AWS Integration

KuaDashboard provides a comprehensive AWS management panel accessible from the sidebar under Cloud > AWS. It gives you a single unified view over 22 AWS services without ever leaving the dashboard.

Since v1.7.0: EC2 SSH/RDP sessions now stay alive as restoreable tabs; Kubernetes logs, YAML and metrics improvements are available from the unified operations surface.

Authentication

AWS credentials can be configured in multiple ways:

Method	Description
Env Manager	Store named profiles with AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN (optional, for temporary credentials), and AWS_DEFAULT_REGION
AWS CLI	Reads ~/.aws/credentials and ~/.aws/config automatically
Local profiles	Select any named profile from your existing ~/.aws/credentials or ~/.aws/config, including SSO profiles created with aws configure sso
Environment variables	AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION
IAM roles	When running on AWS infrastructure (EC2, ECS task, Lambda, etc.)

Temporary credentials (STS / IAM Identity Center)

Profiles support temporary session credentials — the kind issued by AWS STS or the IAM Identity Center (SSO) access portal, where the access key starts with ASIA. Paste the three values (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) into the profile form or import them from a .env file. When the session expires, the dashboard shows a clear message asking you to refresh the credentials.

Alternatively, if you already use aws sso login from the terminal, your SSO profiles appear in the local profiles list and the SDK resolves the cached session automatically — no copy-pasting needed while the SSO session is active.

Built-in SSO login (no copy-paste at all)

When creating an AWS profile, choose "Iniciar sesión temporal (SSO)". KuaDashboard detects your SSO profiles from ~/.aws/config (or you paste the start URL once), opens the AWS access portal in your browser, and once you approve it captures the temporary credentials and stores them in the encrypted vault automatically — the same device-authorization flow the AWS CLI uses.

The dashboard tracks the session expiration: profile cards show a live countdown badge, and when less than 15 minutes remain a persistent alert appears with a one-click "Renovar sesión" button that re-runs the browser login and refreshes the stored credentials.

Select your active profile and region from the dropdowns in the AWS panel header. All API calls use the selected profile credentials.

---

Overview

Overview is the first item of the AWS sidebar and the view AWS opens on. It shows who the active profile is and what it can see:

• Account — account ID (and alias when the profile may read it), with a copy button.
• Identity — whether the profile is an IAM user, a role, an SSO permission set, a federated user or the root user, with its ARN. Root credentials show a warning.
• Region — the profile's region and the regions enabled in the account.
• Services — a card per service with its resource count: EC2 (running/stopped), Lambda, ECS (clusters and services), EKS, ECR, VPC, API Gateway (REST/HTTP), S3, DynamoDB, RDS, EventBridge, Step Functions, CloudFront, Route 53, Cognito and Secrets Manager. A service is active when it has at least one resource; active services come first. S3, CloudFront and Route 53 are account-wide (marked Global); the rest are counted in the profile's region. A + means there are more resources than the overview reads.

Every service is read on its own, in parallel and with a timeout: a missing permission marks only that card as No permission (with the IAM action when AWS reports it), and the rest still load. Clicking a card opens that service's tab. Only read-only List/Describe calls are made.

Costs, activity and services outside KUA

Below the summary the Overview adds, loaded in the background so the rest never waits:

• Costs — this month so far, the month-end forecast and last month, plus the most expensive services (services outside KUA are marked). Data comes from Cost Explorer, which AWS bills at USD 0.01 per request, so KUA caches it per profile for 12 hours on disk (~/.kuadashboard/aws-cost-cache.json, or the app data folder in the desktop app) and Refresh costs forces an update (2 requests). Without Cost Explorer access, KUA shows the account's estimated total from the CloudWatch billing metric (only available when Receive Billing Alerts is enabled) and offers Request access.

• Activity · last 24h — one card per service that has data, account-wide, with an hourly trend line:

  • Lambda: invocations, errors (and rate) and throttles.
  • EC2: average CPU across instances, peak and last hour.
  • Load balancers: ALB requests, 5xx errors and latency, and NLB traffic. When the load balancer itself returns the 5xx (usually no healthy targets), the card says so.
  • EKS: nodes, failed nodes, CPU and memory, when Container Insights is enabled; otherwise the card explains how to get them.
  • RDS: average and peak CPU, connections and the lowest free storage (flagged under 5 GB).
  • DynamoDB: consumed read and write units, throttled requests, system errors and latency.
  • Step Functions: executions started, succeeded, failed or timed out, and the average duration.
  • EventBridge: rule invocations, failed invocations and matched events, across the default and custom buses.
  • Glue: job runs started in the last 24h (succeeded, failed, running, run time) and the jobs that failed most.
  • CloudFront: requests, downloaded bytes and 4xx/5xx error rates (read from us-east-1, where CloudFront publishes its metrics).
  • S3: storage and object count of the buckets in the profile's region (daily CloudWatch metric).

  CloudWatch SEARCH expressions aggregate every instance or load balancer in one request, so the cards cost fractions of a cent; Glue runs come from the Glue API.

• Services outside KUA — services with cost this or last month, tagged resources (Resource Groups Tagging API, first 1,000 resources) or changes in the last 24 hours (CloudTrail write events only, so KUA's own reads do not count) that KUA does not manage yet, such as Elastic Load Balancing, SQS, KMS or Kinesis. Services KUA only uses indirectly (CloudWatch, CloudWatch Logs, CloudFormation) are listed last as Partly in KUA.

Each source is read on its own: a missing permission only hides that source and offers Request access.

CloudWatch Dashboards

Monitoring → CloudWatch Dashboards lists the account's existing CloudWatch dashboards (name, last change and size), with search and sorting. For each one:

• Open in AWS console opens the dashboard in the CloudWatch console (in the desktop app it opens in your browser), in the profile's region and partition.
• Details shows a summary of its widgets in reading order: type (metrics, logs, alarms, text…), title, what each shows (metrics and namespaces, Logs Insights log groups, alarms), view and region, plus the dashboard's JSON definition to copy.

View (or the dashboard name) draws the dashboard inside KUA, on the same 24-column layout:

• Metrics — time series (stacked when configured), bar and single value (with sparkline), including ./... shorthand, metric math, SEARCH and Metrics Insights SQL, per-metric stat, period, label, color and visibility, horizontal annotations and alarm annotations (the alarm's metric with its threshold and state). A widget using both left and right Y axes is drawn as two stacked charts instead of one chart with two scales.
• Logs — Logs Insights results as a table or as horizontal bars. Before querying, KUA estimates the data to scan from the log groups' stored size (free); queries under about 1 GB run automatically, larger ones show the estimate and a Run query button. The bytes actually scanned are shown under each widget.
• Text (Markdown, with any HTML shown as text) and alarm status widgets. Other widget types link to the console.

The time range starts on the dashboard's own range (for example one week) and can be changed. Auto-refresh re-reads metrics and alarms every minute; log queries only run again when you refresh, because Logs Insights is billed per GB scanned (USD 0.005/GB). Metrics cost USD 0.01 per 1,000 requested.

KUA builds every query from the dashboard definition stored in AWS; the app only asks for "widget N of dashboard X". Listing and viewing need cloudwatch:ListDashboards, cloudwatch:GetDashboard, cloudwatch:GetMetricData and cloudwatch:DescribeAlarms, plus logs:DescribeLogGroups, logs:StartQuery and logs:GetQueryResults for log widgets; without them the view offers Request access.

Access requests

When AWS denies a request, KUA explains what is missing instead of only showing the raw error. The error banner of the AWS view (and every No permission card in the Overview) offers Request access, which opens:

• The missing permissions — the IAM action AWS reported as denied, plus the other actions the same screen uses, so one grant fixes the whole view. When AWS hides the action (for example EC2's encoded authorization messages), KUA lists the actions that screen uses.
• A message for your AWS administrator — with your identity ARN, account, the actions and the resource, in English or Spanish (independent of the app language), ready to copy.
• A suggested IAM policy — the denied action on the reported resource and the rest of the screen's actions, ready to copy.

The action list comes from lib/awsIamCatalog.json, generated from the AWS SDK commands of each KUA route (npm run aws:iam-catalog; a test fails if it gets out of date). It only covers the AWS services KUA supports. Review suggested policies before applying them and narrow Resource to specific ARNs where you can.

Compute

EC2 Instances

Browse all EC2 instances with full detail and lifecycle control:

• Instance ID, name tag, type, public/private IP, availability zone, launch time
• Start and Stop instances directly from the table
• SSH — open a browser-based interactive SSH session (available when running)
• RDP — open a browser-based Windows remote desktop canvas (available for Windows instances)
• Persistent remote tabs — hide SSH/RDP windows without closing the WebSocket, then restore them from the floating session dock
• Tags — view all resource tags
• Config — view full JSON configuration of the instance
• Sortable by any column; searchable by name, ID, type or state

ECS (Elastic Container Service)

Full visibility into ECS services across all clusters:

• Service name, task definition, cluster, status (ACTIVE / DRAINING / INACTIVE)
• Desired, running and pending task counts
• Start — scale the service to 1 desired task
• Stop — scale the service to 0 desired tasks
• Logs — stream CloudWatch logs for the service
• CW Logs — open the CloudWatch Logs browser with configurable time window
• Config — view full service JSON configuration

EKS (Elastic Kubernetes Service)

Browse all EKS clusters:

• Cluster name and API endpoint, region, Kubernetes version, status, creation date
• Node groups — managed node groups of each cluster
• EC2 — number of EC2 instances running as nodes (managed node groups, Karpenter and self-managed nodes, detected from their EKS/Kubernetes tags)
• Info — AWS infrastructure of the cluster, in the same layout as the EC2 and Lambda Info panels:
  • Overview — ARN, version and platform version, IAM role, API endpoint access (public/private, allowed CIDRs), OIDC issuer, service CIDR, enabled control-plane logs and tags
  • Network — VPC, every subnet used by the control plane, node groups or nodes (with CIDR, AZ, free IPs and who uses it) and the cluster, additional and remote-access security groups
  • Node groups — status, capacity type, architecture, instance types, scaling (min/desired/max), EC2 count, AMI and release, subnets, Auto Scaling groups, launch template, node role and health issues
  • EC2 instances — every node instance with type, state, origin (node group, karpenter/<pool> or self-managed), private IP, AZ and spot/on-demand
  • Add-ons — EKS-managed add-ons with version, status, IRSA role and health issues
  • If a permission is missing (e.g. ec2:DescribeInstances), the other sections still load and a notice lists what could not be read
• Config — inspect ARN, endpoint, IAM role and tags
• Add to Dashboard — runs aws eks update-kubeconfig automatically so the cluster appears in the Kubernetes panel immediately

---

Serverless

Lambda Functions

The table adds two sortable columns, loaded right after the list:

• 24h — invocations of the last 24 hours, with errors in red (CloudWatch, one bulk query for all functions).
• Logs — the state of the function's CloudWatch Logs group, using its real group (custom LoggingConfig groups included): Active (has stored logs), Empty, No log group (the function never logged or the group was deleted; click to create it) or Unknown (the groups could not be read). Opening logs for a function without a log group shows a clear notice instead of an error.

Manage Lambda functions with a rich detail modal — click any function name to open it.

• Function name, description, runtime (Node.js / Python / Go / Java / etc.), memory (MB), timeout (s), state, last modified
• Invoke — send a custom JSON payload synchronously and inspect the full response
• Detail modal (6 tabs):
  • Básico — name, ARN, description, state, version, architecture, package type, memory, timeout, ephemeral storage, code size/hash and Tags (all in one grid)
  • Configuración — environment variables (toggle reveal), layers, VPC config, tracing/DLQ/concurrency, EFS mounts
  • Logs — live CloudWatch log viewer with time-range selector (15 min → 24 h) and refresh; if the log group does not exist yet, shows a Create Log Group button with configurable retention (7–365 days)
  • Monitoreo — CloudWatch metric sparklines: Invocations, Errors, Duration, Throttles, ConcurrentExecutions
  • Aliases — aliases and published versions table
  • Código — file tree + syntax-highlighted code viewer for ZIP-packaged functions

API Gateway

List all REST (v1) and HTTP/WebSocket (v2) APIs in one unified table:

• API name, ID, type (REST / HTTP / WEBSOCKET), endpoint URL, creation date
• Config — view stages, settings and deployment history
• Routes — open the integrations panel listing all routes, HTTP methods and backend targets

---

Storage

S3 Browser

Browse bucket contents without leaving the dashboard:

• Bucket name, region, creation date, tags
• Browse — navigate folders, view object sizes, download files, preview text content inline
• Tags — view bucket tags
• Config — view versioning, encryption, ACLs and CORS configuration
• Test — check endpoint accessibility and measure latency (ms) for any bucket; result shown inline per row
• + Create Bucket — create a new S3 bucket with name, optional region and optional public access block

DynamoDB

Inspect and manage DynamoDB tables:

• Table name, partition + sort key schema, status, billing mode (PAY_PER_REQUEST / PROVISIONED), item count, size on disk, creation date
• Browse — scan / query records visually in the inline item browser
• Info — detailed panel: billing mode, provisioned throughput, key schema, GSIs, LSIs, stream status, ARN
• + Create Table — create a new table with partition key, optional sort key, billing mode and RCU/WCU

ECR (Elastic Container Registry)

Manage Docker image repositories:

• Repository name, full URI, image tag mutability (MUTABLE / IMMUTABLE), scan-on-push status, creation date
• Tags — view resource tags
• Config — view lifecycle policies and scanning configuration
• Images — browse all images in the repository with digest, tags, push date, size and scan findings
• Deploy to K8s — generate Kubernetes manifests from any image tag and apply them directly to the connected cluster:
  • Configure app name, namespace, replica count, container port, image pull secret and kubectl context
  • Create Service option — optionally append a Service resource (ClusterIP, NodePort or LoadBalancer) separated by ---
  • Copy YAML to clipboard or apply with one click (kubectl apply --validate=false)

---

Networking

VPC

Inspect Virtual Private Clouds:

• VPC name, ID, CIDR block, state, subnet count, default VPC indicator
• Tags — view all VPC tags
• Config — view route tables, internet gateways and DHCP options
• Info — deep-dive panel (same layout as the EC2 and Lambda Info panels, with copy buttons on IDs) with 6 inner tabs:
  • Overview — VPC info card, resource summary counts (subnets, SGs, route tables, IGWs, NAT GWs) and all tags
  • Subnets — subnet ID, CIDR, availability zone, state, auto-assign public IP, available IP count
  • Security Groups — per-group card showing name, description and inbound rules table (protocol, port range, source CIDR)
  • Route Tables — per-table card listing all routes (destination CIDR, target, origin, state)
  • Internet Gateways — gateway ID, state, attachment state
  • NAT Gateways — gateway ID, subnet, public/private IP, state, creation date

Load Balancers

Every load balancer of the region: Application (ALB), Network (NLB), Gateway (GWLB) and Classic.

• Name, Public (internet-facing) or Internal, type, DNS name (with a copy button), listeners and healthy targets out of registered targets
• Health — failed state, target groups without healthy targets, unhealthy targets, no registered targets, public HTTP listeners that do not redirect to HTTPS, and listeners whose TLS policy still accepts TLS 1.0/1.1
• Details — scheme, VPC, zones, security groups, deletion protection, access logs, invalid-header handling, idle timeout, cross-zone balancing, tags, each listener with its default action, TLS policy, certificates and rules (host, path, header… → forward, redirect or fixed response), and each target group with its health check and the unhealthy targets with their reason
• Cost — Elastic Load Balancing Describe* calls have no charge. A load reads the listeners of each load balancer and the health of each attached target group; the detail reads rules, attributes and tags of one
• Needs elasticloadbalancing:Describe* read permissions; a missing permission (for example for Classic load balancers) hides only that part and offers an access request

CloudFront

Manage CDN distributions:

• Domain name, status (Deployed / InProgress), enabled/disabled, price class, custom aliases, origins
• Invalidate — create a cache invalidation (/* or specific paths)
• Stats — view data transfer, request count and error-rate charts
• Visit Site — open the distribution URL (or primary alias) in a new tab
• Config — view full distribution configuration
• + Create from S3 — wizard to create a new distribution backed by an S3 bucket

Route 53

Two-panel DNS browser:

• Left panel — hosted zones with record count and public/private indicator
• Right panel — click a zone to load all records (every page, including routing-policy sets with their Set ID): name, type, TTL, value or alias target
• Search — filter by record name, value, alias target or Set ID
• Type filter — show only one record type (A, TXT, MX, CNAME...)
• Select & export — tick records (the selection survives search/filter changes) and click Export to download a CSV. With nothing selected, Export downloads the records currently visible

DNS diagnostics

The DNS test column checks whether a record is actually published on the internet. Tests run from the machine running KUA against its public resolver, so they show what the internet sees, not only what is stored in Route 53. They do not use AWS credentials.

Only tests that make sense for the record type are offered:

Record	Test	What it checks
A / AAAA	Resolve + TCP	The name resolves, then opens a TCP connection to the first address on port 443 and then 80 (2 s timeout each). No ping or system binaries are used
MX	Resolve	Mail exchangers, sorted by priority
CNAME	Resolve	The alias target
NS	Resolve	Name servers for the name
TXT	Resolve	All TXT strings (chunked values are joined)
TXT with v=spf1	SPF	Exactly one SPF record exists and it ends in an all mechanism or redirect=
TXT at <selector>._domainkey.<domain>	DKIM	A DKIM record with a public key (p=) is published for that selector

Results use three states:

• OK — the record resolves and passes the check.
• WARNING — it resolves but something needs attention: A/AAAA not reachable on TCP 443/80, SPF with +all or without all, DKIM key revoked (empty p=), TXT name with no strings.
• ERROR — it does not resolve (the resolver code, e.g. ENOTFOUND or ENODATA, is shown), SPF is missing or duplicated, or no DKIM key is found.

Hover over a result to see the resolved values; click it to run the test again. Wildcard records (*.example.com) and types such as SOA, SRV or CAA show no test: test a concrete subdomain instead.

TIP

A record that is OK in Route 53 but ERROR here usually means the domain's registrar is not delegating to the hosted zone's name servers, or the zone is private.

---

Database & Analytics

DocumentDB

Manage Amazon DocumentDB clusters (MongoDB-compatible):

• Cluster ID, master username, status, engine version, endpoint, port, multi-AZ and storage encryption indicators
• Connect — view connection string and TLS options
• Config — view full cluster configuration
• Reset Pwd — trigger a master-user password reset
• + New Cluster — launch the cluster creation wizard

Glue

Monitor and trigger ETL jobs:

• Job name, type (glueetl / pythonshell / ray), Glue version, worker type, worker count, last modified
• Run — trigger an on-demand job execution
• Runs — view recent execution history with status and duration
• Info — detailed job info: type, worker config, script location, IAM role, connections, default arguments, tags

Athena

Full data pipeline browser and query IDE organised in three sub-tabs:

Workgroups

• Workgroup name, state (ENABLED / DISABLED), engine version, S3 output location, bytes scanned, queries run, description
• Config — full workgroup configuration (engine, encryption, output, stats, IAM role, policies)
• Query — jump directly to the inline query editor pre-loaded with the workgroup

Data Sources

• Expandable catalog → database tree with type, description, parameters and database count
• Info — catalog detail panel
• Editor — open the query editor scoped to that catalog
• Tables — inline table list for any database

Query Editor

• Split-pane layout: sidebar data tree (catalogs → databases → tables) + SQL editor
• Run queries and view results in a paginated grid
• Export results to CSV
• Query history panel with the 20 most recent executions

Data Pipeline

Manage scheduled data pipelines:

• Pipeline name, ID, state (SCHEDULED / PAUSED / INACTIVE), last run time, next scheduled run
• Activate — resume a paused or inactive pipeline
• Pause — suspend a running scheduled pipeline

---

Security & Identity

Cognito

Full user pool management across four tabs:

Users

• Search/filter by email or username; paginated for large pools
• Username, email, status (CONFIRMED / FORCE_CHANGE_PASSWORD), MFA, enabled state, creation date
• Detail — view all user attributes
• Reset pwd — send a password reset email
• Enable / Disable — toggle account access
• + Create User — create a new pool user

App Clients

• Client name, ID, explicit auth flows, OAuth flows, callback URLs, token validity, has-secret

Identity Providers

• Federated IdPs: name, type (SAML / OIDC / Google / Facebook), issuer/metadata URL, attribute mapping

Groups

• All groups in the pool: group name, description, precedence, IAM role ARN, last modified date

Pool Config

• Password policy (length, character requirements, temporary pwd validity)
• Auto-verified attributes, creation/modification dates
• Schema attributes grid (data type, required, mutable)
• Lambda triggers (pre-sign-up, post-confirmation, pre-token generation, etc.)

Secrets Manager

Browse AWS Secrets Manager secrets:

• Secret name with full path hierarchy, description, rotation enabled, last changed date, ARN
• Reveal — fetch and display the secret value (masked by default for security)
• Config — view rotation schedule, resource policy and replica regions

---

Observability

EventBridge

Manage event-driven rules across all event buses:

• Rule name, description, bus, state (ENABLED / DISABLED), schedule expression or event pattern type
• Details — inspect rule targets (Lambda ARN, SQS URL, etc.) and full event pattern JSON
• Logs — stream logs from the rule's associated CloudWatch log group
• Tags — view rule tags
• Config — view full rule configuration

Step Functions

Two sortable columns show the 24h executions started (with failed or timed-out ones in red) from CloudWatch, which also covers Express machines, and the Logging level (ALL, ERROR, FATAL or Off, flagged because failed executions then leave no logs), with the log group in the tooltip.

Visualise and inspect state machines:

• State machine name, type (STANDARD / EXPRESS), creation date, ARN
• Diagram — render the ASL workflow diagram visually inline using the state machine definition
• Tags — view tags
• Config — view the full ASL definition JSON

---

Messaging

The Integration menu has three tabs for AWS messaging services. Each detail loads hourly charts of the last 24h, and every tab says what its reads cost.

SQS

Queues (standard and FIFO) with messages visible and in flight, messages sent/received/deleted in the last 24h, dead-letter queue and redrive (maxReceiveCount), encryption (SSE-SQS or KMS) and retention. Dead-letter queues are marked DLQ, and their visible messages are highlighted as failures. Details shows the URL, ARN, delayed messages, visibility timeout, which queues send their failures here, and charts of sent/received/deleted, visible messages and the oldest message's age.

SQS writes no logs of its own: API calls reach CloudTrail only as data events. CloudWatch metrics are the signal, and a queue idle for about 6 hours stops publishing them, which the detail explains.

Cost: SQS bills every API call as a request, including ListQueues and GetQueueAttributes. Listing N queues costs N+1 requests (the first 1M per month are free, then USD 0.40 per million). This is why Options → Cache & refresh → AWS → Table auto-refresh limits background reloads (30 s by default). The 24h activity uses CloudWatch GetMetricData (3 metrics per queue, USD 0.01 per 1,000), and opening a detail reads 5 more.

SNS

Topics with confirmed and pending subscriptions, protocols, messages published/delivered/failed in the last 24h, and the state of delivery status logging: Off (no protocol has feedback roles), Active, Empty or No log group (checked against the sns/<region>/<account>/<topic>[/Failure] log groups). Details lists every subscription with its endpoint and confirmation state, the logging per protocol with its success sample rate, and charts of published/delivered/failed.

Cost: SNS list calls have no relevant charge. Activity uses GetMetricData (3 metrics per topic), and log groups are listed only when some topic has logging on.

SES

Uses the SES v2 API in the profile's region:

• Account: whether sending is enabled, sandbox or production access, enforcement status, sent vs. 24h quota (turns yellow above 80%), and maximum send rate.
• 24h metrics: sent, delivered, bounces, complaints and rejects, with the latest bounce and complaint rates. Hourly charts are one click away.
• Identities: domains and email addresses with verification, DKIM, SPF (custom MAIL FROM domain, or amazonses.com when there is none), and default configuration set. Details shows where each identity's events go.
• Configuration sets: each set's event destinations (CloudWatch, Firehose, SNS, EventBridge, Pinpoint), enabled or not.

When no configuration set has an enabled destination, a notice explains that bounces, complaints and deliveries are not logged anywhere.

Cost: account, identity and configuration set reads are free. The account metrics use GetMetricData (7 metrics per load).

In all three tabs, activity follows Options → Activity cache (15 minutes by default); the refresh button reads it again. Missing permissions show a notice with Request access, and the suggested policy lists the actions of the whole screen (for example sqs:ListQueues and sqs:GetQueueAttributes). SQS, SNS and SES are counted in the Overview and no longer appear under services outside KUA.

Health

Each queue, topic and the SES account get a health status (OK, Warning, Critical) with the reasons behind it. Hover a badge to read them, or open Details to see the full list:

• SQS: a dead-letter queue holding messages, the oldest message close to the retention period (messages about to be lost) or older than an hour, messages sent but never deleted (nobody consuming), and no dead-letter queue.
• SNS: failed deliveries (critical above 5%), subscriptions waiting for confirmation, no subscriptions, and failures while delivery status logging is off.
• SES: sending paused, an enforcement status other than HEALTHY, over 90% of the 24h quota used, and bounce and complaint rates checked against the AWS review thresholds (bounces 5% / 10%, complaints 0.1% / 0.5%).

Details and logs

• SQS: receive wait, flagging short polling because each empty receive is a billed request. Also maximum message size, delivery delay, FIFO deduplication, and which queues may use it as a dead-letter queue. The detail lists the Lambda functions that consume it (state, batch size, last result), the SNS topics that deliver to it, a summary of its access policy (principals open to * without conditions are highlighted), and its tags. Charts add empty receives and messages in flight. A detail costs 2 billed SQS requests.
• SNS: every subscription with its filter policy (attributes or body), raw delivery and dead-letter queue. Without one, undeliverable messages are lost. The detail also shows the HTTP retry policy, the access policy, and a delivery status log viewer: the latest events from the sns/<region>/<account>/<topic> groups and their /Failure counterparts, with status, provider response, attempts and dwell time, filterable to failures only. Logs load only when you click, with FilterLogEvents, which has no per-GB charge. The table adds the delivery success rate and filtered messages, and charts add sent to DLQ, failed to reach DLQ and average publish size.
• SES: the suppression list (addresses SES will not send to, whether by bounce or complaint, and whether automatic suppression is on), rendering failures, the delivery rate, bounce and complaint rate charts, and metrics by configuration set. For a set with a CloudWatch destination, KUA first counts the event/dimension metrics that exist (ListMetrics) and shows the estimated cost. It reads them (sent, delivered, bounces, opens, clicks and so on per dimension value) only when you click.

Metric history

Hourly metrics already read are kept in the local database (the APM database, table kua_metric_points). Because GetMetricData bills per metric requested, whatever the time range, history saves money by not requesting what was read recently:

• The table activity is saved per hour, so opening a detail only requests the metrics the table did not read. For example, an SQS detail requests 4 metrics instead of 7.
• Opening the same detail again within the activity cache time requests nothing.
• The 24h / 7d / 30d selector reads longer ranges from history once they are stored. Every chart says how many metrics were requested from CloudWatch and how many came from history.
• Retention is set in Options → Cache & refresh → AWS → Metric history (30 days by default). Local storage shows the space it uses.

Ready for KUA Applications

The three services use the same resource identities as the architecture inventory and the KUA registry, such as AWS::SQS::Queue:orders and AWS::SNS::Topic:alerts. A shared catalog (lib/awsMessagingCatalog.js) defines each service's metrics, the table and detail metrics, and the health rules. GET /api/cloud/aws/metrics/history?identity=…&metrics=…&hours=… returns stored history without calling AWS. A KUA Application that includes a queue or topic can therefore show its history and health without new reads. Automatic collection for applications is not enabled, because it would add recurring charges.

Common Features

All 19 AWS service tabs share these global features:

Feature	Description
Live search	Filter rows by typing in the search bar at the top — results update instantly
Sortable columns	Click any column header to toggle ascending / descending sort
Region switcher	Change the active AWS region from the header dropdown; data reloads automatically
Refresh	Click ↺ to reload the current tab from AWS APIs
Result counter	Shows loading status and final record count in the toolbar
Tag chips	Tags are displayed as inline chips on each row for quick reference