AWS IDR documentation change
Summary
Updated runbook documentation with restructured content, clarified communication procedures, added incident bridge setup options, refined stakeholder management, and removed outdated sections.
Security assessment
The changes focus on operational procedures for incident communication and stakeholder management. No security vulnerabilities, weaknesses, or security-specific features are mentioned. Updates include template placeholders and procedural refinements without addressing security controls or vulnerabilities.
Diff
diff --git a/IDR/latest/userguide/idr-workloads-dev-runbook.md b/IDR/latest/userguide/idr-workloads-dev-runbook.md index 3a16d929d..5b02b0422 100644 --- a//IDR/latest/userguide/idr-workloads-dev-runbook.md +++ b//IDR/latest/userguide/idr-workloads-dev-runbook.md @@ -9 +9 @@ -Incident Detection and Response uses information captured from your AWS Incident Detection and Response Customer Command Line Interface onboarding to develop runbooks and response plans for the management of incidents affecting your workloads. Runbooks document steps Incident Managers take when responding to an incident. A response plan is mapped to at least one of your workloads. The incident management team creates these templates from the information provided by you during [workload onboarding](./getting-started-idr.html#workload-onboarding). Response plans are AWS Systems Manager (SSM) document templates used to trigger incidents. To learn more about SSM documents, see [AWS Systems Manager Documents](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html). To learn more about Incident Manager, see [What Is AWS Systems Manager Incident Manager?](https://docs.aws.amazon.com/incident-manager/latest/userguide/index.html) +AWS Incident Detection and Response uses information captured from your IDR CLI onboarding to develop runbooks for the management of incidents affecting your workloads. Runbooks document steps Incident Managers take when responding to an incident. A response plan is mapped to at least one of your workloads. The incident management team creates these templates from the information provided by you during [workload onboarding](./getting-started-idr.html#workload-onboarding). @@ -15 +15 @@ Incident Detection and Response uses information captured from your AWS Incident - * Completion of alarms, runbooks and response plan definition on AWS Incident Detection and Response. + * Completion of alarms and runbooks on AWS Incident Detection and Response. @@ -22 +22 @@ You can also download an AWS Incident Detection and Response Runbook example: [a -Example runbook: +###### Example runbook @@ -23,0 +24 @@ Example runbook: +###### Description @@ -25,3 +26 @@ Example runbook: - **Runbook template for AWS Incident Detection and Response** - # Description - This document is intended for [CustomerName] [WorkloadName]. +This document is intended for [CustomerName] - [WorkloadName]. @@ -29 +28 @@ Example runbook: - [Insert short description of what the workload is intended for]. +###### Step: Priority @@ -31 +29,0 @@ Example runbook: - ## Step: Priority @@ -33,2 +30,0 @@ Example runbook: - 1. When a case is created with Incident Detection and Response, lock the case to yourself, verify the Customer Stakeholders in the Case from *Engagement Plans - Initial Engagement*. - 2. Send the first correspondence on the support case to the customer as below. If there is no support case or if it is not possible to use the support case then backup communication details are listed in the steps that follow. @@ -36,2 +32,2 @@ Example runbook: - ``` - Hello, + 1. Send the first correspondence on the Support case to the customer as below. + @@ -39 +34,0 @@ Example runbook: - This is <<Engineer's name>> from AWS Incident Detection and Response. An alarm has triggered for your workload <<application name>>. I am currently investigating and will update you in a few minutes after I have finished initial investigation. @@ -41,2 +35,0 @@ Example runbook: - Alarm Identifier - <insert CloudWatch Alarm ARN or APM Response Identifier> - ``` @@ -44,2 +36,0 @@ Example runbook: - **Compliance and regulatory requirements for the workload** - <<e.g. The workload deals with patient health records which must be kept secured and confidential. Information not to be shared with any third parties.>> @@ -47,2 +38,3 @@ Example runbook: - **Actions required from Incident Detection and Response in complying** - <<e.g Incident Management Engineers must not shared data with third parties.>> + Hello, + + This is <<Engineer's name>> from AWS Incident Detection and Response. An alarm has triggered for your workload <<Application_Name>>. I am currently investigating and will update you in a few minutes once I have finished initial investigation. @@ -50,2 +42 @@ Example runbook: - ## Step: Information - **Review of common information** + Alarm Identifier - <insert_CloudWatch_Alarm_ARN_or_APM_Response_Identifier> @@ -53,3 +44 @@ Example runbook: - * This section provides a space for defining common information which may be needed through the life of the incident. - * The target user of this information is the Incident Management Engineer and Operations Engineer. - * The following steps may reference this information to complete an action (for example, execute the "Initial Engagement" plan). +###### Step: Information @@ -57 +45,0 @@ Example runbook: - --- @@ -60 +48 @@ Example runbook: - Describe the engagement plans applicable to this runbook. This section contains only contact details. Engagement plans will be referenced in the step by step **Communication Plans**. +This section describes the engagement plans applicable to this runbook and only contains contact details. Engagement plans will be referenced in the step-by-step **Communication Plans**. @@ -64,9 +52,9 @@ Example runbook: - AWS Incident Detection and Response Team will add customer stakeholder addresses below to the Support Case. AWS Stakeholders are for additional stakeholders that may need to be made aware of any issues. - When updating customer stakeholders details in this plan also update the Backup Mailto links. - * ***Customer Stakeholders***: customeremail1; customeremail2; etc - * ***AWS Stakeholders***: [email protected]; tam-team-email; etc. - * ***One Time Only Contacts***: [These are email contacts that are included on only the first communication. Remove these contacts after the first communication has gone out. These could be customer paging email addresses such as pager-duty that must not be paged for every correspondence] - * ***Backup Mailto Impact Template***: <*Insert Impact Template Mailto Link here*> - * Use the backup Mailto when communication over cases is not possible. - * ***Backup Mailto No Impact Template***: <*Insert No Impact Mailto Link here*> - * Use the backup Mailto when communication over cases is not possible. +AWS Incident Detection and Response Team adds customer stakeholder addresses below to the Support case. AWS stakeholders are for additional stakeholders that might need to be made aware of any issues. + + * _Customer Stakeholders_ : customeremail1; customeremail2; mobile1 + + * _AWS Stakeholders_ : [email protected]; tam-team-email; etc. + + * _One Time Only Contacts_ : [These are email contacts that are included on only the first communication. Remove these contacts after the first communication has gone out. These could be customer paging email addresses such as pager-duty that must not be paged for every correspondence. Explicitly add instructions in "Priority" section, "Communication plans" on how to use these only if _One Time Only Contacts_ is available.] + + * **Incident call setup** @@ -73,0 +62,13 @@ Example runbook: +Indicate if the customer requires AWS Incident Detection and Response to create a bridge, if the customer uses a static bridge or if the customer will provide a bridge when an incident is opened. + +(Choose one option based on customer preference) + + * AWS Incident Detection and Response create a Amazon Chime/Zoom Bridge + + * Customer's provided static Bridge + + * Conference Number: < Insert Conference number > + + * Customer provides bridge details for every incident by responding to communication sent out by AWS Incident Detection and Response Team. + + * Other - Specify details. @@ -78,7 +79,18 @@ Example runbook: - For each Escalation Contact indicate if they must be added to the support case, phoned or both. - * ***First Escalation Contact***: [escalationEmailAddress#1] / [PhoneNumber] - Wait XX Minutes before escalating to this contact. - * [add Contact to Case / phone] this contact. - * ***Second Escalation Contact***: [escalationEmailAddress#2] / [PhoneNumber] - Wait XX Minutes before escalating to this contact. - * [add Contact to Case / phone] this contact. - * Etc; - --- + +For each Escalation Contact indicate if they must be added to the Support case, phoned or both. + + * Make sure that you have called Initial Engagement contact, if applicable, before escalating. + + * _First Escalation Contact_ : [escalationEmailAddress#1] / [PhoneNumber] - Wait XX Minutes before escalating to this contact. + + * [Add contact to Case / Phone] this contact. + + * _Second Escalation Contact_ : [escalationEmailAddress#2] / [PhoneNumber] - Wait XX Minutes before escalating to this contact. + + * [Add Contact to Case / Phone] this contact. + + * etc. + + + + @@ -87 +99 @@ Example runbook: - Describe how Incident Management Engineer communicates with designated stakeholders outside the incident call and communication channels. +This section describes how Incident Management Engineers communicate with designated stakeholders outside the incident call and communication channels. @@ -90,8 +102,19 @@ Example runbook: - This plan is initiated when Incident Detection and Response have determined from step **Triage** that an alert indicates potential impact to a customer. - Incident Detection and Response will request the customer to join the predetermined bridge (Chime Bridge/Customer Provided Bridge / Customer Static Bridge) as indicated in **Engagement plans - Incident call setup**. - All backup email templates for use when cases can't be used are in **Engagement plans - Initial engagement**. - * 1 – Before sending the impact notification, verify then remove and/or add customer contacts from the Support Case CC based on the contacts listed in the **Initial engagement** Engagement plan. - * 2 – Send the engagement notification to the customer based the following Template: - (choose one and remove the rest) - ***Impact Template - Chime Bridge*** - ``` + +This plan is initiated when AWS Incident Detection and Response have determined from step **Triage** that an alert indicates potential impact to a customer. + +AWS Incident Detection and Response will request the customer to join the predetermined bridge as indicated in **Engagement plans - Incident call setup**. + +(Choose one depending on whether _One Time Only Contacts_ is available or not.) + + 1. Ensure _Customer Stakeholders_ from **Engagement plans - Initial engagement** are added to the case CC. + +OR + + 1. Ensure _Customer Stakeholders_ and _One Time Only Contacts_ from **Engagement plans - Initial engagement** are added to the case CC. + + 2. Send the engagement notification to the customer based on the following template: + +(Choose one) + +_Impact Template - Amazon Chime Bridge_ + @@ -99,6 +122,6 @@ Example runbook: - Alarm Identifier - <insert CloudWatch Alarm ARN or APM Response Identifier> - Alarm State Change Reason - <insert state change reason> - Alarm Start Time - <Example: 1 January 2023, 3:30 PM UTC> - Please join the Chime Bridge below so we can start the steps outlined in your Runbook: - <insert Chime Meeting ID> - <insert Link to Chime Bridge> + Alarm Identifier - <insert_CloudWatch_Alarm_ARN_or_APM_Response_Identifier> + Alarm State Change Reason - <insert_state_change_reason> + Alarm Start Time - <Example: 1 January 2025, 3:30 PM UTC> + Please join the Amazon Chime Bridge below so we can start the steps outlined in your Runbook: + Amazon Chime Meeting ID: <insert_Meeting_ID_here> + Link to Amazon Chime Bridge: <insert_Link_here> @@ -106 +128,0 @@ Example runbook: - ``` @@ -108,2 +130,2 @@ Example runbook: - ***Impact Template - Customer Provided Bridge*** - ``` +_Impact Template - Customer Provided Bridge_ + @@ -111,3 +133,3 @@ Example runbook: - Alarm Identifier - <insert CloudWatch Alarm ARN or APM Response Identifier> - Alarm State Change Reason - <insert state change reason> - Alarm Start Time - <Example: 1 January 2023 3:30 PM UTC> + Alarm Identifier - <insert_CloudWatch_Alarm_ARN_or_APM_Response_Identifier> + Alarm State Change Reason - <insert_state_change_reason> + Alarm Start Time - <Example: 1 January 2025 3:30 PM UTC> @@ -115,3 +137,3 @@ Example runbook: - ``` - ***Impact Template - Customer Static Bridge*** - ``` + +_Impact Template - Customer Static Bridge_ + @@ -120,2 +142,2 @@ Example runbook: - Alarm State Change Reason - <insert state change reason> - Alarm Start Time - <Example: 1 January 2023, 3:30 PM UTC> + Alarm State Change Reason - <insert_state_change_reason> + Alarm Start Time - <Example: 1 January 2025, 3:30 PM UTC> @@ -123,6 +145,10 @@ Example runbook: - Conference Number: <insert conference number> - Conference URL : <insert bridgeURL> - ``` - * 3 - Set the Case to Pending Customer Action - * 4 - Follow **Engagement Escalation** plan as mentioned above. - * 5 - If the customer does not respond within 30 minutes, disengage and continue to monitor until the alarm recovers. + Conference Number: <insert_conference_number> + Conference URL: <insert_bridge_URL> +