Difference between creating CloudWatch alarm for "EC2 Instance Changes" & "EC2 Large Instance Changes"?

Question

• Why we are create a separate alarm for "EC2 Instance Changes" & "EC2 Large Instance Changes" ?
• Mainly why we are create a separate alarm for large instances changes..?
• or EC2-instances changes contains also that Large instances changes ??

Answer 1

This question doesn't make sense on its own, without context.

You appear to be reading Amazon Cloudtrail documentation. Both of these are examples of the kinds of alarms you can define from Cloudtrail data.

These aren't alarms you necessarily need, it is only an illustration of some possible capabilities.

http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html

Review the explanations and logical expressions shown in the documentation, and the difference should be obvious.

They both capture launching, rebooting, starting, stopping, and terminating of instances, but the "Large" rule only matches instances of a couple of large classes.

EC2 Instance Changes:

This scenario walks you through how to use the AWS Management Console to create an Amazon CloudWatch alarm that is triggered when an API call is made to create, terminate, start, stop or reboot an Amazon EC2 instance.

{ 
     ($.eventName = RunInstances) 
  || ($.eventName = RebootInstances) 
  || ($.eventName = StartInstances) 
  || ($.eventName = StopInstances) 
  || ($.eventName = TerminateInstances) 
}

EC2 Large Instance Changes:

This scenario walks you through how to use the AWS Management Console to create an Amazon CloudWatch alarm that is triggered when an API call is made to create, terminate, start, stop or reboot a 4x or 8x-large EC2 instance.

{ (
       ($.eventName = RunInstances) 
    || ($.eventName = RebootInstances) 
    || ($.eventName = StartInstances)
    || ($.eventName = StopInstances)
    || ($.eventName = TerminateInstances)
) && (
       ($.requestParameters.instanceType = *.8xlarge) 
    || ($.requestParameters.instanceType = *.4xlarge)
) }