AWS support Incident Detection and Response - What is it? How does it work? | Amazon Web Services

Key Takeaways

In this video, you will learn what is AWS support incident detection and response IDR. You will understand how IDR works, what you need to do to take full advantage of IDR features. IDR is a way for customers to reduce their critical issue resolution time on AWS. With IDR, customers can get AWS support engineer help with a business critical issue within 5 minutes. Customers can even let the AWS support engineer know about their application and AWS services they use their application architecture ahead of time so less time is spent getting to know about applications and AWS services involved when the critical incident occurs. If you are new to IDR and have a critical issue or anytime you have a critical issue after you activate IDR on your account, you can use the manual action by opening a support case with IDR and get a 5 minute response time. Make sure to select incident detection and response service when you open the support case. Opening a support case is good, but to get most out of R, you want to share the context ahead of time. I will introduced to a new AWS support engineer called incident management engineer IME. IME is the key orchestrator of your IDR support cases. As you prepare ahead of time for the incidents, you want IDR team to know your application details, architecture, AWS services involved. This is what is called workload onboarding. IME takes that information and creates a runbook with that. Along with workload information, you also want to share the details of critical alarms that indicates the health of your workload. This is alarm onboarding. IME takes this information and creates a runbook that will be used when this critical alarm triggers. Providing application and alarm details ahead of time reduces the amount of time you need to spend explaining the issue, application nuances and alarms to AWS when a critical issue occurs. R and IME creates a runbook specifically for your alarm and workloads. So when a critical incident occurs, they can follow the runbook and get you to the root cause quickly. Along with sending the context to IDR for your critical alarms, you can also have AWS monitor for those alarms and response. IDR provides event bridgebased mechanism to send your critical alerts to AWS. To get full use of IDR, provide context by onboarding your workload and alarms. When the alarm triggers, send your alarms as an event with event bridge. Let's take a deeper look at how sending critical alarms on IDR works. Once you onboard your account to IDR, you will create an AM service linked role in your account. This role give permissions to the IDR service to create a rule on your event bridge. When you onboard an alarm, essentially asking IDR to start monitor for an alarm, IDR service creates a rule on your event bridge. Pay attention to the box in the bottom. That is the event bridge rule. This rule says if an event payload has a incident detection and response identifier in the detail section and if the detail type and the source exist, the event is an IDR alarm event. That event will be sent to IDR service. Let's see how this works for a cloudatch alarm. You asked IDR to monitor for a specific alarm. This is called alarm onboarding. IDR created a rule on event bridge with the pattern that we just saw. If an event matches the pattern, event will be sent to IDR. That is the trigger for the IDR. When a Cloudatch alarm gets triggered, the alarm details are available on the event bridge. Remember cloudatch alarm is an event generated within the AWS account and it is available in the event bridge. If the event rule matches the pattern that the event is sent to IDR notifying the IDR team that alarm is triggered for your application. IDR system uses this event message to find the right runbook for the specific alarms. IME use that runbook to provide you fast contextaware incident response. Now let's look at how sending the alarms to IDR works when you have an application performance monitoring such as data dog or pager duty etc. You still need to start with alarm on boarding that is sending the alarm details to IDR. IDR creates the rule on your event bridge. The next task is how do you send the alarm from APM to the event bridge so that the payload on the event matches the IDR rule so that the event will be sent to IDR. If an event matches the IDR rule, similar to the Cloudatch scenario, IDR system will map it to the right runbook and IMV will follow the runbook and will reach out to you and also start the investigation at the same time all within the 5 minute response time. The main part of IDR to APM integration is how do you send alarm event to the event bridge with the payload that matches the rule created by the IDR. There are number of ways you can do that. Depending on the APM in use, you can choose the option that fits better. We will go through three architecture patterns you can use to send APM alarms to IDR. Some of the SAS partners have Amazon event bridge integration. With this direct integration from the SAS partner to AWS event bridge, you don't have to do any manual steps. You can configure your SAS APM to send specific alarms to the partner event bus. Let's see how IDR works. When there is a SAS partner event bridge integration available from the APM alarm or event goes to SAS event bus, you still need to make sure event payload matches the IDR rule. You can use a lambda to change the event payload to match the IDR rule. When this rule gets triggered and the alarm is sent to IDR for APMS that do not have a direct bridge integration, let's look at how the you can send the event through the web hook. You can use API gateway to act as a web hook. Lambda here acts as authorizer. You still need to make sure the event payload matches the IDR rule. You can use a lambda to modify the event payload to match the IDR rule. When this modified payload is sent to the event bus, IDR rule gets triggered and the alarm is sent to IDR. If you have a self-managed APM on AWS account such as Graphana, you can use Amazon simple notification based pattern. You can configure APM in your AWS account to send specific alarms to SNS. You still use the lambda to modify the event payload to match the IDR rule. When this modified payload is sent to event bus, IDR rule gets triggered and alarm is sent to IDR. AWS provides architecture patterns and example lambdas in the IDR documentation. You can also use AWS IDR CLI to automate workload and alarm onboarding and IDR CLI can help you install the resources needed for APM integration. In this video, you have learned what is AWS support incident detection and response IDR. How IDR works. In summary, IDR provides 5 minute AWS support response time for your critical incidents. Utilize IDR and improve your issue issue resolution time with preparation. When you onboard workloads and alarms, IDR creates runbook specific to your applications and alarms for faster investigation. Automate AWS support engagement by sending your alarms to IDR. IDR system finds the right runbook for IME to provide you fast context aware incident response. Thank you for watching.