AWS managedservices medium security documentation change
Summary
1. Added condition for EC2 CPUUtilization alarm requiring unresponsiveness to Systems Manager polling 2. Updated 'ELB' to 'Elastic Load Balancing' terminology
Security assessment
The EC2 alarm condition change explicitly references detection of 'malicious attacks' and adds Systems Manager polling verification to reduce false positives. This improves security monitoring accuracy for attack detection (high CPU as attack indicator), warranting security documentation classification.
Diff
diff --git a/managedservices/latest/onboardingguide/monitoring-default-metrics.md b/managedservices/latest/onboardingguide/monitoring-default-metrics.md index 6bf14f46b..9ea14a424 100644 --- a//managedservices/latest/onboardingguide/monitoring-default-metrics.md +++ b//managedservices/latest/onboardingguide/monitoring-default-metrics.md @@ -25 +25 @@ AMSOutpostsCapacityExceptionCapacityExceptions 0 for 5 minutes, 1 consecutive ti -EC2 instance - all OSs | No | CPUUtilization***** >= 95% for 5 mins, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as dead locks, infinite loops, malicious attacks, and other anomalies. +EC2 instance - all OSs | No | CPUUtilization***** >= 95% for 5 mins, 6 consecutive times, if the instance is unresponsive to a polling Systems Manager command. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as dead locks, infinite loops, malicious attacks, and other anomalies. @@ -70 +70 @@ OpenSearch instance | No | AutomatedSnapshotFailure maximum is >= 1 for 1 minute -ELB instance | No | SurgeQueueLength > 100 for 1 minute, 15 consecutive times. | CloudWatch alarm if an excess number of requests are pending routing. +Elastic Load Balancing instance | No | SurgeQueueLength > 100 for 1 minute, 15 consecutive times. | CloudWatch alarm if an excess number of requests are pending routing.