AWS solutions documentation change
Summary
Expanded CloudWatch alarm coverage from 9 to 17 alarms, adding new categories for live race events, workflows, and admin model management with specific security-focused alarms
Security assessment
Added alarms like 'AdminAuthFailureAlarm' and 'AdminBulkDownloadAlarm' help detect brute-force attacks and data exfiltration attempts. While these monitor security-related events, there's no evidence they fix a specific vulnerability.
Diff
diff --git a/solutions/latest/deepracer-on-aws/monitoring.md b/solutions/latest/deepracer-on-aws/monitoring.md index 0894f0ac0..95f706c03 100644 --- a//solutions/latest/deepracer-on-aws/monitoring.md +++ b//solutions/latest/deepracer-on-aws/monitoring.md @@ -43 +43 @@ DeepRacer on AWS automatically provisions CloudWatch alarms to monitor critical -The deployment includes 9 CloudWatch alarms organized into three monitoring categories: +The deployment includes 17 CloudWatch alarms organized into six monitoring categories: @@ -50,0 +51 @@ The deployment includes 9 CloudWatch alarms organized into three monitoring cate + * **Live race event monitoring** \- 4 alarms that monitor live race broadcasting and IoT connectivity @@ -51,0 +53 @@ The deployment includes 9 CloudWatch alarms organized into three monitoring cate + * **Live race workflow monitoring** \- 2 alarms that monitor live race evaluation orchestration @@ -52,0 +55,6 @@ The deployment includes 9 CloudWatch alarms organized into three monitoring cate + * **Admin model management monitoring** \- 2 alarms that monitor admin model download activity + + + + +Additionally, 3 email delivery alarms are provisioned when Amazon SES is selected as the delivery method. @@ -87,0 +96,20 @@ Alarm Name | Purpose | Threshold +**Live race event alarms** + +These alarms monitor the live race broadcasting infrastructure and IoT connectivity: + +Alarm Name | Purpose | Threshold +---|---|--- +`BroadcastDLQAlarm` | Monitors dead letter queue for live race broadcast events | > 0 messages visible in 1 minute +`IoTPublishFailureAlarm` | Monitors failures publishing live race updates to IoT Core | > 0 failures across 3 evaluation periods of 1 minute +`IoTPublishLatencyAlarm` | Monitors latency of live race event publishing to IoT Core | p99 latency > 1000ms across 3 evaluation periods of 1 minute +`AttachPolicyLambdaErrorsAlarm` | Monitors errors in the IoT policy attachment function for spectator connections | > 10 errors across 3 evaluation periods of 1 minute + +**Live race workflow alarms** + +These alarms monitor the Step Functions workflow that orchestrates live race evaluations: + +Alarm Name | Purpose | Threshold +---|---|--- +`LiveRaceWorkflowErrorsAlarm` | Monitors Step Function execution failures for live race evaluations | ≥ 1 failure in 5 minutes +`StreamDLQAlarm` | Monitors dead letter queue for the DynamoDB stream handler that triggers live race executions | ≥ 1 message visible in 1 minute + @@ -97,0 +126,9 @@ Alarm Name | Purpose | Threshold +**Admin model management alarms** + +These alarms monitor the admin model management feature, which allows admins and race facilitators to view and download user models: + +Alarm Name | Purpose | Threshold +---|---|--- +`AdminBulkDownloadAlarm` | Monitors for unusually high volume of admin model downloads | ≥ 50 downloads in 5 minutes +`AdminAuthFailureAlarm` | Monitors for repeated authorization failures on admin endpoints | ≥ 10 failures in 5 minutes +