AWS health documentation change
Summary
Updated documentation about AWS Health event routing with backup regions, high availability setup, and simplified integration patterns. Added sections for backup region functionality, de-duplication guidance, and global event handling.
Security assessment
The changes focus on improving reliability and high availability of event delivery through backup regions and de-duplication. While availability is a security pillar, there is no evidence of addressing a specific security vulnerability or weakness. The updates describe operational best practices rather than security features or mitigations.
Diff
diff --git a/health/latest/ug/choosing-a-region.md b/health/latest/ug/choosing-a-region.md index 0d0b70bcd..0156252a2 100644 --- a//health/latest/ug/choosing-a-region.md +++ b//health/latest/ug/choosing-a-region.md @@ -4,0 +5,2 @@ +High availability setup (optional)Simplified integrationGlobal events + @@ -7 +9,9 @@ -You must create an EventBridge rule for each Region that you want to receive AWS Health events for. If you don’t create a rule, you won’t receive events. For example, to receive events from the US West (Oregon) Region, you must create a rule for this Region. +You can create an EventBridge rule for each Region that you want to receive AWS Health events for. For example, to receive events from the Europe (Frankfurt) Region, you can create a rule for this Region. + +To enhance the reliability of AWS Health notifications, you can set up rules in the dedicated backup regions. In the standard AWS partition, the US West (Oregon) Region acts as the backup region for all other regions, while US East (N. Virginia) Region serves as the backup for the US West (Oregon) Region. When health events occur, they are automatically sent to both the primary region and its designated backup region. For example, if you're monitoring events in the Europe (Frankfurt) Region and that Region is temporarily unavailable, then AWS Health will also deliver that event to both the Europe (Frankfurt) Region and the US West (Oregon) Region. This system makes sure you'll continue to receive health notifications even if your primary region experiences issues. To create a backup rule, follow the procedure for [Configuring an EventBridge rule to send notifications about events in AWS Health](./creating-event-bridge-events-rule-for-aws-health.html). + +If you prefer not to use backup functionality, then you'll need to add a filter to your backup region rule. For example, implement a filter for `detail.backupEvent = False`. This prevents you from receiving backup events from other regions. + +## High availability setup (optional) + +If you want to create an EventBridge integration with high availability, make sure you have implemented rules in both the relevant and backup regions, and then implement de-duplication using `detail.communicationId`. This makes sure you receive all events while avoiding duplicates. For more information, see [Reference: AWS Health events Amazon EventBridge schema](./aws-health-events-eventbridge-schema.html). @@ -9 +19 @@ You must create an EventBridge rule for each Region that you want to receive AWS -Setting up an additional rule in a backup Region adds an extra layer of resilience to your workflows, should your primary rule be affected by an ongoing event. Public events for AWS Health are sent simultaneously to both the impacted Region and to a backup Region. See [About public events for AWS Health](https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html#about-public-events) for more information. For all Regions in the standard AWS partition, you can setup a rule in US West (Oregon) as a backup to continue receiving events even if your primary Region is affected by an ongoing issue. The backup Region for the US West (Oregon) Region is US East (N. Virginia) Region. +## Simplified integration @@ -11 +21 @@ Setting up an additional rule in a backup Region adds an extra layer of resilien -For example, if you're monitoring events in the Europe (Frankfurt) Region and that Region is temporarily unavailable, then AWS Health will also deliver that event to the US West (Oregon) Region. Next, your back up EventBridge rule sends the event to the targets that you specified. To create a backup rule, follow the procedure below for [Configuring an EventBridge rule to send notifications about events in AWS Health](./creating-event-bridge-events-rule-for-aws-health.html) and use the US West (Oregon) Region. +If you want to capture events from multiple AWS Regions but prefer to configure only a single rule, then this solution is be the best option for you. To receive Health events from all Regions in the standard AWS partition, you can setup a central rule in the US West (Oregon) Region. This single rule automatically aggregates events from all standard partition regions where you are receiving Health events. However, you won't have high availability configuration. @@ -13 +23 @@ For example, if you're monitoring events in the Europe (Frankfurt) Region and th -Some AWS Health events are not Region-specific. Events that aren't specific to a Region are called global events. These include events sent for AWS Identity and Access Management (IAM). To receive global events, you must create a rule for the US East (N. Virginia) Region for the primary Region and US West (Oregon) Region as the backup Region. +## Global events @@ -15 +25 @@ Some AWS Health events are not Region-specific. Events that aren't specific to a -To receive global events in the AWS GovCloud (US), you must create a rule in the AWS GovCloud (US-West) Region. +Some AWS Health events are not Region-specific. Events that aren't specific to a Region are called global events. These include events sent for AWS Identity and Access Management (IAM). To receive global events, you must create a rule for the US East (N. Virginia) Region.