# Connections & Observability (/connectors/aws/reference/connections-endpoint)



This reference documents the AWS connector's observability surface: the **read-only management
API**, the **Prometheus metrics**, the **dashboard page**, and the **audit events**. The
management APIs live on the **internal API port** and are network-protected.

## Management API [#management-api]

A **read-only** management API summarizes connector activity:

| Endpoint                               | Returns                                                                                                                                  |
| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| `GET /api/aws/overview`                | aggregate counts (queues / topics / subscriptions / in-flight / active long polls) + waiting-message counts (fed by the 2 s stats cache) |
| `GET /api/aws/operations`              | per-operation counters keyed `{service}/{op}` (e.g. `sqs/send_message`, `sns/publish`)                                                   |
| `GET /api/aws/operations/:service/:op` | a single operation's counters (e.g. `/api/aws/operations/sqs/send_message`)                                                              |

Use the overview to confirm the connector accepted traffic after an upgrade.

## Prometheus metrics [#prometheus-metrics]

### Counters [#counters]

| Metric                                                  | Meaning                                                     |
| ------------------------------------------------------- | ----------------------------------------------------------- |
| `kubemq_aws_operations_total{service,operation,status}` | operations, by service / op / status                        |
| `kubemq_aws_sns_deliveries_total{result}`               | SNS deliveries, by result                                   |
| `kubemq_aws_sns_delivery_dropped_total`                 | SNS deliveries dropped (job-queue overflow / unrecoverable) |

### Histogram [#histogram]

| Metric                                  | Meaning               |
| --------------------------------------- | --------------------- |
| `kubemq_aws_operation_duration_seconds` | per-operation latency |

### Gauges [#gauges]

| Metric                         | Meaning                                       |
| ------------------------------ | --------------------------------------------- |
| `kubemq_aws_queues`            | registered queues                             |
| `kubemq_aws_topics`            | registered topics                             |
| `kubemq_aws_subscriptions`     | registered subscriptions                      |
| `kubemq_aws_inflight`          | in-flight (received-but-not-deleted) messages |
| `kubemq_aws_active_long_polls` | parked long-poll slots in use                 |

<Callout type="info">
  There is **no CloudWatch metrics emulation** — Prometheus is the metrics surface. See
  [Capabilities](/connectors/aws/reference/capabilities).
</Callout>

## Dashboard [#dashboard]

The KubeMQ dashboard has an `/aws` page backed by the management API above.

## Audit events [#audit-events]

The connector emits audit events for control-plane operations (data-plane SQS sends/receives are
**not** audited):

| Event                   | When                                                         |
| ----------------------- | ------------------------------------------------------------ |
| `aws.auth.failure`      | a SigV4 / authorization failure                              |
| `aws.queue.*`           | queue lifecycle (create / delete / tag / purge)              |
| `aws.topic.*`           | topic lifecycle                                              |
| `aws.sub.*`             | subscription lifecycle (subscribe / confirm / unsubscribe)   |
| `aws.registry.conflict` | a registry conflict (e.g. registry-sync conflict resolution) |

## Stats cache [#stats-cache]

The `ApproximateNumberOfMessages` attribute and the overview waiting counts are fed by a stats
cache that wraps the broker queue stats with a **2 s TTL** plus duplicate-call suppression.

## Related [#related]

<Cards>
  <Card title="Connectivity & security" href="/connectors/aws/how-to/connectivity-and-security" description="The traffic gate that returns an AWS-shaped 503 until the broker is ready." />

  <Card title="Authentication" href="/connectors/aws/how-to/authentication" description="SigV4 accept-any mode, static credentials, and the aws.auth.failure audit event." />

  <Card title="Capabilities" href="/connectors/aws/reference/capabilities" description="Supported actions and why there is no CloudWatch emulation." />

  <Card title="Reliability" href="/connectors/aws/how-to/reliability" description="SNS delivery state, the bounded job queue, and the dropped-delivery counter." />
</Cards>