AWS managedservices medium security documentation change
Summary
1. Added condition for EC2 CPUUtilization alarm requiring unresponsiveness to Systems Manager polling 2. Updated 'ELB' to 'Elastic Load Balancing' terminology
Security assessment
Modified EC2 alarm condition enhances security monitoring by correlating high CPU with system unresponsiveness, explicitly citing 'malicious attacks' as detection target. This refines security alerting logic for attack identification.
Diff
diff --git a/managedservices/latest/userguide/monitoring-default-metrics.md b/managedservices/latest/userguide/monitoring-default-metrics.md index 8cc8e5a15..658fb9e45 100644 --- a//managedservices/latest/userguide/monitoring-default-metrics.md +++ b//managedservices/latest/userguide/monitoring-default-metrics.md @@ -33 +33 @@ AMSOutpostsCapacityExceptionCapacityExceptions 0 for 5 minutes, 1 consecutive ti -EC2 instance - all OSs | No | CPUUtilization***** >= 95% for 5 mins, 6 consecutive times. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as dead locks, infinite loops, malicious attacks, and other anomalies. +EC2 instance - all OSs | No | CPUUtilization***** >= 95% for 5 mins, 6 consecutive times, if the instance is unresponsive to a polling Systems Manager command. | CloudWatch alarm. High CPU utilization is an indicator of a change in application state such as dead locks, infinite loops, malicious attacks, and other anomalies. @@ -78 +78 @@ OpenSearch instance | No | AutomatedSnapshotFailure maximum is >= 1 for 1 minute -ELB instance | No | SurgeQueueLength > 100 for 1 minute, 15 consecutive times. | CloudWatch alarm if an excess number of requests are pending routing. +Elastic Load Balancing instance | No | SurgeQueueLength > 100 for 1 minute, 15 consecutive times. | CloudWatch alarm if an excess number of requests are pending routing.