A newly created CloudWatch alarm remains in the INSUFFICIENT_DATA state. The alarm monitors the mem_used_percent metric from an EC2 instance in a public subnet. The unified CloudWatch agent is installed and running on the instance, but the metric is not visible in CloudWatch. What should a SysOps admin do to correct this?

The CloudWatch alarm is in INSUFFICIENTDATA because the memusedpercent metric is not being published to CloudWatch. The Unified CloudWatch Agent needs appropriate permissions to publish custom metrics. Attaching an IAM instance profile with policies like CloudWatchAgentServerPolicy to the EC2 instance grants these necessary permissions. Enabling detailed monitoring is for standard EC2 metrics (CPU, network, disk I/O), not custom metrics like memusedpercent collected by the agent. Moving the instance to a private subnet is irrelevant to metric publishing permissions. While using an IAM user's access and secret keys can provide credentials, an instance profile is the recommended and more secure method for granting permissions to applications running on EC2 instances, as it avoids hardcoding credentials.