Enabling EC2 Memory Metrics for Accurate Rightsizing

Give the instance permission to publish metrics

The agent needs its own permission to write the metrics. Attach the AWS-managed policy CloudWatchAgentServerPolicy to the IAM role of the instance, which is the instance profile. If you store the agent configuration in the SSM Parameter Store, also add AmazonSSMManagedInstanceCore.

Install the CloudWatch agent

Option A is SSM. Use it for a fleet of instances. The AWS-ConfigureAWSPackage document installs AmazonCloudWatchAgent on many instances, and you do not open a shell.

Option B is the installation by hand, on a single instance with Amazon Linux 2 or Amazon Linux 2023:

sudo yum install -y amazon-cloudwatch-agent

On Ubuntu and Debian, download the .deb package for your architecture from the AWS package location. Then install it with dpkg -i. Windows uses the MSI package.

Configure the agent to emit memory

Create an agent configuration that collects mem_used_percent. The configuration must append the InstanceId dimension under the CWAgent namespace. DigiUsher and AWS Compute Optimizer use this dimension to match the memory data to the instance. If the dimension is absent or has another name, the memory data has no link to the instance.

{
  "metrics": {
    "namespace": "CWAgent",
    "append_dimensions": {
      "InstanceId": "${aws:InstanceId}"
    },
    "metrics_collected": {
      "mem": {
        "measurement": ["mem_used_percent"],
        "metrics_collection_interval": 60
      },
      "disk": {
        "measurement": ["used_percent"],
        "resources": ["*"],
        "metrics_collection_interval": 60
      }
    }
  }
}

Start the agent and make sure that it runs

sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config -m ec2 -s \
  -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json

# Confirm status is "running"
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status

A correct result gives "status": "running".

Make sure that the metric is in CloudWatch

Make sure that the data point exists. In the CloudWatch console, open Metrics → All metrics → CWAgent → InstanceId and look for mem_used_percent for your instance.

You can also use the CLI. Replace the region and the instance ID:

# Does the metric exist for this instance?
aws cloudwatch list-metrics \
  --namespace CWAgent \
  --metric-name mem_used_percent \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --region us-east-1

# Are data points landing?
aws cloudwatch get-metric-statistics \
  --namespace CWAgent \
  --metric-name mem_used_percent \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --start-time 2026-07-13T00:00:00Z \
  --end-time 2026-07-14T00:00:00Z \
  --period 3600 --statistics Average Maximum \
  --region us-east-1 --output table

If list-metrics returns nothing, look at the namespace and the InstanceId dimension again. Also make sure that the agent runs. Steps 3 and 4 cover these points.

Make sure that the DigiUsher IAM role can read the metric

DigiUsher reads the metrics with a read-only role. This role has cloudwatch:Get* and cloudwatch:List*, which cover ListMetrics, GetMetricData, and GetMetricStatistics. The memory metrics are in the same CWAgent namespace that DigiUsher already reads for the other CloudWatch data. Usually you therefore need no new permission. Make sure that the access exists.

1. Make sure that the DigiUsher role is attached to the account that owns the instance. Read the Permissions Reference.
2. Make sure that the read-only policy on that role has cloudwatch:ListMetrics, cloudwatch:GetMetricData, and cloudwatch:GetMetricStatistics, or the wildcards cloudwatch:Get* and cloudwatch:List*.
3. Make sure that the role itself can read the metric. Assume the DigiUsher read role and run the list-metrics call from step 5 again. If the call returns mem_used_percent, DigiUsher can read it.

aws sts assume-role \
  --role-arn arn:aws:iam::<ACCOUNT_ID>:role/<DigiUsher-ReadOnly-Role> \
  --role-session-name du-mem-check
# then, with the returned temporary credentials, re-run the Step 5 list-metrics call

If the console shows the metric in step 5 but the DigiUsher role does not, the cause is IAM. Correct the policy. DigiUsher shows the memory data only after that correction.

Make sure that the memory data appears in DigiUsher

After the role can read the metric, DigiUsher collects the memory data in the next collection cycle. The rightsizing recommendations then use the memory data, and not only the CPU, network, and disk data. Before you trust the memory-based sizing, wait for 15 days of history. For an instance that is memory-bound, the recommendations become more conservative.