AWS IDR documentation change
Summary
Updated alarm ingestion questionnaire structure by splitting into Overview and Runbook sections, added new content about alarm ingestion process, contact management, and critical alarm criteria. Minor text case corrections and terminology updates.
Security assessment
The changes enhance documentation for incident response processes but don't address a specific vulnerability. Added security-related documentation about critical alarm criteria and contact escalation procedures which improve security operations.
Diff
diff --git a/IDR/latest/userguide/idr-gs-questionnaire.md b/IDR/latest/userguide/idr-gs-questionnaire.md index be00bb0ce..307625567 100644 --- a//IDR/latest/userguide/idr-gs-questionnaire.md +++ b//IDR/latest/userguide/idr-gs-questionnaire.md @@ -7 +7 @@ -Workload onboarding questionnaire - General questionsWorkload onboarding questionnaire - Architecture questionsAlarm ingestion questionnaireAlarm matrix +Workload onboarding questionnaire - General questionsWorkload onboarding questionnaire - Architecture questionsAlarm ingestion questionnaire - OverviewAlarm ingestion questionnaire - Runbook questionsAlarm matrix @@ -9 +9,5 @@ Workload onboarding questionnaire - General questionsWorkload onboarding questio -# Workload onboarding and alarm ingestion questionnaires in Incident Detection and Response +# Workload onboarding and alarm ingestion questionnaires in Incident Detection and Response (exception path) + +###### Note + +If you are unable to use the AWS Incident Detection and Response Customer Command Line Interface to onboard your workload, use the following questionnaires for workload and alarm onboarding. @@ -49 +53 @@ Tags are case sensitive. If you provide multiple tags, all resources used by thi -A list of AWS Services utilized by this workload and the AWS Account and Regions that they're in. +A list of AWS services utilized by this workload and the AWS Account and Regions that they're in. @@ -54 +58 @@ Create a new row for each service. | Route 53: Routes internet traffic to the AL -A list of AWS Services utilized by this workload and the AWS Account and Regions that they're in. +A list of AWS services utilized by this workload and the AWS Account and Regions that they're in. @@ -59 +63 @@ Create a new row for each service. | ALB: Routes incoming traffic to a target gr -A list of AWS Services utilized by this workload and the AWS Account and Regions that they're in. +A list of AWS services utilized by this workload and the AWS Account and Regions that they're in. @@ -78 +82,22 @@ Provide details of any manual or automated failover/disaster recovery plans at t -## Alarm ingestion questionnaire +## Alarm ingestion questionnaire - Overview + +In the alarm ingestion questionnaire, you specify the critical alarms for your workload that you want to engage AWS Incident Detection and Response, as well as the contacts you want an Incident Management Engineer to engage when these alarms trigger. + +The Alarm Ingestion Questionnaire is divided into the following sections: + + * **Contact section:** First, specify the primary contact(s) to be included on the Support Case created with AWS Incident Detection and Response when an alarm triggers, as well as your preferred conferencing application for incident bridges. If no bridge preference is provided, AWS Incident Detection and Response will create an incident bridge during incidents. Next, specify escalation contacts and time intervals to engage them when primary contacts are unreachable. Finally, list any contacts who should receive regular incident status updates through the support case for the duration of an incident. + + * **Alarm matrix:** List the set of alarms that will engage AWS Incident Detection and Response when triggered. See the "Critical Alarm Criteria" defined by AWS Incident Detection and Response when selecting alarms for onboarding. For more information, see [Alarm definition](./idr-gs-alarm-definition.html). + + * **Amazon CloudWatch Alarms** (leave this section blank if you don't have Amazon CloudWatch alarms) + + * **Third party APM alarms** (leave this section blank if you don't have Third party APM alarms) + + * **EventBridge EventBus ARN:** This is the ARN of the custom EventBus ARN that you created in [Ingest Alarms from APMs with direct EventBridge integration](./idr-gs-ingest_alarms_from_apm_to_eventbridge.html) or [Ingest alarms from APMs without direct integration with EventBridge](./idr-gs-ingest-apm-webhooks.html). + + * **Alarm Identifiers:** Share the account number, region, and name of the APM alarm. + + + + +## Alarm ingestion questionnaire - Runbook questions @@ -82 +107 @@ Runbook questions Question | Example Response -AWS will engage workload contacts through the Support Case. Who is the primary contact when an alarm triggers for this workload? Specify your preferred conferencing application and AWS will request these details during an incident. +AWS engages workload contacts through the Support case. Who is the primary contact when an alarm triggers for this workload? Specify your preferred conferencing application and AWS will request these details during an incident. @@ -94 +119 @@ Provide the following information to identify the set of alarms that will engage -**AWS Incident Detection and Response Critical Alarm Criteria** : +**AWS Incident Detection and Response Critical alarm criteria** : @@ -105 +130 @@ Provide the following information to identify the set of alarms that will engage -**AWS Incident Detection and Response Policy for Criteria Violations** : +**AWS Incident Detection and Response Policy for criteria violations** : @@ -129 +154 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Onboarding +Alarms go live @@ -131 +156 @@ Onboarding -Workload discovery +Manage workloads