AWS solutions documentation change
Summary
Added comprehensive documentation about informational tagging feature including tag keys, error codes, tag behavior, governance considerations, control tags, and tag capacity limits
Security assessment
This change documents a monitoring feature that provides visibility into scheduling operations and error states through resource tagging. While it enhances operational transparency and helps with compliance (tag governance considerations), there is no evidence of addressing a specific security vulnerability. The documentation includes security-adjacent content about tag governance policies and ensuring tag capacity limits, which helps organizations maintain security and compliance controls.
Diff
diff --git a/solutions/latest/instance-scheduler-on-aws/monitor-the-solution.md b/solutions/latest/instance-scheduler-on-aws/monitor-the-solution.md index afc66b36a..4ba7fcf2c 100644 --- a//solutions/latest/instance-scheduler-on-aws/monitor-the-solution.md +++ b//solutions/latest/instance-scheduler-on-aws/monitor-the-solution.md @@ -5 +5 @@ -Logging and notificationsCloudWatch Logs Insights queriesOperational insights dashboardMonitoring EventBridge Events +Logging and notificationsInformational tagsCloudWatch Logs Insights queriesOperational insights dashboardMonitoring EventBridge Events @@ -26,0 +27,84 @@ Warning and error logs are also forwarded to a solution-created Amazon SNS topic +## Informational tags + +When informational tagging is enabled (the default), Instance Scheduler writes tags directly to managed resources to provide at-a-glance visibility into the solution’s scheduling activity. These tags are applied using the AWS Resource Groups Tagging API and are updated each time the scheduler processes a resource. + +You can enable or disable this feature using the **Enable informational tagging** parameter on the hub stack. For more information, refer to [Update global configuration settings](./update-global-configuration-settings.html). + +### Informational tag keys + +The following tags are written to managed resources: + +Tag key | Description +---|--- +`IS-ManagedBy` | The ARN of the Instance Scheduler hub stack managing this resource. Applied when a resource is first registered for scheduling and on each subsequent scheduling action. +`IS-LastAction` | The last scheduling action taken on the resource, along with a UTC timestamp. For example: `Started 2025-06-15 09:00:00 UTC` or `Stopped 2025-06-15 17:00:00 UTC`. This tag is only updated when the scheduler actively starts or stops a resource (not when it evaluates a resource and determines no action is needed). +`IS-Error` | If the scheduler encounters an error while processing a resource, this tag contains the error code and a UTC timestamp. For example: `StartFailed 2025-06-15 09:00:05 UTC`. This tag is automatically cleared on the next successful scheduling action. +`IS-ErrorMessage` | A human-readable description of the error. This tag is only present when `IS-Error` is also present and is cleared alongside it. + +### Error codes + +The following error codes may appear in the `IS-Error` tag: + +Error code | Description +---|--- +`UnknownSchedule` | The schedule name specified in the resource’s schedule tag does not match any schedule defined in the configuration table. +`UnsupportedResource` | The resource type is not supported for scheduling (for example, a read replica of another RDS instance). +`IncompatibleSchedule` | The schedule assigned to the resource is not compatible with the resource type (for example, an ASG schedule that uses unsupported cron expressions). +`StartFailed` | The scheduler attempted to start the resource but the operation failed. +`StopFailed` | The scheduler attempted to stop the resource but the operation failed. +`ConfigurationFailed` | The scheduler attempted to configure scheduled scaling rules on an Auto Scaling group but the operation failed. +`UnknownError` | An unexpected error occurred while processing the resource. + +### Tag behavior + + * When a resource is first registered for scheduling, the `IS-ManagedBy` tag is applied immediately. + + * When a resource is deregistered (the schedule tag is removed), all informational tags (`IS-ManagedBy`, `IS-LastAction`, `IS-Error`, `IS-ErrorMessage`) are removed from the resource. + + * Error tags are not re-written on each scheduling interval if the same error persists and the existing tag is still present on the resource. They are only updated when the error code changes. + + * All tag values are truncated to 256 characters to comply with AWS tagging limits. + + + + +### Tag governance considerations + +###### Important + +Instance Scheduler creates and updates the tags listed above on managed resources as part of normal operation. If your organization enforces tag governance through AWS Config rules, tag policies, service control policies, or automated remediation, ensure that your change management controls are configured to allow the following tag keys: + + * `IS-ManagedBy` + + * `IS-LastAction` + + * `IS-Error` + + * `IS-ErrorMessage` + + * `IS-PreferredInstanceTypes` (if using alternate instance types) + + * `IS-MinDesiredMax` (if scheduling Auto Scaling groups) + + + + +If you cannot accommodate these tags in your governance policies, disable informational tagging by setting the **Enable informational tagging** parameter to `No` on the hub stack. Note that this will also disable the `IS-ManagedBy` tag that is used to confirm resource registration. + +### Control tags + +In addition to informational tags, Instance Scheduler uses the following control tags for specific features: + +Tag key | Description +---|--- +`IS-PreferredInstanceTypes` | A comma-separated list of alternate EC2 instance types to try when starting an instance fails due to insufficient capacity. For more information, refer to [Handling EC2 Insufficient Capacity Errors](./specifying-alternate-instance-types-for-ec2.html). +`IS-MinDesiredMax` | The minimum, desired, and maximum capacity values for an Auto Scaling group in the format `min,desired,max`. For more information, refer to [EC2 Auto Scaling Group Scheduling](./ec2-auto-scaling-group-scheduling.html). + +### Tag capacity + +###### Important + +AWS resources typically have a limit of 50 tags per resource. Instance Scheduler may use up to 6 tags on a resource (4 informational tags plus up to 2 control tags). Ensure your resources have sufficient tag capacity to accommodate Instance Scheduler tags alongside your existing tagging strategy. + +If a resource is at or near the 50-tag limit, informational tag writes may fail. The scheduler logs these failures but continues scheduling operations. Check CloudWatch Logs if you suspect tagging issues. +