AWS managedservices documentation change
Summary
Updated monitoring alert documentation with improved service naming consistency, added variable placeholders for resource identifiers, and enhanced alert descriptions for clarity
Security assessment
Changes primarily focus on formatting improvements, service name standardization (e.g., 'ALB' to 'Application Load Balancer'), and adding template variables for resource IDs. While some alerts mention security-related scenarios like malicious attacks in EC2 notes, these were already present in previous versions. The updates don't introduce new security content or address specific vulnerabilities.
Diff
diff --git a/managedservices/latest/accelerate-guide/monitoring-default-metrics.md b/managedservices/latest/accelerate-guide/monitoring-default-metrics.md index 045fb3a4b..6157ce34c 100644 --- a//managedservices/latest/accelerate-guide/monitoring-default-metrics.md +++ b//managedservices/latest/accelerate-guide/monitoring-default-metrics.md @@ -17 +17 @@ AMS Accelerate calibrates its baseline monitoring on a periodic basis. New accou -Alerts from baseline monitoring Service | Alert name and trigger condition | Notes +Alerts from baseline monitoring Service / Resource type | Alert source and trigger condition | Alert name and notes @@ -20,26 +20,26 @@ For starred (*****) alerts, AMS proactively assesses impact and remediates when -ALB instance | ApplicationLoadBalancerErrorCount (HTTPCode_ELB_5XX_Count/RequestCount)*100 sum > 15% for 1 min, 5 consecutive times. | CloudWatch alarm on excess number of HTTP 5XX response codes generated by the Loadbalancer. -ALB instance | RejectedConnectionCount sum > 0% for 1 min, 5 consecutive times. | CloudWatch alarm if the number of connections that were rejected because the load balancer reached its maximum -ALB target | TargetConnectionErrorCount (HTTPCode_Target_5XX_Count/RequestCount)*100 sum > 15% for 1 min, 5 consecutive times. | CloudWatch alarm on excess number of HTTP 5XX response codes generated by a target. -ALB target | ApplicationLoadBalancerTargetGroupErrorCount sum > 0% for 1 min, 5 consecutive times. | CloudWatch alarm if number of connections were unsuccessfully established between the load balancer and the registered instances. -EC2 instance - all OSs | CPUUtilization***** > 95% for 5 mins, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. -EC2 instance - all OSs | StatusCheckFailed > 0% for 5 minute , 3 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. -EC2 instance - Linux | Minimum mem_used_percent >= 95% for 5 minutes, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. -EC2 instance - Linux | Average swap_used_percent >= 95% for 5 minutes, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. -EC2 instance - Linux | Maximum disk_used_percent >= 95% for 5 minutes, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. -EC2 instance - Windows | Minimum Memory % Committed Bytes in Use >= 95% for 5 minutes, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. -EC2 instance - Windows | Maximum LogicalDisk % Free Space <= 5% for 5 minutes, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. -EFS | AMSEFSBurstCreditBalanceExhausted. BurstCreditBalance less than 1000 for fifteen minutes. | CloudWatch alarm on the BurstCreditBalance of the EFS file system. -EFS | AMSEFSClientConnectionsLimit. ClientConnections > 24,000 for fifteen minutes. | CloudWatch alarm on the ClientConnections of the EFS file system. -EFS | AMSEFSThroughputUtilizationLimit. EFS Throughput Utilization > 80% for one hour. | CloudWatch alarm on the Throughput Utilization of the EFS file system. -EFS | AMSEFSPercentIOLimit. PercentIOLimit > 95 for seventy five minutes. | CloudWatch alarm on the PercentIOLimit of the EFS file system. -EKS | See EKS [Baseline alerts in monitoring and incident management for Amazon EKS in AMS Accelerate](./acc-baseline-eks-alerts.html). | -ELB instance | SpilloverCountBackendConnectionErrors > 1 for 1 minute , 15 consecutive times. | CloudWatch alarm if an excess number of requests that were rejected because the surge queue is full. -ELB instance | HTTPCode_ELB_5XX_Count sum > 0 for 5 min, 3 consecutive times. | CloudWatch alarm on excess number of HTTP 5XX response codes that originate from the load balancer. -ELB instance | SurgeQueueLength > 100 for 1 minute, 15 consecutive times. | CloudWatch alarm if an excess number of requests are pending routing. -FSx for ONTAP | AMSFSXONTAPIOPSUtilization. FSX:ONTAP IOPS Utilization > 80% for two hours. | CloudWatch alarm on the IOPS utilization limit of the FSX:ONTAP instance. -FSx for ONTAP | AMSFSXONTAPThroughputUtilization. FSX:ONTAP Throughput Utilization > 80% for two hours. | CloudWatch alarm on the throughput limit of the FSX:ONTAP volume. -FSx for ONTAP | AMSFSXONTAPVolumeInodeUtilization. FSX:ONTAP Inode Utilization > 80% for two hours. | CloudWatch alarm on the file capacity utilization limit of the FSX:ONTAP volume. -FSx for ONTAP | AMSFSXONTAPVolumeCapacityUtilization. FSX:ONTAP Volume Capacity Utilization > 80% for two hours. | CloudWatch alarm on the volume capacity utilization limit of the FSX:ONTAP volume. -Amazon FSx Windows | AMSFSXWindowsThroughputUtilization. FSX:Windows Throughput Utilization > 80% for two hours. | CloudWatch alarm on the throughput limit of the FSX:Windows instance. -Amazon FSx Windows | AMSFSXWindowsIOPSUtilization. FSX:Windows IOPS Utilization > 80% for two hours. | CloudWatch alarm on the IOPS utilization limit of the FSX:Windows instance. -GuardDuty Service | Not applicable; all findings (threat purposes) are monitored. Each finding corresponds to an alert. Changes in the GuardDuty findings. These changes include newly generated findings or subsequent occurrences of existing findings. | List of supported GuardDuty finding types are on [GuardDuty Active Finding Types](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html). +Application Load Balancer instance | ApplicationLoadBalancerErrorCount (HTTPCode_ELB_5XX_Count/RequestCount)*100 sum > 15% for 1 min, 5 consecutive times. | Application LoadBalancer HTTP 5XX Error Count CloudWatch alarm on excess number of HTTP 5XX response codes generated by the Loadbalancer. +Application Load Balancer instance | RejectedConnectionCount sum > 0% for 1 min, 5 consecutive times. | Application LoadBalancer Rejected Connection Count CloudWatch alarm if the number of connections that were rejected because the load balancer reached its maximum +Application Load Balancer target | TargetConnectionErrorCount (HTTPCode_Target_5XX_Count/RequestCount)*100 sum > 15% for 1 min, 5 consecutive times. | ${ElasticLoadBalancingV2::TargetGroup::FullName} - Application LoadBalancer Target Connection Error Count - ${ElasticLoadBalancingV2::TargetGroup::UUID} CloudWatch alarm on excess number of HTTP 5XX response codes generated by a target. +Application Load Balancer target | ApplicationLoadBalancerTargetGroupErrorCount sum > 0% for 1 min, 5 consecutive times. | ${ElasticLoadBalancingV2::TargetGroup::FullName} - Application LoadBalancer Target HTTP 5XX Error Count - ${ElasticLoadBalancingV2::TargetGroup::UUID} CloudWatch alarm if number of connections were unsuccessfully established between the load balancer and the registered instances. +Amazon EC2 instance - all OSs | CPUUtilization***** > 95% for 5 mins, 6 consecutive times. | ${EC2::InstanceId}: CPU Too High CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. +Amazon EC2 instance - all OSs | StatusCheckFailed > 0% for 5 minute , 3 consecutive times. | ${EC2::InstanceId}: Status Check Failed CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. +Amazon EC2 instance - Linux | Minimum mem_used_percent >= 95% for 5 minutes, 6 consecutive times. | ${EC2::InstanceId}: Memory Free CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. +Amazon EC2 instance - Linux | Average swap_used_percent >= 95% for 5 minutes, 6 consecutive times. | ${EC2::InstanceId}: Swap Free CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. +Amazon EC2 instance - Linux | Maximum disk_used_percent >= 95% for 5 minutes, 6 consecutive times. | ${EC2::InstanceId}: Disk Usage Too High - ${EC2::Disk::UUID} CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. +Amazon EC2 instance - Windows | Minimum Memory % Committed Bytes in Use >= 95% for 5 minutes, 6 consecutive times. | ${EC2::InstanceId}: Memory Free CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. +Amazon EC2 instance - Windows | Maximum LogicalDisk % Free Space <= 5% for 5 minutes, 6 consecutive times. | ${EC2::InstanceId}: Disk Usage Too High - ${EC2::Disk::UUID} CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as deadlocks, infinite loops, malicious attacks, and other anomalies. These are Direct-Customer-Alerts alarms. +Amazon EFS | AMSEFSBurstCreditBalanceExhausted. BurstCreditBalance less than 1000 for fifteen minutes. | ${EFS::FileSystemId}: EFS: Burst Credit Balance CloudWatch alarm on the BurstCreditBalance of the Amazon EFS file system. +Amazon EFS | AMSEFSClientConnectionsLimit. ClientConnections > 24,000 for fifteen minutes. | ${EFS::FileSystemId}: EFS: Client Connections Limit CloudWatch alarm on the ClientConnections of the Amazon EFS file system. +Amazon EFS | AMSEFSThroughputUtilizationLimit. EFS Throughput Utilization > 80% for one hour. | ${EFS::FileSystemId}: EFS: Throughput Utilization Limit CloudWatch alarm on the Throughput Utilization of the Amazon EFS file system. +Amazon EFS | AMSEFSPercentIOLimit. PercentIOLimit > 95 for seventy five minutes. | ${EFS::FileSystemId}: EFS: PercentIOLimit CloudWatch alarm on the PercentIOLimit of the Amazon EFS file system. +Amazon EKS | See Amazon EKS [Baseline alerts in monitoring and incident management for Amazon EKS in AMS Accelerate](./acc-baseline-eks-alerts.html). | +Elastic Load Balancing instance | SpilloverCountBackendConnectionErrors > 1 for 1 minute , 15 consecutive times. | Classic LoadBalancer Spillover Count Alarm CloudWatch alarm if an excess number of requests that were rejected because the surge queue is full. +Elastic Load Balancing instance | HTTPCode_ELB_5XX_Count sum > 0 for 5 min, 3 consecutive times. | CloudWatch alarm on excess number of HTTP 5XX response codes that originate from the load balancer. +Elastic Load Balancing instance | SurgeQueueLength > 100 for 1 minute, 15 consecutive times. | Classic LoadBalancer Surge Queue Length Alarm. CloudWatch alarm if an excess number of requests are pending routing. +FSx for ONTAP | AMSFSXONTAPIOPSUtilization. FSX:ONTAP IOPS Utilization > 80% for two hours. | ${FSx::FileSystemId}: FSX:ONTAP IOPS Utilization CloudWatch alarm on the IOPS utilization limit of the FSx for ONTAP instance. +FSx for ONTAP | AMSFSXONTAPThroughputUtilization. FSX:ONTAP Throughput Utilization > 80% for two hours. | ${FSx::FileSystemId}: FSX:ONTAP Throughput Utilization CloudWatch alarm on the throughput limit of the FSx for ONTAP volume. +FSx for ONTAP | AMSFSXONTAPVolumeInodeUtilization. FSX:ONTAP Inode Utilization > 80% for two hours. | ${FSx::FileSystemId}:${FSx::ONTAP::VolumeId} FSX:ONTAP Inode Utilization CloudWatch alarm on the file capacity utilization limit of the FSx for ONTAP volume. +FSx for ONTAP | AMSFSXONTAPVolumeCapacityUtilization. FSX:ONTAP Volume Capacity Utilization > 80% for two hours. | ${FSx::FileSystemId}:${FSx::ONTAP::VolumeId} CloudWatch alarm on the volume capacity utilization limit of the FSx for ONTAP volume. +FSx for Windows File Server | AMSFSXWindowsThroughputUtilization. FSX:Windows Throughput Utilization > 80% for two hours. | ${FSx::FileSystemId}: FSX:Windows Throughput Utilization CloudWatch alarm on the throughput limit of the FSx for Windows File Server instance. +FSx for Windows File Server | AMSFSXWindowsIOPSUtilization. FSX:Windows IOPS Utilization > 80% for two hours. | ${FSx::FileSystemId}: FSX:Windows IOPS Utilization CloudWatch alarm on the IOPS utilization limit of the FSx for Windows File Server instance. +GuardDuty Service | Not applicable; all findings (threat purposes) are monitored. Each finding corresponds to an alert. Changes in the GuardDuty findings. These changes include newly generated findings or subsequent occurrences of existing findings. | For a list of supported GuardDuty finding types, see [GuardDuty Active Finding Types](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html). @@ -47,2 +47,2 @@ Health | AWS Health Dashboard | Notifications are sent when there are changes in -IAM | EC2 IAM Instance Profile does not exist. The instance profile is missing. | For instructions on replacing an EC2 IAM instance profile, see the IAM documentation at [Replace IAM role](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#replace-iam-role). -IAM | EC2 IAM Instance Profile has too many policies. The IAM instance profile has 10 policies and additional policies cannot be added. | +IAM | Amazon EC2 IAM Instance Profile does not exist. The IAM instance profile is missing. | For instructions on replacing an Amazon EC2 IAM instance profile, see the IAM documentation at [Replace IAM role](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#replace-iam-role). +IAM | Amazon EC2 IAM Instance Profile has too many policies. The IAM instance profile has 10 policies and additional policies cannot be added. | @@ -56,40 +56,40 @@ Macie | Newly generated alerts and updates to existing alerts. Macie finds any c -NATGateways | PacketsDropCount : Alarm if packetsdropcount is > 0 over 15 minutes period | A value greater than zero may indicate an ongoing transient issue with the NAT gateway. -NATGateways | ErrorPortAllocation : Alarm if NAT Gateways could not allocate port for over 15 minutes evaluation period | The number of times the NAT gateway could not allocate a source port. A value greater than Zero indicates that too many concurrent connecations are open.. -OpenSearch cluster | ClusterStatus red maximum is >= 1 for 1 minute, 1 consecutive time. | CloudWatch alarm. The KMS encryption key that is used to encrypt data at rest in your domain is disabled. Re-enable it to restore normal operations. To learn more, see [Red Cluster Status](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-red-cluster-status). -OpenSearch domain | KMSKeyError >= 1 for 1 minute, 1 consecutive time. | CloudWatch alarm. At least one primary shard and its replicas are not allocated to a node. To learn more, see [Encryption of Data at Rest for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html). -OpenSearch domain | KMSKeyInaccessible >= 1 for 1 minute, 1 consecutive time. | CloudWatch alarm. At least one primary shard and its replicas are not allocated to a node. To learn more, see [Encryption of Data at Rest for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html). -OpenSearch domain | ClusterStatus yellow maximum is >= 1 for 1 minute, 1 consecutive time. | At least one replica shard is not allocated to a node. To learn more, see [Yellow Cluster Status](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-yellow-cluster-status). -OpenSearch domain | FreeStorageSpace minimum is <= 20480 for 1 minute, 1 consecutive time. | A node in your cluster is down to 20 GiB of free storage space. To learn more, see [ Lack of Available Storage Space](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-watermark). -OpenSearch domain | ClusterIndexWritesBlocked >= 1 for 5 minutes, 1 consecutive time. | The cluster is blocking write requests. To learn more, see [ClusterBlockException](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#troubleshooting-cluster-block). -OpenSearch domain | Nodes minimum < x for 1 day, 1 consecutive time. | x is the number of nodes in your cluster. This alarm indicates that at least one node in your cluster has been unreachable for one day. To learn more, see [Failed Cluster Nodes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-failed-cluster-nodes). -OpenSearch domain | CPUUtilization average >= 80% for 15 minutes, 3 consecutive times. | 100% CPU utilization isn't uncommon, but sustained high averages are problematic. Consider right-sizing an existing instance types or adding instances. -OpenSearch domain | JVMMemoryPressure maximum >= 80% for 5 minutes, 3 consecutive times. | The cluster could encounter out of memory errors if usage increases. Consider scaling vertically. Amazon ES uses half of an instance's RAM for the Java heap, up to a heap size of 32 GiB. You can scale instances vertically up to 64 GiB of RAM, at which point you can scale horizontally by adding instances. -OpenSearch domain | MasterCPUUtilization average >= 50% for 15 minutes, 3 consecutive times. | Consider using larger instance types for your [ dedicated master nodes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html). Because of their role in cluster stability and [blue/green deployments](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-createupdatedomains.html#es-managedomains-configuration-changes), dedicated master nodes should have lower average CPU usage than data nodes. -OpenSearch domain | MasterJVMMemoryPressure maximum >= 80% for 15 minutes, 1 consecutive time. | Consider using larger instance types for your [ dedicated master nodes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html). Because of their role in cluster stability and [blue/green deployments](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-createupdatedomains.html#es-managedomains-configuration-changes), dedicated master nodes should have lower average CPU usage than data nodes. -OpenSearch instance | AutomatedSnapshotFailure maximum is >= 1 for 1 minute, 1 consecutive time. | CloudWatch alarm. An automated snapshot failed. This failure is often the result of a red cluster health status. To learn more, see [Red Cluster Status](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-red-cluster-status). -RDS | Average CPU utilization > 90% for 15 mins, 2 consecutive times. | CloudWatch alarms. -Sum of DiskQueueDepth > 75% for 1 mins, 15 consecutive times. | CloudWatch alarms. -Average FreeStorageSpace < 1,073,741,824 bytes for 5 mins, 2 consecutive times. | CloudWatch alarms. -Low Storage alert Triggers when the allocated storage for the DB instance has been exhausted. | RDS-EVENT-0007, see details at [Using Amazon RDS event notification](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html). -DB instance fail The DB instance has failed due to an incompatible configuration or an underlying storage issue. Begin a point-in-time-restore for the DB instance. | RDS-EVENT-0031, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -RDS -0034 failover not attempted. RDS is not attempting a requested failover because a failover recently occurred on the DB instance. | RDS-EVENT-0034, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -RDS - 0035 DB instance invalid parameters For example, MySQL could not start because a memory-related parameter is set too high for this instance class, so your action would be to modify the memory parameter and reboot the DB instance. | RDS-EVENT-0035, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -Invalid subnet IDs DB instance The DB instance is in an incompatible network. Some of the specified subnet IDs are invalid or do not exist. | Service event. RDS-EVENT-0036, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -RDS-0045 DB instance read replica error An error has occurred in the read replication process. For more information, see the event message. For information on troubleshooting Read Replica errors, see [ Troubleshooting a MySQL Read Replica Problem](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_MySQL.Replication.ReadReplicas.html#USER_ReadRepl.Troubleshooting). | RDS-EVENT-0045, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -RDS-0057 Error create statspack user account Replication on the Read Replica was ended. | Service event. RDS-EVENT-0057, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -RDS-0058 DB instance read replication ended Error while creating Statspack user account PERFSTAT. Drop the account before adding the Statspack option. | Service event. RDS-EVENT-0058, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -DB instance recovery start The SQL Server DB instance is re-establishing its mirror. Performance will be degraded until the mirror is reestablished. A database was found with non-FULL recovery model. The recovery model was changed back to FULL and mirroring recovery was started. (<dbname>: <recovery model found>[,…]) | Service event. RDS-EVENT-0066 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -A failover for the DB cluster has failed. | RDS-EVENT-0069, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -Invalid permissions recovery S3 bucket The IAM role that you use to access your Amazon S3 bucket for SQL Server native backup and restore is configured incorrectly. For more information, see [ Setting Up for Native Backup and Restore](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html#SQLServer.Procedural.Importing.Native.Enabling). | Service event. RDS-EVENT-0081 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -Aurora was unable to copy backup data from an Amazon S3 bucket. | RDS-EVENT-0082, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -Low storage alert when the DB instance has consumed more than 90% of its allocated storage. | Service event. RDS-EVENT-0089 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -Notification service when scaling failed for the Aurora Serverless DB cluster. | Service event. RDS-EVENT-0143 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -The DB instance is in an invalid state. No actions are necessary. Autoscaling will retry later. | RDS-EVENT-0219, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -The DB instance has reached the storage-full threshold, and the database has been shut down. | RDS-EVENT-0221, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -This event indicates the RDS instance storage autoscaling is unable to scale, there could be multiple reasons for why the autoscaling failed. | RDS-EVENT-0223, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -Storage autoscaling has triggered a pending scale storage task that would reach the maximum storage threshold. | RDS-EVENT-0224, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -The DB instance has a storage type that's currently unavailable in the Availability Zone. Autoscaling will retry later. | RDS-EVENT-0237, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -RDS couldn't provision capacity for the proxy because there aren't enough IP addresses available in your subnets. | RDS-EVENT-0243, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -The storage for your AWS account has exceeded the allowed storage quota. | RDS-EVENT-0254, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). -RedShift cluster | The health of the cluster when not in maintenance mode < 1 for 5 min | For more information, see [Monitoring Amazon Redshift using CloudWatch metrics](https://docs.aws.amazon.com/redshift/latest/mgmt/metrics-listing.html). -Site-to-Site VPN | VPNTunnelDownTunnelState <= 0 for 1 min, 20 consecutive times. | TunnelState is 0 when both tunnels are down, .5 when one tunnel is up, and 1.0 when both tunnels are up. +NATGateways | PacketsDropCount : Alarm if packetsdropcount is > 0 over 15 minutes period | NatGateway PacketsDropCount A value greater than zero may indicate an ongoing transient issue with the NAT gateway. +NATGateways | ErrorPortAllocation : Alarm if NAT Gateways could not allocate port for over 15 minutes evaluation period | NatGateway ErrorPortAllocation The number of times the NAT gateway could not allocate a source port. A value greater than zero indicates that too many concurrent connecations are open. +OpenSearch cluster | ClusterStatus red maximum is >= 1 for 1 minute, 1 consecutive time. | ClusterStatus Red CloudWatch alarm. The AWS KMS encryption key that is used to encrypt data at rest in your domain is disabled. Re-enable it to restore normal operations. To learn more, see [Red Cluster Status](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-red-cluster-status). +OpenSearch domain | KMSKeyError >= 1 for 1 minute, 1 consecutive time. | KMS key Error CloudWatch alarm. At least one primary shard and its replicas are not allocated to a node. To learn more, see [Encryption of Data at Rest for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html). +OpenSearch domain | KMSKeyInaccessible >= 1 for 1 minute, 1 consecutive time. | KMS key Inaccessible Error CloudWatch alarm. At least one primary shard and its replicas are not allocated to a node. To learn more, see [Encryption of Data at Rest for Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html). +OpenSearch domain | ClusterStatus yellow maximum is >= 1 for 1 minute, 1 consecutive time. | ClusterStatus Yellow At least one replica shard is not allocated to a node. To learn more, see [Yellow Cluster Status](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-yellow-cluster-status). +OpenSearch domain | FreeStorageSpace minimum is <= 20480 for 1 minute, 1 consecutive time. | Low free storage space A node in your cluster is down to 20 GiB of free storage space. To learn more, see [ Lack of Available Storage Space](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-watermark). +OpenSearch domain | ClusterIndexWritesBlocked >= 1 for 5 minutes, 1 consecutive time. | Cluster Index Writes Blocked The cluster is blocking write requests. To learn more, see [ClusterBlockException](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#troubleshooting-cluster-block). +OpenSearch domain | Nodes minimum < x for 1 day, 1 consecutive time. | Nodes Down x is the number of nodes in your cluster. This alarm indicates that at least one node in your cluster has been unreachable for one day. To learn more, see [Failed Cluster Nodes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-failed-cluster-nodes). +OpenSearch domain | CPUUtilization average >= 80% for 15 minutes, 3 consecutive times. | High CPU usage in data node 100% CPU utilization isn't uncommon, but sustained high averages are problematic. Consider right-sizing an existing instance types or adding instances. +OpenSearch domain | JVMMemoryPressure maximum >= 80% for 5 minutes, 3 consecutive times. | High memory usage in data node The cluster could encounter out of memory errors if usage increases. Consider scaling vertically. OpenSearch uses half of an instance's RAM for the Java heap, up to a heap size of 32 GiB. You can scale instances vertically up to 64 GiB of RAM, at which point you can scale horizontally by adding instances. +OpenSearch domain | MasterCPUUtilization average >= 50% for 15 minutes, 3 consecutive times. | Master Nodes High CPU usage Consider using larger instance types for your [ dedicated master nodes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html). Because of their role in cluster stability and [blue/green deployments](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-createupdatedomains.html#es-managedomains-configuration-changes), dedicated master nodes should have lower average CPU usage than data nodes. +OpenSearch domain | MasterJVMMemoryPressure maximum >= 80% for 15 minutes, 1 consecutive time. | Master Nodes High JVM Memory Pressure Consider using larger instance types for your [ dedicated master nodes](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html). Because of their role in cluster stability and [blue/green deployments](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-createupdatedomains.html#es-managedomains-configuration-changes), dedicated master nodes should have lower average CPU usage than data nodes. +OpenSearch instance | AutomatedSnapshotFailure maximum is >= 1 for 1 minute, 1 consecutive time. | Automated snapshot failure CloudWatch alarm. An automated snapshot failed. This failure is often the result of a red cluster health status. To learn more, see [Red Cluster Status](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/aes-handling-errors.html#aes-handling-errors-red-cluster-status). +Amazon RDS | Average CPU utilization > 90% for 15 mins, 2 consecutive times. | ${RDS::DBInstanceIdentifier}: CPUUtilization CloudWatch alarms. +Amazon RDS | Sum of DiskQueueDepth > 75% for 1 mins, 15 consecutive times. | ${RDS::DBInstanceIdentifier}: DiskQueue CloudWatch alarms. +Amazon RDS | Average FreeStorageSpace < 1,073,741,824 bytes for 5 mins, 2 consecutive times. | ${RDS::DBInstanceIdentifier}: FreeStorageSpace CloudWatch alarms. +Amazon RDS | Low Storage alert Triggers when the allocated storage for the DB instance has been exhausted. | RDS-EVENT-0007, see details at [Using Amazon RDS event notification](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html). +Amazon RDS | DB instance fail The DB instance has failed due to an incompatible configuration or an underlying storage issue. Begin a point-in-time-restore for the DB instance. | RDS-EVENT-0031, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | RDS -0034 failover not attempted. Amazon RDS is not attempting a requested failover because a failover recently occurred on the DB instance. | RDS-EVENT-0034, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | RDS - 0035 DB instance invalid parameters For example, MySQL could not start because a memory-related parameter is set too high for this instance class, so your action would be to modify the memory parameter and reboot the DB instance. | RDS-EVENT-0035, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | Invalid subnet IDs DB instance The DB instance is in an incompatible network. Some of the specified subnet IDs are invalid or do not exist. | Service event. RDS-EVENT-0036, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | RDS-0045 DB instance read replica error An error has occurred in the read replication process. For more information, see the event message. For information on troubleshooting Read Replica errors, see [ Troubleshooting a MySQL Read Replica Problem](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_MySQL.Replication.ReadReplicas.html#USER_ReadRepl.Troubleshooting). | RDS-EVENT-0045, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | RDS-0057 Error create statspack user account Replication on the Read Replica was ended. | Service event. RDS-EVENT-0057, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | RDS-0058 DB instance read replication ended Error while creating Statspack user account PERFSTAT. Drop the account before adding the Statspack option. | Service event. RDS-EVENT-0058, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | DB instance recovery start The SQL Server DB instance is re-establishing its mirror. Performance will be degraded until the mirror is reestablished. A database was found with non-FULL recovery model. The recovery model was changed back to FULL and mirroring recovery was started. (<dbname>: <recovery model found>[,…]) | Service event. RDS-EVENT-0066 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | A failover for the DB cluster has failed. | RDS-EVENT-0069, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | Invalid permissions recovery S3 bucket The IAM role that you use to access your Amazon S3 bucket for SQL Server native backup and restore is configured incorrectly. For more information, see [ Setting Up for Native Backup and Restore](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html#SQLServer.Procedural.Importing.Native.Enabling). | Service event. RDS-EVENT-0081 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | Aurora was unable to copy backup data from an Amazon S3 bucket. | RDS-EVENT-0082, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | Low storage alert when the DB instance has consumed more than 90% of its allocated storage. | Service event. RDS-EVENT-0089 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | Notification service when scaling failed for the Aurora Serverless DB cluster. | Service event. RDS-EVENT-0143 see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | The DB instance is in an invalid state. No actions are necessary. Autoscaling will retry later. | RDS-EVENT-0219, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | The DB instance has reached the storage-full threshold, and the database has been shut down. | RDS-EVENT-0221, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | This event indicates the Amazon RDS instance storage autoscaling is unable to scale, there could be multiple reasons for why the autoscaling failed. | RDS-EVENT-0223, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | Storage autoscaling has triggered a pending scale storage task that would reach the maximum storage threshold. | RDS-EVENT-0224, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | The DB instance has a storage type that's currently unavailable in the Availability Zone. Autoscaling will retry later. | RDS-EVENT-0237, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | Amazon RDS couldn't provision capacity for the proxy because there aren't enough IP addresses available in your subnets. | RDS-EVENT-0243, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon RDS | The storage for your AWS account has exceeded the allowed storage quota. | RDS-EVENT-0254, see details at [Amazon RDS Event Categories and Event Messages](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages). +Amazon Redshift cluster | The health of the cluster when not in maintenance mode < 1 for 5 min | RedshiftClusterHealthStatus For more information, see [Monitoring Amazon Redshift using CloudWatch metrics](https://docs.aws.amazon.com/redshift/latest/mgmt/metrics-listing.html). +Site-to-Site VPN | VPNTunnelDownTunnelState <= 0 for 1 min, 20 consecutive times. | ${AWS::EC2::VpnConnectionId} - VPNTunnelDown TunnelState is 0 when both tunnels are down, .5 when one tunnel is up, and 1.0 when both tunnels are up.