Search for AWS ships one dashboard per AWS service, built entirely on its search commands. Because the commands query AWS live, the dashboards show your accounts as they are right now - a live console, not a view over stored history. Every dashboard has an account picker and, where the service is regional, a region picker fed by the account’s allowed or enabled regions.
Three conventions run through all of them:
- Fleet, then detail. A service dashboard is a fleet view: inventory, posture, and hygiene for everything of that kind in the selected account and region. Clicking a row opens the detail dashboard for that one resource, carrying the account, region, and time window across. The per-resource CloudWatch metrics and logs live on the detail dashboards, so metric calls happen for the resource you asked about, not for the whole fleet on every page load. Lambda and EKS are the exceptions - their fleet views chart the whole fleet with a handful of Metrics Insights queries, and the Lambda fleet’s Saturation & Cost tab runs Logs Insights over every function’s log group; see Costs and performance.
- Documents open in place. Where a resource’s documents are the point - an IAM role’s trust and inline policies, a KMS key policy, a WAF web ACL’s rules, a CloudFormation stack’s properties - clicking the row fills an inspector directly under the table.
- A failure shows, and is not counted. When an account or region cannot be queried, or CloudWatch cuts an answer short, every panel drawn from that search shows the warning icon - hover it for the account, the region, and AWS’s message - and its counts and tables leave the failed target out rather than counting it as one more resource. On the Overview, the Needs attention tiles and the Spend tab’s month totals read n/a instead of a total that is missing a target when AWS answers that target with an error, and the alarm list names the failure in a row of its own.
Find them under the app’s navigation bar, grouped as below.
Overview
Overview is the landing dashboard. It opens on Needs attention: the alarms in ALARM and the certificates expiring within 30 days now, and the alarms that fired (OK again or not), Lambda errors, API Gateway 5XX responses, failed console sign-ins, and root user events over an Activity window you pick, above the alarms that are not OK. The certificates, sign-ins, and root user events are counted in us-east-1 too, where CloudFront’s certificates live and CloudTrail records those events, unless the account’s allowed regions leave it out, and each tile opens the dashboard that explains it over the same window and regions. Then the account’s footprint at a glance, a Spend tab with this month’s charges so far, last month’s, and the month projected from settled days, all before credits, which calls Cost Explorer only when you open it, and a Navigator tab that links to every dashboard in the app.
Compute
Compute & Inventory covers EC2 - instances by type, state, and availability zone, with an instance detail dashboard for CPU, network, disk, status checks, and the instance’s CloudTrail history. Lambda lists every function with runtime, memory, timeout, and triggers; its detail dashboard adds invocations, errors, duration, throttles, concurrency, an error-class breakdown read from the function’s own log lines (timeouts and crashes), and a Logs tab that tails /aws/lambda/<name>; its Errors & Changes tab lists the function’s aliases with the version each serves, marking one that serves $LATEST and any weighted routing. ECS covers clusters and services with a service detail dashboard that discovers each container’s log group from the task definition. EKS and ECR list clusters and repositories.
Networking
Networking covers VPCs, subnets, route tables, gateways, and security groups, with the rules that matter for posture called out. Load Balancers lists ALBs and NLBs with listeners and target groups. Its detail dashboard charts request, latency, and error metrics for application load balancers; a network or gateway load balancer is shown there by name, and its panels stay empty, because it publishes under a different CloudWatch namespace. API Gateway lists REST and HTTP APIs. Its detail dashboard is for REST APIs: request, latency, and error metrics for the API as a whole (by API name, not per stage) and execution logs. HTTP and WebSocket APIs are inventory only there; chart their metrics on Metrics Explorer, by ApiId. Edge & certificates has a tab each for ACM certificates (the days left on each, from the DaysToExpiry metric, expiring first), CloudFront distributions (aliases, origins, minimum TLS version, web ACL, requests, data out, and 4xx and 5xx rates weighted by requests), and Route 53 health checks (the status now, how much of the window each passed, and when it last failed). CloudFront and health-check metrics are read in us-east-1, where AWS publishes them, whatever the region picker says, so an account whose allowed regions leave out us-east-1 shows those panels with a warning and no data; add us-east-1 to its allowed regions to see them.
Storage
S3 lists buckets with encryption, versioning, public-access block, and object ownership; the bucket detail dashboard adds bucket-policy statements, lifecycle rules, tags, and size and object-count trends. EBS lists volumes with type, size, encryption, and attachment; the volume detail dashboard adds IOPS, throughput, latency, queue length, and burst balance, and links through to the attached instance.
Databases
RDS & Aurora lists instances and clusters with engine, class, storage, and Multi-AZ; the instance detail dashboard adds CPU, connections, IOPS, latency, free storage, and every log type the instance exports. DynamoDB lists tables with billing mode and capacity; the table detail dashboard adds consumed capacity, throttles, and latency.
App Integration
SQS, SNS, and Step Functions each list the service’s resources with their configuration and a detail dashboard for queue depth and age, delivery metrics, and execution outcomes. EventBridge lists the default bus’s rules with what triggers each, their targets, and how often each triggered, invoked its targets, and failed to over the window - a failed invocation is one EventBridge could not deliver, which the target’s own dashboard never shows - and the EventBridge Scheduler schedules with expression, time zone, target, retries, and dead-letter queue, beside each schedule group’s invocation attempts, target errors, and dropped invocations. SES charts email sent, delivered, bounced, and drawing complaints, colors the bounce and complaint rates at the thresholds where AWS reviews (5% and 0.1%) and may pause (10% and 0.5%) an account’s sending, and lists the sending identities with their DKIM and MAIL FROM settings.
Analytics
Kinesis Data Streams and Kinesis Data Firehose list streams with shards, retention, and encryption, and detail dashboards for throughput and iterator age. Glue Data Catalog browses databases, tables, and partitions, with a table detail dashboard showing columns, format, and location - the catalog behind your Athena queries.
Security
IAM lists roles, users, and managed policies; clicking a row shows the trust policy, inline policies, and attached policies in place. Its Credentials tab reads the IAM credential report: the root user’s MFA and access keys, console users without MFA, passwords and access keys unused for 45 days, and access keys older than 90 days (the CIS AWS Foundations Benchmark’s thresholds), above a table of every user with what is wrong with each. KMS lists keys with rotation state and shows a key’s policy in place. WAF lists web ACLs with their rules. CloudTrail - Security & Activity summarizes recent management events by service, user, and outcome. CloudTrail - Event Explorer is an interactive front end to | awscloudtrail: it loads the most recent events, up to the limit you pick, and narrows them by event name, event source, principal, resource, and outcome without writing SPL. The filters apply to what was loaded, so an event older than that window is not found - for those, search with | awscloudtrail attribute=... value=..., which asks CloudTrail for the match itself. Its Principal investigation view follows one user name or role session across everything it did; to follow an access key, use | awscloudtrail attribute=AccessKeyId value=....
Observability
CloudWatch shows which alarms are firing - tiles for the alarms in ALARM and with insufficient data, and every alarm that is not OK, firing first, each opening in the CloudWatch console - and lists alarms and log groups; alarm rows link to the Metrics Explorer with the alarm’s metric and dimensions pre-filled, and log-group rows link to the Log Tail. Its History tab reads what the alarms did over a window from an hour to 30 days, so an alarm that fired at night and recovered before anyone looked still shows: tiles for the alarms that fired, the times they went into ALARM, the alarms that fired three times or more, failed actions such as a notification that could not be sent, and configuration changes; a chart of how many alarms were in ALARM across the window, the ten that spent the longest there by name; the alarms in ALARM during the window, the most often fired first, with the full history of the one you click shown in place; and tables of the failed actions and the configuration changes. The Overview’s alarms-that-fired tile opens the CloudWatch dashboard with that window set to its Activity window. Metrics Explorer charts any metric the account publishes, with Namespace, Metric, and Dimensions pickers fed from the live metric catalog (| awsmetrics list=true), so an empty chart means no data in the window, not a mistyped dimension. The catalog lists only metrics that reported data in the past two weeks, so a resource idle for longer is not in the pickers. Logs Insights runs a Logs Insights query over one or more groups. Log Tail reads raw events from any log group, newest first, driven by a CloudWatch filter pattern.
Management
CloudFormation lists stacks with status and drift-relevant fields, and shows a stack’s parameters, outputs, and resources in place. Governance, Tagging & Resource Explorer finds resources by tag and reports tag coverage. Cost & Usage is where you query Cost Explorer: cost by service, region, and tag over the time picker, and a month-over-month tab. Its panels wait for a Submit, because Cost Explorer bills per request; the only other call is the Overview’s Spend tab, when you open it.
About
About shows the app version, links to the Setup page, and reprints the IAM policy the app needs and the Splunk Cloud egress notes.
Every dashboard is read-only and runs against the live APIs on the search head, so opening one is exactly as safe (and as current) as running the underlying command yourself. To build your own, start from the Command reference - the bundled dashboards are just SPL over the same nine commands.