AWS awssupport documentation change
Summary
Minor formatting and capitalization changes in section headers and links (e.g., 'Detailed Monitoring Not Enabled' -> 'detailed monitoring not enabled'). Added clarification about account-level driver configuration exclusion for ECS AWSLogs checks. Updated alert criteria descriptions and resource links.
Security assessment
Changes are primarily stylistic (capitalization, formatting) or clarify existing fault tolerance guidance. No evidence of addressing specific vulnerabilities or security incidents. Updates to logging driver configuration recommendations focus on availability/reliability rather than security controls.
Diff
diff --git a/awssupport/latest/user/fault-tolerance-checks.md b/awssupport/latest/user/fault-tolerance-checks.md index b927195a4..747f1f46f 100644 --- a//awssupport/latest/user/fault-tolerance-checks.md +++ b//awssupport/latest/user/fault-tolerance-checks.md @@ -5 +5 @@ -ALB Multi-AZAmazon Aurora MySQL cluster backtracking not enabledAmazon Aurora DB Instance AccessibilityAmazon CloudFront Origin FailoverAmazon Comprehend Endpoint Access RiskAmazon DocumentDB Single AZ ClustersAmazon DynamoDB Point-in-time RecoveryAmazon DynamoDB Table Not Included in Backup PlanAmazon EBS Not Included in AWS Backup PlanAmazon EBS SnapshotsAmazon EC2 Auto Scaling does not have ELB Health Check EnabledAmazon EC2 Auto Scaling Group has Capacity Rebalancing EnabledAmazon EC2 Auto Scaling is not deployed in multiple AZs or does not meet the minimum number of AZsAmazon EC2 Availability Zone BalanceAmazon EC2 Detailed Monitoring Not EnabledAmazon ECS AWSLogs driver in blocking modeAmazon ECS service using a single AZAmazon ECS Multi-AZ placement strategy Amazon EFS No Mount Target RedundancyAmazon EFS not in AWS Backup PlanAmazon ElastiCache Multi-AZ clustersElastiCache (Redis OSS) Clusters Automatic BackupAmazon MemoryDB Multi-AZ clustersAmazon MSK brokers hosting too many partitionsAmazon MSK Cluster Multi-AZAmazon OpenSearch Service domains with less than three data nodesAmazon RDS BackupsAmazon RDS Continuous Backup Not EnabledAmazon RDS DB clusters have one DB instanceAmazon RDS DB clusters with all instances in the same Availability ZoneAmazon RDS DB clusters with all reader instances in the same Availability ZoneAmazon RDS DB Instance Enhanced Monitoring not enabledAmazon RDS DB instances have storage autoscaling turned offAmazon RDS DB instances not using Multi-AZ deploymentAmazon RDS DiskQueueDepthAmazon RDS FreeStorageSpaceAmazon RDS log_output parameter is set to tableAmazon RDS innodb_default_row_format parameter setting is unsafeAmazon RDS innodb_flush_log_at_trx_commit parameter is not 1Amazon RDS max_user_connections parameter is lowAmazon RDS Multi-AZAmazon RDS Not In AWS Backup PlanAmazon RDS Read Replicas are open in writable modeAmazon RDS resource automated backups is turned offAmazon RDS sync_binlog parameter is turned offRDS DB Cluster has no Multi-AZ replication enabledRDS Multi-AZ Standby Instance Not EnabledAmazon RDS ReplicaLagAmazon RDS synchronous_commit parameter is turned offAmazon Redshift cluster automated snapshotsAmazon Route 53 Deleted Health ChecksAmazon Route 53 Failover Resource Record SetsAmazon Route 53 High TTL Resource Record SetsAmazon Route 53 Name Server DelegationsAmazon Route 53 Resolver Endpoint Availability Zone RedundancyAmazon S3 Bucket LoggingAmazon S3 Bucket Replication Not EnabledAmazon S3 Bucket VersioningApplication, Network, and Gateway Load Balancers Not Spanning Multiple Availability ZonesAuto Scaling available IPs in SubnetsAuto Scaling Group Health CheckAuto Scaling Group ResourcesAWS CloudHSM clusters running HSM instances in a single AZAWS Direct Connect Location ResiliencyAWS Lambda functions without a dead-letter queue configuredAWS Lambda On Failure Event DestinationsAWS Lambda VPC-enabled Functions without Multi-AZ RedundancyAWS Outposts Single Rack deploymentAWS Resilience Hub Application Component checkAWS Resilience Hub policy breachedAWS Resilience Hub resilience scoresAWS Resilience Hub assessment ageAWS Site-to-Site VPN has at least one tunnel in DOWN statusAWS STS global endpoint usage across AWS RegionsAWS Well-Architected high risk issues for reliabilityClassic Load Balancer has no multiple AZs configuredCLB Connection DrainingELB Target ImbalanceGWLB - endpoint AZ independenceLoad Balancer OptimizationNAT Gateway AZ IndependenceNetwork Firewall endpoint AZ IndependenceNetwork Firewall Multi-AZNetwork Load Balancers Cross Load BalancingNLB - Internet-facing resource in private subnetNLB Multi-AZNumber of AWS Regions in an Incident Manager replication setSingle AZ Application CheckVPC interface endpoint network interfaces in multiple AZsVPN Tunnel RedundancyActiveMQ Availability Zone RedundancyRabbitMQ Availability Zone Redundancy +ALB Multi-AZAmazon Aurora MySQL cluster backtracking not enabledAmazon Aurora DB Instance AccessibilityAmazon CloudFront Origin FailoverAmazon Comprehend Endpoint Access RiskAmazon DocumentDB Single AZ ClustersAmazon DynamoDB Point-in-time RecoveryAmazon DynamoDB Table Not Included in Backup PlanAmazon EBS Not Included in AWS Backup PlanAmazon EBS SnapshotsAmazon EC2 Auto Scaling does not have ELB Health Check EnabledAmazon EC2 Auto Scaling Group has Capacity Rebalancing EnabledAmazon EC2 Auto Scaling is not deployed in multiple AZs or does not meet the minimum number of AZsAmazon EC2 Availability Zone BalanceAmazon EC2 detailed monitoring not enabledAmazon ECS AWSLogs driver in blocking modeAmazon ECS service using a single AZAmazon ECS Multi-AZ placement strategy Amazon EFS no mount target redundancyAmazon EFS not in AWS Backup planAmazon ElastiCache Multi-AZ clustersElastiCache (Redis OSS) Clusters Automatic BackupAmazon MemoryDB Multi-AZ clustersAmazon MSK brokers hosting too many partitionsAmazon MSK Cluster Multi-AZAmazon OpenSearch Service domains with less than three data nodesAmazon RDS BackupsAmazon RDS Continuous Backup Not EnabledAmazon RDS DB clusters have one DB instanceAmazon RDS DB clusters with all instances in the same Availability ZoneAmazon RDS DB clusters with all reader instances in the same Availability ZoneAmazon RDS DB Instance Enhanced Monitoring not enabledAmazon RDS DB instances have storage autoscaling turned offAmazon RDS DB instances not using Multi-AZ deploymentAmazon RDS DiskQueueDepthAmazon RDS FreeStorageSpaceAmazon RDS log_output parameter is set to tableAmazon RDS innodb_default_row_format parameter setting is unsafeAmazon RDS innodb_flush_log_at_trx_commit parameter is not 1Amazon RDS max_user_connections parameter is lowAmazon RDS Multi-AZAmazon RDS Not In AWS Backup PlanAmazon RDS Read Replicas are open in writable modeAmazon RDS resource automated backups is turned offAmazon RDS sync_binlog parameter is turned offRDS DB Cluster has no Multi-AZ replication enabledRDS Multi-AZ Standby Instance Not EnabledAmazon RDS ReplicaLagAmazon RDS synchronous_commit parameter is turned offAmazon Redshift cluster automated snapshotsAmazon Route 53 Deleted Health ChecksAmazon Route 53 Failover Resource Record SetsAmazon Route 53 High TTL Resource Record SetsAmazon Route 53 Name Server DelegationsAmazon Route 53 Resolver Endpoint Availability Zone RedundancyAmazon S3 Bucket LoggingAmazon S3 Bucket Replication Not EnabledAmazon S3 Bucket VersioningApplication, Network, and Gateway Load Balancers Not Spanning Multiple Availability ZonesAuto Scaling available IPs in SubnetsAuto Scaling Group Health CheckAuto Scaling Group ResourcesAWS CloudHSM clusters running HSM instances in a single AZAWS Direct Connect Location ResiliencyAWS Lambda functions without a dead-letter queue configuredAWS Lambda On Failure Event DestinationsAWS Lambda VPC-enabled Functions without Multi-AZ RedundancyAWS Outposts Single Rack deploymentAWS Resilience Hub Application Component checkAWS Resilience Hub policy breachedAWS Resilience Hub resilience scoresAWS Resilience Hub assessment ageAWS Site-to-Site VPN has at least one tunnel in DOWN statusAWS STS global endpoint usage across AWS RegionsAWS Well-Architected high risk issues for reliabilityClassic Load Balancer has no multiple AZs configuredCLB Connection DrainingELB Target ImbalanceGWLB - endpoint AZ independenceLoad Balancer OptimizationNAT Gateway AZ IndependenceNetwork Firewall endpoint AZ IndependenceNetwork Firewall Multi-AZNetwork Load Balancers Cross Load BalancingNLB - Internet-facing resource in private subnetNLB Multi-AZNumber of AWS Regions in an Incident Manager replication setSingle AZ Application CheckVPC interface endpoint network interfaces in multiple AZsVPN Tunnel RedundancyActiveMQ Availability Zone RedundancyRabbitMQ Availability Zone Redundancy @@ -41 +41 @@ You can use the following checks for the fault tolerance category. - * [Amazon EC2 Detailed Monitoring Not Enabled](./fault-tolerance-checks.html#amazon-ec2-detailed-monitoring-not-enabled) + * [Amazon EC2 detailed monitoring not enabled](./fault-tolerance-checks.html#amazon-ec2-detailed-monitoring-not-enabled) @@ -43 +43 @@ You can use the following checks for the fault tolerance category. - * [Amazon ECS AWSLogs driver in blocking mode](./fault-tolerance-checks.html#amazon-ec2-awslogs-driver-blockingmode) + * [Amazon ECS AWSLogs driver in blocking mode](./fault-tolerance-checks.html#amazon-ecs-awslogs-driver-blockingmode) @@ -49 +49 @@ You can use the following checks for the fault tolerance category. - * [Amazon EFS No Mount Target Redundancy](./fault-tolerance-checks.html#amazon-efs-no-mount-target-redundancy) + * [Amazon EFS no mount target redundancy](./fault-tolerance-checks.html#amazon-efs-no-mount-target-redundancy) @@ -51 +51 @@ You can use the following checks for the fault tolerance category. - * [Amazon EFS not in AWS Backup Plan](./fault-tolerance-checks.html#amazon-efs-not-in-backup-plan) + * [Amazon EFS not in AWS Backup plan](./fault-tolerance-checks.html#amazon-efs-not-in-backup-plan) @@ -1027 +1027 @@ Balance your Amazon EC2 instances evenly across multiple Availability Zones. You -## Amazon EC2 Detailed Monitoring Not Enabled +## Amazon EC2 detailed monitoring not enabled @@ -1054 +1054 @@ AWS Config Managed Rule: ec2-instance-detailed-monitoring-enabled -**Alert Criteria** +**Alert criteria** @@ -1059 +1059 @@ Yellow: Detailed monitoring is not enabled for Amazon EC2 instances. -**Recommended Action** +**Recommended action** @@ -1089 +1089 @@ Checks for Amazon ECS task definitions configured with the AWSLogs logging drive -###### Note +This check does not consider account-level driver configuration settings. @@ -1102 +1102 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Alert Criteria** +**Alert criteria** @@ -1105 +1105 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -Yellow: The awslogs driver logging configuration parameter mode is set to blocking or missing. A missing mode parameter indicates a default blocking configurations. +Yellow: The awslogs driver logging configuration parameter mode is set to blocking. @@ -1109 +1109 @@ Green: Amazon ECS task definition is not using the awslogs driver or the awslogs -**Recommended Action** +**Recommended action** @@ -1112 +1112 @@ Green: Amazon ECS task definition is not using the awslogs driver or the awslogs -To mitigate the availability risk, consider changing the task definition AWSLogs driver configuration from blocking to non-blocking. With non-blocking mode, you will have to set a value for the max-buffer-size parameter. For more information and guidance on configuration parameters, see . See [Preventing log loss with non-blocking mode in the AWSLogs container log driver](https://aws.amazon.com/blogs/containers/preventing-log-loss-with-non-blocking-mode-in-the-awslogs-container-log-driver/) +To mitigate the availability risk, consider changing the task definition AWSLogs driver configuration from blocking to non-blocking. With non-blocking mode, you will have to set a value for the max-buffer-size parameter. For more information and guidance on configuration parameters, see [Preventing log loss with non-blocking mode in the AWSLogs container log driver](https://aws.amazon.com/blogs/containers/preventing-log-loss-with-non-blocking-mode-in-the-awslogs-container-log-driver/). @@ -1114 +1114 @@ To mitigate the availability risk, consider changing the task definition AWSLogs -**Additional Resources** +**Additional resources** @@ -1159 +1159 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Alert Criteria** +**Alert criteria** @@ -1169 +1169 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Recommended Action** +**Recommended action** @@ -1174 +1174 @@ Create at least one more task for the service in a different AZ. -**Additional Resources** +**Additional resources** @@ -1217 +1217 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Alert Criteria** +**Alert criteria** @@ -1227 +1227 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Recommended Action** +**Recommended action** @@ -1232 +1232 @@ Enable the spread task placement strategy to distribute tasks across multiple AZ -**Additional Resources** +**Additional resources** @@ -1253 +1253 @@ Enable the spread task placement strategy to distribute tasks across multiple AZ -## Amazon EFS No Mount Target Redundancy +## Amazon EFS no mount target redundancy @@ -1273 +1273 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Alert Criteria** +**Alert criteria** @@ -1283 +1283 @@ Green: File system has 2 or more mount targets created in multiple Availability -**Recommended Action** +**Recommended action** @@ -1290 +1290 @@ For EFS file systems using Standard storage classes, we recommend you create mou -**Additional Resources** +**Additional resources** @@ -1318 +1318 @@ For EFS file systems using Standard storage classes, we recommend you create mou -## Amazon EFS not in AWS Backup Plan +## Amazon EFS not in AWS Backup plan @@ -1339 +1339 @@ For more information, see [Backing up your Amazon EFS file systems](https://docs -**Alert Criteria** +**Alert criteria** @@ -1342 +1342 @@ For more information, see [Backing up your Amazon EFS file systems](https://docs -Red: Amazon EFS are not included in AWS Backup plan. +Red: Amazon EFS file systems aren't included in AWS Backup plan. @@ -1344 +1344 @@ Red: Amazon EFS are not included in AWS Backup plan. -**Recommended Action** +**Recommended action** @@ -1349 +1349 @@ Make sure that your Amazon EFS file systems are included in your AWS Backup plan -**Additional Resources** +**Additional resources** @@ -1394 +1394 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Alert Criteria** +**Alert criteria** @@ -1404 +1404 @@ For Business, Enterprise On-Ramp, or Enterprise Support customers, you can use t -**Recommended Action** +**Recommended action** @@ -1409 +1409 @@ Create at least one replica per shard, in an AZ that is different than the prima -**Additional Resources** +**Additional resources**