

## Related help

* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)
* [SSH into EC2 Instance](/aws-cp/support/ssh-into-ec2-instance)