Question

A financial services company exposes an internal REST API through an Application Load Balancer reachable only within their VPC. The network operations team wants proactive alerting when the API's HTTPS response latency exceeds a threshold or when the endpoint returns error codes, even during periods with no customer traffic. The monitoring must run from within the private network context and generate CloudWatch metrics and alarms. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy a CloudWatch Synthetics canary configured to run inside the VPC subnets, using a heartbeat/API canary script that issues periodic HTTPS requests to the internal ALB and publishes latency and status-code metrics for CloudWatch alarms.

Answer

Enable VPC Flow Logs on the ALB subnet ENIs and create a metric filter that counts high-latency connections, then alarm on the resulting metric.

Answer

Configure the ALB access logs to write to S3 and use Athena scheduled queries to detect elevated latency and error rates, publishing results back to CloudWatch.

Answer

Create a Route 53 health check pointing at the internal ALB DNS name and alarm on the CloudWatch health-check status metric.