Metrics summarize measurements over time. Logs retain event detail. An alarm evaluates a metric using a namespace, dimensions, statistic, period, threshold, and evaluation rule. Those settings determine what the alarm means, so an alarm with the right name can still watch the wrong signal.
A missing datapoint isn't automatically a healthy datapoint. Choose missing-data treatment based on how the workload emits metrics, and distinguish an inactive service from an interrupted telemetry path. Logs also need suitable access and retention; don't place secrets in a message just because it helps debugging. In this unit, create useful monitoring resources, then connect each signal to a question about service behavior. An empty log group proves only that the group exists.