diff --git a/ecs/README.md b/ecs/README.md
index 0d48c3e4..b4afe1d2 100644
--- a/ecs/README.md
+++ b/ecs/README.md
@@ -129,6 +129,14 @@ Based on [AWS reference architecture](https://github.com/aws-samples/ecs-refarch
 
     The ID of the Internet Gateway
 
+* `lb_metrics`
+
+    Load balancer related Cloudwatch metrics, see [network/metrics.tf](./network/metrics.tf)
+
+* `lb_widgets`
+
+    Load balancer related Cloudwatch dashboard widgets, see [network/widgets.tf](./network/widgets.tf)
+
 * `load_balancer_arn`
 
     The ARN of the Application Load Balancer
@@ -157,6 +165,22 @@ Based on [AWS reference architecture](https://github.com/aws-samples/ecs-refarch
 
     Cluster name
 
+* `nat_gateway_metrics`
+
+    NAT gateway related Cloudwatch metrics, see [network/metrics.tf](./network/metrics.tf)
+
+* `nat_gateway_widgets`
+
+    NAT gateway related Cloudwatch dashboard widgets, see [network/widgets.tf](./network/widgets.tf)
+
+* `nat_instance_metrics`
+
+    NAT instance related Cloudwatch metrics, see [network/metrics.tf](./network/metrics.tf)
+
+* `nat_instance_widgets`
+
+    NAT instance related Cloudwatch dashboard widgets, see [network/widgets.tf](./network/widgets.tf)
+
 * `private_blocks`
 
     The CIDR blocks of private subnets
diff --git a/ecs/example/main.tf b/ecs/example/main.tf
index c2ec7c81..18f300be 100644
--- a/ecs/example/main.tf
+++ b/ecs/example/main.tf
@@ -103,6 +103,22 @@ module "dashboard" {
 
   name = "terraform-ecs-example"
   widgets = [
+    module.cluster.lb_widgets.responses,
+    module.cluster.lb_widgets.response_percentages,
+    module.cluster.lb_widgets.target_response_time,
+    module.cluster.lb_widgets.connections,
+    module.cluster.lb_widgets.lcus,
+    module.cluster.lb_widgets.traffic,
+    module.cluster.nat_instance_widgets.cpu_utilization,
+    module.cluster.nat_instance_widgets.cpu_credit_balance,
+    module.cluster.nat_instance_widgets.cpu_credit_usage,
+    module.cluster.nat_instance_widgets.network_bytes,
+    module.cluster.nat_instance_widgets.network_packets,
+    module.cluster.nat_gateway_widgets.network_bytes,
+    module.cluster.nat_gateway_widgets.network_packets,
+    module.cluster.nat_gateway_widgets.active_connections,
+    module.cluster.nat_gateway_widgets.connection_attempts,
+
     module.hosts.widgets.instance_scaling,
     module.hosts.widgets.instance_states,
     module.hosts.widgets.memory_utilization,
diff --git a/ecs/network/README.md b/ecs/network/README.md
index eda763a7..06845535 100644
--- a/ecs/network/README.md
+++ b/ecs/network/README.md
@@ -84,6 +84,14 @@ Creates networking resources needed for a standard ECS cluster setup:
 
     The ID of the Internet Gateway
 
+* `lb_metrics`
+
+    Load balancer related Cloudwatch metrics, see [metrics.tf](./metrics.tf)
+
+* `lb_widgets`
+
+    Load balancer related Cloudwatch dashboard widgets, see [widgets.tf](./widgets.tf)
+
 * `load_balancer_arn`
 
     The ARN of the Application Load Balancer
@@ -108,6 +116,22 @@ Creates networking resources needed for a standard ECS cluster setup:
 
     The canonical hosted zone ID of the Application Load Balancer (to be used in a Route 53 Alias record)
 
+* `nat_gateway_metrics`
+
+    NAT gateway Cloudwatch metrics, see [metrics.tf](./metrics.tf)
+
+* `nat_gateway_widgets`
+
+    NAT gateway Cloudwatch dashboard widgets, see [widgets.tf](./widgets.tf)
+
+* `nat_instance_metrics`
+
+    NAT instance Cloudwatch metrics, see [metrics.tf](./metrics.tf)
+
+* `nat_instance_widgets`
+
+    NAT instance Cloudwatch dashboard widgets, see [widgets.tf](./widgets.tf)
+
 * `private_blocks`
 
     The CIDR blocks of private subnets
diff --git a/ecs/network/metrics.tf b/ecs/network/metrics.tf
new file mode 100644
index 00000000..cc5467b7
--- /dev/null
+++ b/ecs/network/metrics.tf
@@ -0,0 +1,492 @@
+locals {
+  lb_metrics = {
+    # ALB request counts
+    requests                            = module.metric_requests
+    lb_responses                        = module.metric_lb_responses
+    lb_fixed_responses                  = module.metrics_response_count.out_map.lb_fixed
+    lb_fixed_response_percentage        = module.metrics_response_percentage.out_map.lb_fixed
+    lb_redirects                        = module.metrics_response_count.out_map.lb_redirect
+    lb_redirect_percentage              = module.metrics_response_percentage.out_map.lb_redirect
+    lb_4xx_responses                    = module.metrics_response_count.out_map.lb_4xx
+    lb_4xx_response_percentage          = module.metrics_response_percentage.out_map.lb_4xx
+    lb_5xx_responses                    = module.metrics_response_count.out_map.lb_5xx
+    lb_5xx_response_percentage          = module.metrics_response_percentage.out_map.lb_5xx
+    lb_tls_negotiation_errors           = module.metrics_response_count.out_map.lb_tls_negotiation_error
+    lb_tls_negotiation_error_percentage = module.metrics_response_percentage.out_map.lb_tls_negotiation_error
+    target_requests                     = module.metrics_response_count.out_map.target
+    target_2xx_responses                = module.metrics_response_count.out_map.target_2xx
+    target_2xx_response_percentage      = module.metrics_response_percentage.out_map.target_2xx
+    target_3xx_responses                = module.metrics_response_count.out_map.target_3xx
+    target_3xx_response_percentage      = module.metrics_response_percentage.out_map.target_3xx
+    target_4xx_responses                = module.metrics_response_count.out_map.target_4xx
+    target_4xx_response_percentage      = module.metrics_response_percentage.out_map.target_4xx
+    target_5xx_responses                = module.metrics_response_count.out_map.target_5xx
+    target_5xx_response_percentage      = module.metrics_response_percentage.out_map.target_5xx
+    target_connection_errors            = module.metrics_response_count.out_map.target_connection_error
+    target_connection_error_percentage  = module.metrics_response_percentage.out_map.target_connection_error
+
+    # ALB response times
+    target_average_response_time = module.metrics_target_response_time.out_map.average
+    target_p50_response_time     = module.metrics_target_response_time.out_map.p50
+    target_p90_response_time     = module.metrics_target_response_time.out_map.p90
+    target_p95_response_time     = module.metrics_target_response_time.out_map.p95
+    target_p99_response_time     = module.metrics_target_response_time.out_map.p99
+    target_max_response_time     = module.metrics_target_response_time.out_map.max
+
+    # ALB other
+    consumed_lcus      = module.metric_consumed_lcus
+    active_connections = module.metric_lb_active_connections
+    new_connections    = module.metric_lb_new_connections
+    traffic            = module.metric_lb_traffic
+  }
+
+  nat_instance_metrics = {
+    min_cpu_utilization     = module.metric_nat_instance_min_cpu_utilization
+    average_cpu_utilization = module.metric_nat_instance_average_cpu_utilization
+    max_cpu_utilization     = module.metric_nat_instance_max_cpu_utilization
+
+    cpu_credit_usage            = module.metric_nat_instance_cpu_credit_usage
+    cpu_credit_balance          = module.metrics_nat_instance_cpu_credit_balance.out_map.balance
+    cpu_surplus_credit_balance  = module.metrics_nat_instance_cpu_credit_balance.out_map.surplus
+    cpu_surplus_credits_charged = module.metrics_nat_instance_cpu_credit_balance.out_map.surplus_charged
+
+    bytes_received   = module.metrics_nat_instance_io.out_map.bytes_received
+    packets_received = module.metrics_nat_instance_io.out_map.packets_received
+    bytes_sent       = module.metrics_nat_instance_io.out_map.bytes_sent
+    packets_sent     = module.metrics_nat_instance_io.out_map.packets_sent
+  }
+
+  nat_gateway_metrics = {
+    bytes_received_in  = module.metrics_nat_gateway_bytes.out_map.received_in
+    bytes_received_out = module.metrics_nat_gateway_bytes.out_map.received_out
+    bytes_sent_in      = module.metrics_nat_gateway_bytes.out_map.sent_in
+    bytes_sent_out     = module.metrics_nat_gateway_bytes.out_map.sent_out
+
+    packets_dropped      = module.metrics_nat_gateway_packets_dropped
+    packets_received_in  = module.metrics_nat_gateway_packets.out_map.received_in
+    packets_received_out = module.metrics_nat_gateway_packets.out_map.received_out
+    packets_sent_in      = module.metrics_nat_gateway_packets.out_map.sent_in
+    packets_sent_out     = module.metrics_nat_gateway_packets.out_map.sent_out
+
+    active_connections      = module.metrics_nat_gateway_connections.out_map.active
+    connection_attempts     = module.metrics_nat_gateway_connections.out_map.attempt
+    established_connections = module.metrics_nat_gateway_connections.out_map.established
+    port_allocation_errors  = module.metrics_nat_gateway_connections.out_map.port_allocation_error
+  }
+}
+
+module "cloudwatch_consts" {
+  source = "./../../cloudwatch/consts"
+}
+
+locals {
+  colors       = module.cloudwatch_consts.colors
+  lb_namespace = "AWS/ApplicationELB"
+  lb_dimensions = {
+    LoadBalancer = var.create ? aws_lb.lb[0].arn_suffix : ""
+  }
+}
+
+locals {
+  metrics_response_count = {
+    lb_fixed = {
+      name  = "HTTP_Fixed_Response_Count"
+      label = "ALB fixed responses"
+      color = local.colors.light_green
+    }
+    lb_redirect = {
+      name  = "HTTP_Redirect_Count"
+      label = "ALB redirects"
+      color = local.colors.light_blue
+    }
+    lb_4xx = {
+      name  = "HTTPCode_ELB_4XX_Count"
+      label = "ALB 4xx responses"
+      color = local.colors.light_orange
+    }
+    lb_5xx = {
+      name  = "HTTPCode_ELB_5XX_Count"
+      label = "ALB 5xx responses"
+      color = local.colors.light_red
+    }
+    lb_tls_negotiation_error = {
+      name  = "ClientTLSNegotiationErrorCount"
+      label = "ALB TLS negotiation errors"
+      color = local.colors.light_purple
+    }
+    target = {
+      name  = "RequestCount"
+      label = "Target requests"
+      color = null
+    }
+    target_2xx = {
+      name  = "HTTPCode_Target_2XX_Count"
+      label = "Target 2xx responses"
+      color = local.colors.green
+    }
+    target_3xx = {
+      name  = "HTTPCode_Target_3XX_Count"
+      label = "Target 3xx responses"
+      color = local.colors.blue
+    }
+    target_4xx = {
+      name  = "HTTPCode_Target_4XX_Count"
+      label = "Target 4xx responses"
+      color = local.colors.orange
+    }
+    target_5xx = {
+      name  = "HTTPCode_Target_5XX_Count"
+      label = "Target 5xx responses"
+      color = local.colors.red
+    }
+    target_connection_error = {
+      name  = "TargetConnectionErrorCount"
+      label = "Target connection errors"
+      color = local.colors.purple
+    }
+  }
+}
+
+module "metric_lb_responses" {
+  source = "./../../cloudwatch/metric_expression"
+  expression = join(" + ", [
+    module.metrics_response_count.out_map.lb_fixed.id,
+    module.metrics_response_count.out_map.lb_redirect.id,
+    module.metrics_response_count.out_map.lb_4xx.id,
+    module.metrics_response_count.out_map.lb_5xx.id,
+    module.metrics_response_count.out_map.lb_tls_negotiation_error.id,
+  ])
+  label = "ALB responses"
+}
+
+module "metric_requests" {
+  source = "./../../cloudwatch/metric_expression"
+  expression = join(" + ", [
+    module.metric_lb_responses.id,
+    module.metrics_response_count.out_map.target.id,
+  ])
+  label = "Requests"
+}
+
+module "metrics_response_count" {
+  source = "./../../cloudwatch/metric/many"
+
+  vars_map = { for k, variant in local.metrics_response_count : k => {
+    namespace  = local.lb_namespace
+    dimensions = local.lb_dimensions
+    name       = variant.name
+    label      = variant.label
+    color      = variant.color
+    stat       = "Sum"
+    period     = 60
+  } }
+}
+
+module "metrics_response_percentage" {
+  source = "./../../cloudwatch/metric_expression/many"
+
+  vars_map = { for k, variant in local.metrics_response_count : k => {
+    expression = "IF(${module.metric_requests.id} == 0, 0, FILL(${module.metrics_response_count.out_map[k].id}, 0) / ${module.metric_requests.id} * 100)"
+    label      = variant.label
+    color      = variant.color
+  } }
+}
+
+locals {
+  metrics_response_time_variants = {
+    average = { stat = "Average", color = local.colors.red }
+    p50     = { stat = "p50", color = local.colors.red }
+    p90     = { stat = "p90", color = local.colors.orange }
+    p95     = { stat = "p95", color = local.colors.orange }
+    p99     = { stat = "p99", color = local.colors.light_red }
+    max     = { stat = "Maximum", color = local.colors.light_orange }
+  }
+}
+
+module "metrics_target_response_time" {
+  source = "./../../cloudwatch/metric/many"
+
+  vars_map = { for k, variant in local.metrics_response_time_variants : k => {
+    namespace  = local.lb_namespace
+    dimensions = local.lb_dimensions
+    name       = "TargetResponseTime"
+    label      = "${variant.stat} target response time"
+    color      = variant.color
+    stat       = variant.stat
+    period     = 60
+  } }
+}
+
+module "metric_consumed_lcus" {
+  source = "./../../cloudwatch/metric"
+
+  namespace  = local.lb_namespace
+  dimensions = local.lb_dimensions
+  name       = "ConsumedLCUs"
+  label      = "Consumed LCUs"
+  stat       = "Sum"
+  period     = 60
+}
+
+module "metric_lb_active_connections" {
+  source = "./../../cloudwatch/metric"
+
+  namespace  = local.lb_namespace
+  dimensions = local.lb_dimensions
+  name       = "ActiveConnectionCount"
+  label      = "Active connections"
+  color      = local.colors.blue
+  stat       = "Sum"
+  period     = 60
+}
+
+module "metric_lb_new_connections" {
+  source = "./../../cloudwatch/metric"
+
+  namespace  = local.lb_namespace
+  dimensions = local.lb_dimensions
+  name       = "NewConnectionCount"
+  label      = "New connections"
+  color      = local.colors.green
+  stat       = "Sum"
+  period     = 60
+}
+
+module "metric_lb_traffic" {
+  source = "./../../cloudwatch/metric"
+
+  namespace  = local.lb_namespace
+  dimensions = local.lb_dimensions
+  name       = "ProcessedBytes"
+  label      = "Traffic"
+  stat       = "Sum"
+  period     = 60
+}
+
+locals {
+  search_nat_instance_dimensions = join(" OR ", [
+    for id in aws_instance.nat.*.id : "InstanceId=${jsonencode(id)}"
+  ])
+  search_nat_instance = "Namespace=\"AWS/EC2\" (${local.search_nat_instance_dimensions})"
+}
+
+module "metric_nat_instance_min_cpu_utilization" {
+  source = "./../../cloudwatch/metric_expression"
+
+  expression = "MIN(SEARCH('${local.search_nat_instance} MetricName=\"CPUUtilization\"', 'Minimum', 60))"
+  label      = "Minimum CPU utilization"
+  color      = local.colors.light_orange
+}
+
+module "metric_nat_instance_average_cpu_utilization" {
+  source = "./../../cloudwatch/metric_expression"
+
+  expression = <<EOF
+    SUM(SEARCH('${local.search_nat_instance} MetricName="CPUUtilization"', 'Sum', 60)) /
+    SUM(SEARCH('${local.search_nat_instance} MetricName="CPUUtilization"', 'SampleCount', 60))
+  EOF
+
+  label = "Average CPU utilization"
+  color = local.colors.orange
+}
+
+module "metric_nat_instance_max_cpu_utilization" {
+  source = "./../../cloudwatch/metric_expression"
+
+  expression = "MAX(SEARCH('${local.search_nat_instance} MetricName=\"CPUUtilization\"', 'Maximum', 60))"
+  label      = "Maximum CPU utilization"
+  color      = local.colors.red
+}
+
+locals {
+  metrics_cpu_credit_balance = {
+    balance = {
+      name  = "CPUCreditBalance"
+      label = "CPU credit balance"
+      color = local.colors.green
+    }
+    surplus = {
+      name  = "CPUSurplusCreditBalance"
+      label = "CPU surplus credit balance"
+      color = local.colors.orange
+    }
+    surplus_charged = {
+      name  = "CPUSurplusCreditsCharged"
+      label = "CPU surplus credits charged"
+      color = local.colors.red
+    }
+  }
+}
+
+module "metric_nat_instance_cpu_credit_usage" {
+  source = "./../../cloudwatch/metric_expression"
+
+  expression = "SUM(SEARCH('${local.search_nat_instance} MetricName=\"CPUCreditUsage\"', 'Sum', 300))"
+  label      = "CPU credit usage"
+}
+
+module "metrics_nat_instance_cpu_credit_balance" {
+  source = "./../../cloudwatch/metric_expression/many"
+
+  vars_map = { for k, variant in local.metrics_cpu_credit_balance : k => {
+    expression = <<EOF
+    SUM(SEARCH('${local.search_nat_instance} MetricName="${variant.name}"', 'Sum', 300)) /
+    SUM(SEARCH('${local.search_nat_instance} MetricName="${variant.name}"', 'SampleCount', 300))
+    EOF
+
+    label = variant.label
+    color = variant.color
+  } }
+}
+
+locals {
+  io_colors = {
+    read  = local.colors.green
+    write = local.colors.orange
+
+    light_read  = local.colors.light_green
+    light_write = local.colors.light_orange
+  }
+
+  metrics_nat_instance_io = {
+    bytes_received = {
+      name  = "NetworkIn"
+      label = "Received bytes"
+      color = local.io_colors.read
+    }
+    packets_received = {
+      name  = "NetworkPacketsIn"
+      label = "Received packets"
+      color = local.io_colors.read
+    }
+    bytes_sent = {
+      name  = "NetworkOut"
+      label = "Sent bytes"
+      color = local.io_colors.write
+    }
+    packets_sent = {
+      name  = "NetworkPacketsOut"
+      label = "Sent packets"
+      color = local.io_colors.write
+    }
+  }
+}
+
+module "metrics_nat_instance_io" {
+  source = "./../../cloudwatch/metric_expression/many"
+
+  vars_map = { for k, variant in local.metrics_nat_instance_io : k => {
+    expression = <<EOF
+    SUM(SEARCH('${local.search_nat_instance} MetricName="${variant.name}"', 'Sum', 300))
+    EOF
+    label      = variant.label
+    color      = variant.color
+  } }
+}
+
+locals {
+  nat_gateway_dimensions = {
+    NatGatewayId = var.create && ! var.nat_instance ? aws_nat_gateway.public[0].id : ""
+  }
+  metrics_nat_gateway_io = {
+    sent_in = {
+      name_suffix  = "OutToSource"
+      label_suffix = "sent to VPC"
+      color        = local.io_colors.light_read
+    }
+    sent_out = {
+      name_suffix  = "OutToDestination"
+      label_suffix = "sent to WAN"
+      color        = local.io_colors.write
+    }
+    received_in = {
+      name_suffix  = "InFromSource"
+      label_suffix = "received from VPC"
+      color        = local.io_colors.light_write
+    }
+    received_out = {
+      name_suffix  = "InFromDestination"
+      label_suffix = "received from WAN"
+      color        = local.io_colors.read
+    }
+  }
+}
+
+module "metrics_nat_gateway_bytes" {
+  source = "./../../cloudwatch/metric/many"
+
+  vars_map = { for k, v in local.metrics_nat_gateway_io : k => {
+    namespace  = "AWS/NATGateway"
+    dimensions = local.nat_gateway_dimensions
+    name       = "Bytes${v.name_suffix}"
+    label      = "Bytes ${v.label_suffix}"
+    color      = v.color
+    stat       = "Sum"
+    period     = 60
+  } }
+}
+
+module "metrics_nat_gateway_packets" {
+  source = "./../../cloudwatch/metric/many"
+
+  vars_map = { for k, v in local.metrics_nat_gateway_io : k => {
+    namespace  = "AWS/NATGateway"
+    dimensions = local.nat_gateway_dimensions
+    name       = "Packets${v.name_suffix}"
+    label      = "Packets ${v.label_suffix}"
+    color      = v.color
+    stat       = "Sum"
+    period     = 60
+  } }
+}
+
+module "metrics_nat_gateway_packets_dropped" {
+  source = "./../../cloudwatch/metric"
+
+  namespace  = "AWS/NATGateway"
+  dimensions = local.nat_gateway_dimensions
+  name       = "PacketsDropCount"
+  label      = "Packets dropped"
+  color      = local.colors.red
+  stat       = "Sum"
+  period     = 60
+}
+
+locals {
+  metrics_nat_gateway_connections = {
+    active = {
+      name  = "ActiveConnectionCount"
+      label = "Active connections"
+      color = null
+    }
+    attempt = {
+      name  = "ConnectionAttemptCount"
+      label = "Connection attempts"
+      color = local.colors.blue
+    }
+    established = {
+      name  = "ConnectionEstablishedCount"
+      label = "Connections established"
+      color = local.colors.green
+    }
+    port_allocation_error = {
+      name  = "ErrorPortAllocation"
+      label = "Port allocation errors"
+      color = local.colors.red
+    }
+  }
+}
+
+module "metrics_nat_gateway_connections" {
+  source = "./../../cloudwatch/metric/many"
+
+  vars_map = { for k, v in local.metrics_nat_gateway_connections : k => {
+    namespace  = "AWS/NATGateway"
+    dimensions = local.nat_gateway_dimensions
+    name       = v.name
+    label      = v.label
+    color      = v.color
+    stat       = "Sum"
+    period     = 60
+  } }
+}
diff --git a/ecs/network/outputs.tf b/ecs/network/outputs.tf
index a768beb5..15f07ce4 100644
--- a/ecs/network/outputs.tf
+++ b/ecs/network/outputs.tf
@@ -92,3 +92,33 @@ output "hosts_security_group_arn" {
   value       = var.create ? aws_security_group.hosts[0].arn : null
   description = "The ARN of the Security Group which should be used by host instances"
 }
+
+output "lb_metrics" {
+  description = "Load balancer related Cloudwatch metrics, see [metrics.tf](./metrics.tf)"
+  value       = local.lb_metrics
+}
+
+output "lb_widgets" {
+  description = "Load balancer related Cloudwatch dashboard widgets, see [widgets.tf](./widgets.tf)"
+  value       = local.lb_widgets
+}
+
+output "nat_instance_metrics" {
+  description = "NAT instance Cloudwatch metrics, see [metrics.tf](./metrics.tf)"
+  value       = local.nat_instance_metrics
+}
+
+output "nat_instance_widgets" {
+  description = "NAT instance Cloudwatch dashboard widgets, see [widgets.tf](./widgets.tf)"
+  value       = local.nat_instance_widgets
+}
+
+output "nat_gateway_metrics" {
+  description = "NAT gateway Cloudwatch metrics, see [metrics.tf](./metrics.tf)"
+  value       = local.nat_gateway_metrics
+}
+
+output "nat_gateway_widgets" {
+  description = "NAT gateway Cloudwatch dashboard widgets, see [widgets.tf](./widgets.tf)"
+  value       = local.nat_gateway_widgets
+}
diff --git a/ecs/network/widgets.tf b/ecs/network/widgets.tf
new file mode 100644
index 00000000..2a9fcc4b
--- /dev/null
+++ b/ecs/network/widgets.tf
@@ -0,0 +1,229 @@
+locals {
+  lb_widgets = {
+    responses            = module.widget_responses
+    response_percentages = module.widget_response_percentages
+    target_response_time = module.widget_target_response_time
+    connections          = module.widget_lb_connections
+    lcus                 = module.widget_lb_lcus
+    traffic              = module.widget_lb_traffic
+  }
+
+  nat_instance_widgets = {
+    cpu_utilization    = module.widget_nat_instance_cpu_utilization
+    cpu_credit_balance = module.widget_nat_instance_cpu_credit_balance
+    cpu_credit_usage   = module.widget_nat_instance_cpu_credit_usage
+    network_bytes      = module.widget_nat_instance_network_bytes
+    network_packets    = module.widget_nat_instance_network_packets
+  }
+
+  nat_gateway_widgets = {
+    network_bytes       = module.widget_nat_gateway_network_bytes
+    network_packets     = module.widget_nat_gateway_network_packets
+    active_connections  = module.widget_nat_gateway_active_connections
+    connection_attempts = module.widget_nat_gateway_connection_attempts
+  }
+}
+
+module "widget_responses" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "ALB and target responses"
+  stacked = true
+  left_metrics = [
+    local.lb_metrics.lb_tls_negotiation_errors,
+    local.lb_metrics.lb_5xx_responses,
+    local.lb_metrics.lb_4xx_responses,
+    local.lb_metrics.lb_redirects,
+    local.lb_metrics.lb_fixed_responses,
+    local.lb_metrics.target_connection_errors,
+    local.lb_metrics.target_5xx_responses,
+    local.lb_metrics.target_4xx_responses,
+    local.lb_metrics.target_3xx_responses,
+    local.lb_metrics.target_2xx_responses,
+  ]
+}
+
+module "widget_response_percentages" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "ALB and target response percentages"
+  stacked = true
+  left_metrics = [
+    local.lb_metrics.lb_tls_negotiation_error_percentage,
+    local.lb_metrics.lb_5xx_response_percentage,
+    local.lb_metrics.lb_4xx_response_percentage,
+    local.lb_metrics.lb_redirect_percentage,
+    local.lb_metrics.lb_fixed_response_percentage,
+    local.lb_metrics.target_connection_error_percentage,
+    local.lb_metrics.target_5xx_response_percentage,
+    local.lb_metrics.target_4xx_response_percentage,
+    local.lb_metrics.target_3xx_response_percentage,
+    local.lb_metrics.target_2xx_response_percentage,
+  ]
+  left_range = [0, 100]
+  hidden_metrics = [
+    local.lb_metrics.requests,
+    local.lb_metrics.lb_responses,
+    local.lb_metrics.target_requests,
+    local.lb_metrics.lb_fixed_responses,
+    local.lb_metrics.lb_redirects,
+    local.lb_metrics.lb_4xx_responses,
+    local.lb_metrics.lb_5xx_responses,
+    local.lb_metrics.lb_tls_negotiation_errors,
+    local.lb_metrics.target_2xx_responses,
+    local.lb_metrics.target_3xx_responses,
+    local.lb_metrics.target_4xx_responses,
+    local.lb_metrics.target_5xx_responses,
+    local.lb_metrics.target_connection_errors,
+  ]
+}
+
+module "widget_target_response_time" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "ALB target response times"
+  stacked = true
+  left_metrics = [
+    local.lb_metrics.target_p50_response_time,
+    local.lb_metrics.target_p95_response_time,
+    local.lb_metrics.target_p99_response_time,
+    local.lb_metrics.target_max_response_time,
+  ]
+  left_range = [0, null]
+}
+
+module "widget_lb_connections" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "ALB connections"
+  stacked = true
+  left_metrics = [
+    local.lb_metrics.active_connections,
+    local.lb_metrics.new_connections,
+  ]
+  left_range = [0, null]
+}
+
+module "widget_lb_lcus" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title        = "ALB consumed LCUs"
+  stacked      = true
+  left_metrics = [local.lb_metrics.consumed_lcus]
+}
+
+module "widget_lb_traffic" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title        = "ALB traffic"
+  stacked      = true
+  left_metrics = [local.lb_metrics.traffic]
+  left_range   = [0, null]
+}
+
+module "widget_nat_instance_cpu_utilization" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title = "NAT instance CPU utilization"
+  left_metrics = [
+    local.nat_instance_metrics.min_cpu_utilization,
+    local.nat_instance_metrics.average_cpu_utilization,
+    local.nat_instance_metrics.max_cpu_utilization,
+  ]
+  left_range = [0, 100]
+}
+
+module "widget_nat_instance_cpu_credit_balance" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "NAT instance CPU credit balance"
+  stacked = true
+  left_metrics = [
+    local.nat_instance_metrics.cpu_surplus_credits_charged,
+    local.nat_instance_metrics.cpu_surplus_credit_balance,
+    local.nat_instance_metrics.cpu_credit_balance,
+  ]
+  left_range = [0, null]
+}
+
+module "widget_nat_instance_cpu_credit_usage" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title        = "NAT instance CPU credit usage"
+  left_metrics = [local.nat_instance_metrics.cpu_credit_usage]
+  left_range   = [0, null]
+}
+
+module "widget_nat_instance_network_bytes" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "NAT instance network traffic"
+  stacked = true
+  left_metrics = [
+    local.nat_instance_metrics.bytes_sent,
+    local.nat_instance_metrics.bytes_received,
+  ]
+  left_range = [0, null]
+}
+
+module "widget_nat_instance_network_packets" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "NAT instance network traffic"
+  stacked = true
+  left_metrics = [
+    local.nat_instance_metrics.packets_sent,
+    local.nat_instance_metrics.packets_received,
+  ]
+  left_range = [0, null]
+}
+
+module "widget_nat_gateway_network_bytes" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "NAT gateway network traffic"
+  stacked = true
+  left_metrics = [
+    local.nat_gateway_metrics.bytes_received_out,
+    local.nat_gateway_metrics.bytes_sent_in,
+    local.nat_gateway_metrics.bytes_received_in,
+    local.nat_gateway_metrics.bytes_sent_out,
+  ]
+  left_range = [0, null]
+}
+
+module "widget_nat_gateway_network_packets" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title   = "NAT gateway network traffic"
+  stacked = true
+  left_metrics = [
+    local.nat_gateway_metrics.packets_dropped,
+    local.nat_gateway_metrics.packets_received_out,
+    local.nat_gateway_metrics.packets_sent_in,
+    local.nat_gateway_metrics.packets_received_in,
+    local.nat_gateway_metrics.packets_sent_out,
+  ]
+  left_range = [0, null]
+}
+
+module "widget_nat_gateway_active_connections" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title        = "NAT gateway active connections"
+  stacked      = true
+  left_metrics = [local.nat_gateway_metrics.active_connections]
+  left_range   = [0, null]
+}
+
+module "widget_nat_gateway_connection_attempts" {
+  source = "./../../cloudwatch/metric_widget"
+
+  title = "NAT gateway connection attempts"
+  left_metrics = [
+    local.nat_gateway_metrics.connection_attempts,
+    local.nat_gateway_metrics.established_connections,
+    local.nat_gateway_metrics.port_allocation_errors,
+  ]
+  left_range = [0, null]
+}
diff --git a/ecs/outputs.tf b/ecs/outputs.tf
index dd7e8346..d9b13b66 100644
--- a/ecs/outputs.tf
+++ b/ecs/outputs.tf
@@ -105,6 +105,36 @@ output "hosts_security_group_arn" {
   description = "The ARN of the Security Group which should be used by host instances"
 }
 
+output "lb_metrics" {
+  value       = module.network.lb_metrics
+  description = "Load balancer related Cloudwatch metrics, see [network/metrics.tf](./network/metrics.tf)"
+}
+
+output "lb_widgets" {
+  value       = module.network.lb_widgets
+  description = "Load balancer related Cloudwatch dashboard widgets, see [network/widgets.tf](./network/widgets.tf)"
+}
+
+output "nat_instance_metrics" {
+  value       = module.network.nat_instance_metrics
+  description = "NAT instance related Cloudwatch metrics, see [network/metrics.tf](./network/metrics.tf)"
+}
+
+output "nat_instance_widgets" {
+  value       = module.network.nat_instance_widgets
+  description = "NAT instance related Cloudwatch dashboard widgets, see [network/widgets.tf](./network/widgets.tf)"
+}
+
+output "nat_gateway_metrics" {
+  value       = module.network.nat_gateway_metrics
+  description = "NAT gateway related Cloudwatch metrics, see [network/metrics.tf](./network/metrics.tf)"
+}
+
+output "nat_gateway_widgets" {
+  value       = module.network.nat_gateway_widgets
+  description = "NAT gateway related Cloudwatch dashboard widgets, see [network/widgets.tf](./network/widgets.tf)"
+}
+
 # access outputs
 
 output "host_role_name" {