AWS amazondynamodb high security documentation change
Summary
Replaced CloudFormation template for CloudWatch alarms with critical clarification about required dimensions (TableName + Operation or GlobalSecondaryIndexName) when monitoring SystemErrors metric to prevent alarms from staying in INSUFFICIENT_DATA state.
Security assessment
The change addresses a critical monitoring gap where improperly configured alarms would never trigger for SystemErrors. Since SystemErrors can indicate security-related failures like authentication/authorization issues (HTTP 500 errors), this directly impacts security visibility. The explicit documentation prevents misconfiguration that could hide security incidents.
Diff
diff --git a/amazondynamodb/latest/developerguide/TroubleshootingInternalServerErrors.md b/amazondynamodb/latest/developerguide/TroubleshootingInternalServerErrors.md index 89d1f4ae6..691e40840 100644 --- a//amazondynamodb/latest/developerguide/TroubleshootingInternalServerErrors.md +++ b//amazondynamodb/latest/developerguide/TroubleshootingInternalServerErrors.md @@ -72,137 +72 @@ You should have CloudWatch alarms set on your DynamoDB tables to receive notific -These alarms use custom metric math to calculate the failed request percentage for a 5-minute window. The recommended best practice is to configure the alarm to enter the `ALARM` state when 3 consecutive data points breach the 1% threshold, which means that overall 1% of requests fail within a 15-minute period. - -The sample below is a CloudFormation template that can help you create CloudWatch alarms on your table and GSI on the table. - - - AWSTemplateFormatVersion: "2010-09-09" - Description: Sample template for monitoring DynamoDB - Parameters: - DynamoDBProvisionedTableName: - Description: Name of DynamoDB Provisioned Table to create - Type: String - MinLength: 3 - MaxLength: 255 - ConstraintDescription : https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Limits.html#limits-naming-rules - DynamoDBSNSEmail: - Description : Email Address subscribed to newly created SNS Topic - Type: String - AllowedPattern: "^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9-.]+$" - MinLength: 1 - MaxLength: 255 - - Resources: - DynamoDBMonitoringSNSTopic: - Type: AWS::SNS::Topic - Properties: - DisplayName: DynamoDB Monitoring SNS Topic - Subscription: - - Endpoint: !Ref DynamoDBSNSEmail - Protocol: email - TopicName: dynamodb-monitoring - - DynamoDBTableSystemErrorAlarm: - Type: 'AWS::CloudWatch::Alarm' - Properties: - AlarmName: 'DynamoDBTableSystemErrorAlarm' - AlarmDescription: 'Alarm when system errors exceed 1% of total number of requests for 15 minutes' - AlarmActions: - - !Ref DynamoDBMonitoringSNSTopic - Metrics: - - Id: 'e1' - Expression: 'm1/(m1+m2+m3)' - Label: SystemErrorsOverTotalRequests - - Id: 'm1' - MetricStat: - Metric: - Namespace: 'AWS/DynamoDB' - MetricName: 'SystemErrors' - Dimensions: - - Name: 'TableName' - Value: !Ref DynamoDBProvisionedTableName - Period: 300 - Stat: 'SampleCount' - Unit: 'Count' - ReturnData: False - - Id: 'm2' - MetricStat: - Metric: - Namespace: 'AWS/DynamoDB' - MetricName: 'ConsumedReadCapacityUnits' - Dimensions: - - Name: 'TableName' - Value: !Ref DynamoDBProvisionedTableName - Period: 300 - Stat: 'SampleCount' - Unit: 'Count' - ReturnData: False - - Id: 'm3' - MetricStat: - Metric: - Namespace: 'AWS/DynamoDB' - MetricName: 'ConsumedWriteCapacityUnits' - Dimensions: - - Name: 'TableName' - Value: !Ref DynamoDBProvisionedTableName - Period: 300 - Stat: 'SampleCount' - Unit: 'Count' - ReturnData: False - EvaluationPeriods: 3 - Threshold: 1.0 - ComparisonOperator: 'GreaterThanThreshold' - DynamoDBGSISystemErrorAlarm: - Type: 'AWS::CloudWatch::Alarm' - Properties: - AlarmName: 'DynamoDBGSISystemErrorAlarm' - AlarmDescription: 'Alarm when GSI system errors exceed 2% of total number of requests for 15 minutes' - AlarmActions: - - !Ref DynamoDBMonitoringSNSTopic - Metrics: - - Id: 'e1' - Expression: 'm1/(m1+m2+m3)' - Label: GSISystemErrorsOverTotalRequests - - Id: 'm1' - MetricStat: - Metric: - Namespace: 'AWS/DynamoDB' - MetricName: 'SystemErrors' - Dimensions: - - Name: 'TableName' - Value: !Ref DynamoDBProvisionedTableName - - Name: 'GlobalSecondaryIndexName' - Value: !Join [ '-', [!Ref DynamoDBProvisionedTableName, 'gsi1'] ] - Period: 300 - Stat: 'SampleCount' - Unit: 'Count' - ReturnData: False - - Id: 'm2' - MetricStat: - Metric: - Namespace: 'AWS/DynamoDB' - MetricName: 'ConsumedReadCapacityUnits' - Dimensions: - - Name: 'TableName' - Value: !Ref DynamoDBProvisionedTableName - - Name: 'GlobalSecondaryIndexName' - Value: !Join [ '-', [!Ref DynamoDBProvisionedTableName, 'gsi1'] ] - Period: 300 - Stat: 'SampleCount' - Unit: 'Count' - ReturnData: False - - Id: 'm3' - MetricStat: - Metric: - Namespace: 'AWS/DynamoDB' - MetricName: 'ConsumedWriteCapacityUnits' - Dimensions: - - Name: 'TableName' - Value: !Ref DynamoDBProvisionedTableName - - Name: 'GlobalSecondaryIndexName' - Value: !Join [ '-', [!Ref DynamoDBProvisionedTableName, 'gsi1'] ] - Period: 300 - Stat: 'SampleCount' - Unit: 'Count' - ReturnData: False - EvaluationPeriods: 3 - Threshold: 1.0 - ComparisonOperator: 'GreaterThanThreshold' +When you create an alarm on the [SystemErrors](./metrics-dimensions.html#SystemErrors) metric, specify both the `TableName` and `Operation` dimensions (or `TableName` and `GlobalSecondaryIndexName` for a global secondary index). DynamoDB emits `SystemErrors` per operation, not on `TableName` alone, so an alarm that specifies only `TableName` stays in the `INSUFFICIENT_DATA` state and never alerts.