[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-aws-health-events":3,"mdc-v0hmeo-key":51,"related-org-aws-aws-health-events":2221,"related-repo-aws-aws-health-events":2396},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":46,"sourceUrl":49,"mdContent":50},"aws-health-events","analyze AWS Health events for incidents","ALWAYS use this skill in the beginning of any incident investigation, root cause analysis, or operational troubleshooting. This skill retrieves and analyzes AWS Health events (service issues, scheduled changes, and account notifications) to identify AWS-side events that may explain or correlate with observed operational issues. Activate this skill when investigating an issue and you observe service degradation, elevated error rates, latency spikes, connection failures, throttling, capacity issues, deployment-related failures, alarms, or any operational event or issue. This skill searches AWS Health events by service, time window, region, and status to surface active or recent service disruptions, scheduled maintenance, and account-specific notifications that inform the current investigation. Also activate when a user requests a health event summary or report for their account over a specified time period.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,21],{"name":13,"slug":14,"type":15},"Monitoring","monitoring","tag",{"name":17,"slug":18,"type":15},"Incident Response","incident-response",{"name":20,"slug":8,"type":15},"AWS",{"name":22,"slug":23,"type":15},"Debugging","debugging",35,"https:\u002F\u002Fgithub.com\u002Faws\u002Ftools-for-devops-agent","2026-08-20T03:53:41.178955",null,30,[30,31,32,33,34,8,35,36,37,38,39,40,18,41,42,43,44,45],"agent-skills","agentic-ai","agents","ai-agents","aiops","aws-devops-agent","cloud-operations","custom-agents","devops","devops-agent-skills","frontier-agent","operational-excellence","root-cause-analysis","skills","sre","support",{"repoUrl":25,"stars":24,"forks":28,"topics":47,"description":48},[30,31,32,33,34,8,35,36,37,38,39,40,18,41,42,43,44,45],"Open-source tools for AWS DevOps Agent - extend DevOps Agent with ready-to-use skills, custom agents, and other tools, for incident response, root cause analysis, and operational troubleshooting","https:\u002F\u002Fgithub.com\u002Faws\u002Ftools-for-devops-agent\u002Ftree\u002FHEAD\u002Fskills\u002Faws-health-events","---\nname: aws-health-events\ndescription: ALWAYS use this skill in the beginning of any incident investigation, root cause\n  analysis, or operational troubleshooting. This skill retrieves and analyzes\n  AWS Health events (service issues, scheduled changes, and account notifications)\n  to identify AWS-side events that may explain or correlate with observed\n  operational issues. Activate this skill when investigating an issue and you\n  observe service degradation, elevated error rates, latency spikes, connection\n  failures, throttling, capacity issues, deployment-related failures, alarms, or\n  any operational event or issue. This skill searches AWS Health events by\n  service, time window, region, and status to surface active or recent service\n  disruptions, scheduled maintenance, and account-specific notifications that\n  inform the current investigation. Also activate when a user requests a health\n  event summary or report for their account over a specified time period.\nmetadata:\n  author: udid-aws\n  version: \"1.0.0\"\n  aws-devops-agent-skills.agent-types: \"Chat tasks, Incident RCA\"\n  aws-devops-agent-skills.aws-services: \"AWS Health\"\n  aws-devops-agent-skills.technical-domains: \"Operations\"\n---\n\n# AWS Health Event Review\n\nUse this skill when investigating an incident and you need to check for AWS-side\nservice events that may be causing or contributing to the observed issue. Also\nuse this skill when a user requests a summary report of AWS Health events over a\nconfigurable time period.\n\n## When to Use This Skill\n\n**Incident Investigation (automatic activation):**\n\n- An active incident may be caused by an AWS service disruption or degradation.\n- You observe service degradation, elevated error rates, latency spikes,\n  connection failures, throttling, or capacity issues.\n- You need to determine whether an AWS-side event is the root cause or a\n  contributing factor to the current incident.\n- You want to correlate observed symptoms with known AWS Health events.\n\n**Chat Reporting (on-demand activation):**\n\n- A user requests a health event summary or report for their account.\n- A user wants to review the health posture of their AWS environment over a\n  specific time period.\n- A user asks about recent AWS service issues affecting their account or region.\n\n## Prerequisites\n\n- The account must have an **AWS Business Support+**, **Enterprise Support**, or\n  **Unified Operations** support plan to access the AWS Health API.\n- The agent must have permissions to call the following IAM actions:\n  - `health:DescribeEvents`\n  - `health:DescribeEventDetails`\n  - `health:DescribeAffectedEntities`\n  - `health:DescribeEventTypes`\n- The AWS Health API is only available in the **us-east-1** region. All API\n  calls must target the `us-east-1` endpoint regardless of where the affected\n  resources are located.\n- Health event data is available for up to 90 days. Events older than 90 days\n  cannot be retrieved via the API.\n\n---\n\n## Step 1: Gather Incident Context\n\nBefore searching Health events, extract key details from the current incident:\n\n1. **Affected AWS services** — identify the service(s) experiencing issues\n   (e.g., EC2, RDS, Lambda, ELB, ECS).\n2. **Timeframe** — determine when the incident started and its current duration.\n   Use ISO 8601 timestamps.\n3. **Affected resources** — collect specific resource identifiers (instance IDs,\n   ARNs, endpoint names, cluster names).\n4. **Region and availability zone** — identify the AWS region and, if known, the\n   specific availability zone(s) affected.\n5. **Symptoms** — note the observed symptoms (latency spikes, 5xx errors,\n   connection timeouts, throttling, capacity errors).\n\nUse these details as filter criteria in subsequent steps.\n\n---\n\n## Step 2: Search Health Events\n\nUse the AWS Health API `DescribeEvents` operation to retrieve events matching\nthe incident context. All calls must target the **us-east-1** endpoint.\n\n### API call pattern\n\n```\naws health describe-events \\\n  --region us-east-1 \\\n  --filter '{\n    \"services\": [\"\u003CSERVICE_CODE>\"],\n    \"startTimes\": [{\"from\": \"\u003CISO-8601-start>\"}],\n    \"regions\": [\"\u003Caffected-region>\"],\n    \"eventStatusCodes\": [\"open\", \"closed\"],\n    \"eventTypeCategories\": [\"issue\", \"scheduledChange\", \"accountNotification\"]\n  }' \\\n  --max-results 100\n```\n\n### Filtering strategies\n\n| Strategy | How to Apply |\n|----------|-------------|\n| By service | Use the `services` filter with the AWS Health service code (e.g., `EC2`, `RDS`, `ELASTICLOADBALANCING`), because service-specific events are most likely to correlate with the incident. |\n| By time range | Use `startTimes` with a `from` value set to 7 days before the incident start, because events that started before the incident may still be active and causing impact. |\n| By region | Use the `regions` filter to scope events to the affected region, because regional events are more likely to impact the specific resources under investigation. |\n| By availability zone | Use the `availabilityZones` filter when the incident is isolated to a specific AZ, because AZ-scoped events have the highest correlation with AZ-specific failures. |\n| By status | Include both `open` and `closed` statuses, because recently closed events may have caused residual impact that is still being observed. |\n| By event scope | Include both `ACCOUNT_SPECIFIC` and `PUBLIC` events, because public service events affect all accounts in the region while account-specific events target your resources directly. |\n\n### Pagination handling\n\n- Follow the `nextToken` from each response to retrieve subsequent pages.\n- Continue paginating until `nextToken` is null or a maximum of **500 events**\n  have been collected.\n- Set `maxResults` to 100 per page for efficient retrieval.\n\n---\n\n## Step 3: Filter Relevant Events\n\nBefore retrieving full event details, filter the events returned in Step 2 to\nidentify only those relevant to the current investigation. This avoids\nunnecessary `DescribeEventDetails` calls for events that are clearly unrelated.\n\n### Relevance filtering criteria\n\nEvaluate each event from the `DescribeEvents` response using these fields\n(available without calling `DescribeEventDetails`):\n\n| Field | Relevance Signal |\n|-------|-----------------|\n| `service` | Must match one of the affected services from the incident context, or a related service from the Service Dependency Map |\n| `eventTypeCategory` | Prioritize `issue` events for active incidents; include `scheduledChange` if the incident coincides with a maintenance window |\n| `eventTypeCode` | Match against known operational event patterns (e.g., `AWS_EC2_OPERATIONAL_ISSUE`, `AWS_RDS_MAINTENANCE`) |\n| `statusCode` | Prioritize `open` events; include `closed` only if the event ended within 2 hours of the incident start |\n| `startTime` \u002F `endTime` | The event's active period must overlap with the incident timeframe |\n| `region` \u002F `availabilityZone` | Must match the incident's affected region or AZ |\n\n### Filtering rules\n\n1. **Keep** events where the `service` matches an affected service or a related\n   service from the Service Dependency Map.\n2. **Keep** events where the active period (startTime to endTime, or to present\n   if open) overlaps with the incident timeframe.\n3. **Keep** events where the `region` or `availabilityZone` matches the\n   incident's affected region\u002FAZ.\n4. **Discard** `accountNotification` events unless the incident context\n   specifically suggests an account-level issue (e.g., abuse notification,\n   certificate expiry).\n5. **Discard** `closed` events that ended more than 2 hours before the incident\n   started (unlikely to be contributing).\n\n### Result\n\nAfter filtering, proceed to Step 4 only with the relevant subset of events.\nIf all events are filtered out, report that no relevant Health events were found\nand suggest alternative investigation paths (see Step 7).\n\n---\n\n## Step 4: Get Event Details\n\nFor each **relevant** event identified in Step 3, retrieve full descriptions\nand timelines using `DescribeEventDetails`.\n\n### API call pattern\n\n```\naws health describe-event-details \\\n  --region us-east-1 \\\n  --event-arns '[\"\u003Carn-1>\", \"\u003Carn-2>\", ..., \"\u003Carn-10>\"]'\n```\n\n### Batching rules\n\n- The API accepts a **maximum of 10 event ARNs per request**.\n- If more than 10 relevant events need details, issue multiple batched calls of\n  up to 10 ARNs each until all relevant events are detailed.\n\n### Extract from each event detail\n\n- **Event description** — the `latestDescription` text explaining the event.\n- **Timeline** — start time, end time (null if ongoing), last updated time.\n- **Status** — current status (open, closed, upcoming).\n- **Service and region** — confirm the affected service and region.\n- **Event type** — the category (issue, scheduledChange, accountNotification)\n  and specific type code.\n\n### Handling failedSet\n\n- The response contains a `successfulSet` and a `failedSet`.\n- If any event ARNs appear in `failedSet`, report the failed ARN and error\n  message to the operator.\n- Continue processing all events from `successfulSet` without blocking on\n  failures.\n\n---\n\n## Step 5: Identify Affected Entities\n\nFor events with `eventScopeCode` of **ACCOUNT_SPECIFIC**, retrieve the list of\naffected resources using `DescribeAffectedEntities`.\n\n> **Important**: Only call DescribeAffectedEntities for ACCOUNT_SPECIFIC events.\n> PUBLIC events do not return entity data.\n\n### API call pattern\n\n```\naws health describe-affected-entities \\\n  --region us-east-1 \\\n  --filter '{\"eventArns\": [\"\u003Cevent-arn>\"]}'\n  --max-results 100\n```\n\n### Entity matching\n\nWhen the incident context includes specific resource identifiers:\n\n1. Retrieve all affected entities for the event (paginate up to **500 entities**\n   per event using `nextToken`).\n2. Perform exact string matching of each entity's `entityValue` against the\n   incident context resource identifiers.\n3. Present matched entities in a separate section before non-matched entities.\n4. Include entity status (`IMPAIRED`, `UNIMPAIRED`, `UNKNOWN`, `PENDING`) and\n   last updated time for each entity.\n\n### Error handling\n\n- If `DescribeAffectedEntities` returns an error for a specific event ARN,\n  report the event ARN that failed and continue processing remaining events.\n\n---\n\n## Step 6: Correlate with Incident\n\nScore each Health event for relevance to the current incident using the\nfollowing criteria:\n\n### Relevance scoring\n\n| Classification | Criteria | Label |\n|---------------|----------|-------|\n| **High** | Matching service + overlapping timeframe + matching affected resource (or matching region\u002FAZ if no resource IDs available) | Likely contributing factor (if event is open) |\n| **Medium** | Matching service + overlapping timeframe (no resource match) | Likely contributing factor (if event is open) |\n| **Low** | Matching service only (no timeframe overlap) | Background context |\n\n### Scoring rules\n\n- **Service match**: The event's service code matches one of the affected\n  services from the incident context.\n- **Timeframe overlap**: The event's active period (start time through end time,\n  or through present if still open) intersects with the incident's timeframe\n  (start time through end time, or through present if ongoing).\n- **Region\u002FAZ match**: The event's region or availability zone matches the\n  incident's affected region or AZ.\n- **Resource match**: At least one affected entity's `entityValue` matches a\n  resource identifier from the incident context.\n\n### Contributing factor labeling\n\n- Any **open** event classified as High or Medium relevance SHALL be labeled as\n  a \"likely contributing factor\" in addition to its relevance classification.\n- Closed events with High relevance should be noted as potential recent causes\n  if the incident started shortly after the event closed.\n\n### When resource identifiers are unavailable\n\nIf the incident context does not include specific resource identifiers, score\nrelevance using only service, timeframe, and region\u002FAZ factors:\n\n- **High**: Matching service + overlapping timeframe + matching region or AZ\n- **Medium**: Matching service + overlapping timeframe\n- **Low**: Matching service only\n\n---\n\n## Step 7: Present Structured Output\n\nPresent findings in a clear, structured format organized for quick\ncomprehension and action.\n\n### Output structure\n\n1. **Summary** — total events found, broken down by category and status.\n2. **Correlated events** — grouped by event type category in this order:\n   - Issues (service disruptions) — present first\n   - Scheduled changes (maintenance) — present second\n   - Account notifications — present last\n3. **Within each group** — sort by:\n   - Relevance classification (High → Medium → Low)\n   - Then by start time descending (most recent first)\n4. **Per event** — include:\n   - Event type category and service\n   - Region and availability zone (if applicable)\n   - Status (open\u002Fclosed\u002Fupcoming)\n   - Start time and end time (ISO 8601)\n   - Description (summarized to 256 characters max)\n   - Relevance classification and matching criteria\n   - Contributing factor label (if applicable)\n5. **Actionable next steps** — for each correlated event, include at least one\n   recommendation such as:\n   - Check specific affected resources\n   - Review related service limits or quotas\n   - Verify recent configuration changes\n   - Monitor the AWS Health Dashboard for updates\n   - Contact AWS Support if the event is ongoing\n\n### When no events are found\n\nIf no relevant Health events are identified:\n\n- Explicitly state that no matching AWS Health events were found.\n- Confirm the search parameters used (service, time range, region).\n- Recommend checking other potential causes:\n  - Recent deployments or configuration changes\n  - Resource limits or quota exhaustion\n  - Network connectivity issues\n  - Application-level errors\n\n---\n\n## Decision Tree: Event Search Strategy\n\n```\nIs this a chat-based health report request?\n├── YES → Search the user-specified time period (default 30 days, max 90 days)\n│         Organize results by category, service, and status\n│         Present as a summary report\n└── NO → Continue with incident investigation flow below\n\nIs the affected AWS service known?\n├── YES → Search events for that service within the past 7 days\n│   ├── Events found → Proceed to Step 3 (Filter Relevant Events)\n│   └── No events found → Broaden to related services (see Service Dependency Map)\n│       ├── Events found → Proceed to Step 3\n│       └── No events found → Expand time window to 14 days and retry\n│           ├── Events found → Proceed to Step 3\n│           └── No events found → Report no events found, suggest other investigation paths\n└── NO → Search all services filtered by region and availability zone (past 7 days)\n    ├── Events found → Proceed to Step 3\n    └── No events found → Expand time window to 14 days\n        ├── Events found → Proceed to Step 3\n        └── No events found → Report no events found, suggest other investigation paths\n\nDoes the incident involve a specific availability zone?\n├── YES → Include the AZ filter in all searches above\n└── NO → Filter by region only\n```\n\n---\n\n## Service Dependency Map\n\nWhen the initial service-specific search returns no results, broaden the search\nto related services that share infrastructure dependencies:\n\n| Primary Service | Related Services to Check |\n|----------------|--------------------------|\n| ELB \u002F ALB \u002F NLB | EC2, VPC, Route 53 |\n| RDS | EC2, EBS |\n| ECS \u002F EKS | EC2, VPC, ELB |\n| Lambda | VPC, CloudWatch |\n| CloudFront | S3, Route 53 |\n| API Gateway | Lambda, VPC |\n| ElastiCache | EC2, VPC |\n| DynamoDB | VPC (if VPC endpoints used) |\n| S3 | CloudFront, VPC (if VPC endpoints used) |\n| Kinesis | EC2, VPC |\n\nSearch up to 3 related services when broadening. Use the Health API service\ncodes from the references document (e.g., `ELASTICLOADBALANCING` for ELB,\n`ROUTE53` for Route 53).\n\n---\n\n## Error Handling\n\n| Error Condition | Agent Behavior |\n|----------------|----------------|\n| Missing `health:Describe*` permissions | Report the missing permissions and specify the required IAM actions: `health:DescribeEvents`, `health:DescribeEventDetails`, `health:DescribeAffectedEntities`, `health:DescribeEventTypes`. Provide the IAM policy snippet needed. |\n| Throttling (HTTP 429) | Retry with exponential backoff: wait 1s → 2s → 4s (max 3 retries). If still throttled after 3 retries, report that the Health API is currently rate-limited and recommend trying again shortly. |\n| Service error (HTTP 5xx) | Report the error code and recommend the operator check the AWS Health Dashboard directly as a fallback. |\n| Timeout (30 seconds) | Cancel the request and report a timeout error. Suggest the operator check the Health Dashboard directly or retry with narrower filters. |\n| Zero events found | Report that no events matched the specified filters. Confirm the search parameters used. Suggest broadening the search or checking other investigation paths. |\n| Invalid time range (start > end) | Report the invalid time range error. Ask the operator to provide corrected timestamps. |\n| DescribeEventDetails failedSet | Report the failed event ARNs and error messages. Continue processing events from the successfulSet. |\n| DescribeAffectedEntities error | Report the event ARN for which entity retrieval failed. Continue processing remaining events. |\n| Unknown service name (chat report) | Inform the user the service was not recognized. List services that have events in the requested time period. |\n\n---\n\n## Tips for Effective Health Event Review\n\n- **Always check us-east-1**: The Health API endpoint is only in us-east-1,\n  regardless of where your resources are located.\n- **Start narrow, then broaden**: Begin with the specific affected service and\n  a 7-day window. Only expand if no results are found.\n- **Check both open and closed events**: A recently closed event may still be\n  causing residual impact.\n- **Correlate with support cases**: If a Health event references a service\n  disruption, check if related support cases exist using the support-cases skill.\n- **Account-specific vs public events**: Account-specific events directly affect\n  your resources. Public events are service-wide but may still impact you.\n- **Look at scheduled changes**: Upcoming or recent maintenance windows can\n  explain transient issues that resolve on their own.\n",{"data":52,"body":60},{"name":4,"description":6,"metadata":53},{"author":54,"version":55,"aws-devops-agent-skills":56},"udid-aws","1.0.0",{"agent-types":57,"aws-services":58,"technical-domains":59},"Chat tasks, Incident RCA","AWS Health","Operations",{"type":61,"children":62},"root",[63,72,78,85,94,119,127,145,151,249,253,259,264,318,323,326,332,351,358,370,376,572,578,626,629,635,648,654,673,856,862,946,952,957,960,966,985,990,999,1005,1024,1030,1091,1097,1144,1147,1153,1179,1193,1198,1207,1213,1218,1292,1298,1313,1316,1322,1327,1333,1422,1428,1478,1484,1503,1509,1514,1544,1547,1553,1558,1564,1714,1720,1725,1766,1769,1775,1784,1787,1793,1798,1948,1968,1971,1977,2149,2152,2158],{"type":64,"tag":65,"props":66,"children":68},"element","h1",{"id":67},"aws-health-event-review",[69],{"type":70,"value":71},"text","AWS Health Event Review",{"type":64,"tag":73,"props":74,"children":75},"p",{},[76],{"type":70,"value":77},"Use this skill when investigating an incident and you need to check for AWS-side\nservice events that may be causing or contributing to the observed issue. Also\nuse this skill when a user requests a summary report of AWS Health events over a\nconfigurable time period.",{"type":64,"tag":79,"props":80,"children":82},"h2",{"id":81},"when-to-use-this-skill",[83],{"type":70,"value":84},"When to Use This Skill",{"type":64,"tag":73,"props":86,"children":87},{},[88],{"type":64,"tag":89,"props":90,"children":91},"strong",{},[92],{"type":70,"value":93},"Incident Investigation (automatic activation):",{"type":64,"tag":95,"props":96,"children":97},"ul",{},[98,104,109,114],{"type":64,"tag":99,"props":100,"children":101},"li",{},[102],{"type":70,"value":103},"An active incident may be caused by an AWS service disruption or degradation.",{"type":64,"tag":99,"props":105,"children":106},{},[107],{"type":70,"value":108},"You observe service degradation, elevated error rates, latency spikes,\nconnection failures, throttling, or capacity issues.",{"type":64,"tag":99,"props":110,"children":111},{},[112],{"type":70,"value":113},"You need to determine whether an AWS-side event is the root cause or a\ncontributing factor to the current incident.",{"type":64,"tag":99,"props":115,"children":116},{},[117],{"type":70,"value":118},"You want to correlate observed symptoms with known AWS Health events.",{"type":64,"tag":73,"props":120,"children":121},{},[122],{"type":64,"tag":89,"props":123,"children":124},{},[125],{"type":70,"value":126},"Chat Reporting (on-demand activation):",{"type":64,"tag":95,"props":128,"children":129},{},[130,135,140],{"type":64,"tag":99,"props":131,"children":132},{},[133],{"type":70,"value":134},"A user requests a health event summary or report for their account.",{"type":64,"tag":99,"props":136,"children":137},{},[138],{"type":70,"value":139},"A user wants to review the health posture of their AWS environment over a\nspecific time period.",{"type":64,"tag":99,"props":141,"children":142},{},[143],{"type":70,"value":144},"A user asks about recent AWS service issues affecting their account or region.",{"type":64,"tag":79,"props":146,"children":148},{"id":147},"prerequisites",[149],{"type":70,"value":150},"Prerequisites",{"type":64,"tag":95,"props":152,"children":153},{},[154,180,225,244],{"type":64,"tag":99,"props":155,"children":156},{},[157,159,164,166,171,173,178],{"type":70,"value":158},"The account must have an ",{"type":64,"tag":89,"props":160,"children":161},{},[162],{"type":70,"value":163},"AWS Business Support+",{"type":70,"value":165},", ",{"type":64,"tag":89,"props":167,"children":168},{},[169],{"type":70,"value":170},"Enterprise Support",{"type":70,"value":172},", or\n",{"type":64,"tag":89,"props":174,"children":175},{},[176],{"type":70,"value":177},"Unified Operations",{"type":70,"value":179}," support plan to access the AWS Health API.",{"type":64,"tag":99,"props":181,"children":182},{},[183,185],{"type":70,"value":184},"The agent must have permissions to call the following IAM actions:\n",{"type":64,"tag":95,"props":186,"children":187},{},[188,198,207,216],{"type":64,"tag":99,"props":189,"children":190},{},[191],{"type":64,"tag":192,"props":193,"children":195},"code",{"className":194},[],[196],{"type":70,"value":197},"health:DescribeEvents",{"type":64,"tag":99,"props":199,"children":200},{},[201],{"type":64,"tag":192,"props":202,"children":204},{"className":203},[],[205],{"type":70,"value":206},"health:DescribeEventDetails",{"type":64,"tag":99,"props":208,"children":209},{},[210],{"type":64,"tag":192,"props":211,"children":213},{"className":212},[],[214],{"type":70,"value":215},"health:DescribeAffectedEntities",{"type":64,"tag":99,"props":217,"children":218},{},[219],{"type":64,"tag":192,"props":220,"children":222},{"className":221},[],[223],{"type":70,"value":224},"health:DescribeEventTypes",{"type":64,"tag":99,"props":226,"children":227},{},[228,230,235,237,242],{"type":70,"value":229},"The AWS Health API is only available in the ",{"type":64,"tag":89,"props":231,"children":232},{},[233],{"type":70,"value":234},"us-east-1",{"type":70,"value":236}," region. All API\ncalls must target the ",{"type":64,"tag":192,"props":238,"children":240},{"className":239},[],[241],{"type":70,"value":234},{"type":70,"value":243}," endpoint regardless of where the affected\nresources are located.",{"type":64,"tag":99,"props":245,"children":246},{},[247],{"type":70,"value":248},"Health event data is available for up to 90 days. Events older than 90 days\ncannot be retrieved via the API.",{"type":64,"tag":250,"props":251,"children":252},"hr",{},[],{"type":64,"tag":79,"props":254,"children":256},{"id":255},"step-1-gather-incident-context",[257],{"type":70,"value":258},"Step 1: Gather Incident Context",{"type":64,"tag":73,"props":260,"children":261},{},[262],{"type":70,"value":263},"Before searching Health events, extract key details from the current incident:",{"type":64,"tag":265,"props":266,"children":267},"ol",{},[268,278,288,298,308],{"type":64,"tag":99,"props":269,"children":270},{},[271,276],{"type":64,"tag":89,"props":272,"children":273},{},[274],{"type":70,"value":275},"Affected AWS services",{"type":70,"value":277}," — identify the service(s) experiencing issues\n(e.g., EC2, RDS, Lambda, ELB, ECS).",{"type":64,"tag":99,"props":279,"children":280},{},[281,286],{"type":64,"tag":89,"props":282,"children":283},{},[284],{"type":70,"value":285},"Timeframe",{"type":70,"value":287}," — determine when the incident started and its current duration.\nUse ISO 8601 timestamps.",{"type":64,"tag":99,"props":289,"children":290},{},[291,296],{"type":64,"tag":89,"props":292,"children":293},{},[294],{"type":70,"value":295},"Affected resources",{"type":70,"value":297}," — collect specific resource identifiers (instance IDs,\nARNs, endpoint names, cluster names).",{"type":64,"tag":99,"props":299,"children":300},{},[301,306],{"type":64,"tag":89,"props":302,"children":303},{},[304],{"type":70,"value":305},"Region and availability zone",{"type":70,"value":307}," — identify the AWS region and, if known, the\nspecific availability zone(s) affected.",{"type":64,"tag":99,"props":309,"children":310},{},[311,316],{"type":64,"tag":89,"props":312,"children":313},{},[314],{"type":70,"value":315},"Symptoms",{"type":70,"value":317}," — note the observed symptoms (latency spikes, 5xx errors,\nconnection timeouts, throttling, capacity errors).",{"type":64,"tag":73,"props":319,"children":320},{},[321],{"type":70,"value":322},"Use these details as filter criteria in subsequent steps.",{"type":64,"tag":250,"props":324,"children":325},{},[],{"type":64,"tag":79,"props":327,"children":329},{"id":328},"step-2-search-health-events",[330],{"type":70,"value":331},"Step 2: Search Health Events",{"type":64,"tag":73,"props":333,"children":334},{},[335,337,343,345,349],{"type":70,"value":336},"Use the AWS Health API ",{"type":64,"tag":192,"props":338,"children":340},{"className":339},[],[341],{"type":70,"value":342},"DescribeEvents",{"type":70,"value":344}," operation to retrieve events matching\nthe incident context. All calls must target the ",{"type":64,"tag":89,"props":346,"children":347},{},[348],{"type":70,"value":234},{"type":70,"value":350}," endpoint.",{"type":64,"tag":352,"props":353,"children":355},"h3",{"id":354},"api-call-pattern",[356],{"type":70,"value":357},"API call pattern",{"type":64,"tag":359,"props":360,"children":364},"pre",{"className":361,"code":363,"language":70},[362],"language-text","aws health describe-events \\\n  --region us-east-1 \\\n  --filter '{\n    \"services\": [\"\u003CSERVICE_CODE>\"],\n    \"startTimes\": [{\"from\": \"\u003CISO-8601-start>\"}],\n    \"regions\": [\"\u003Caffected-region>\"],\n    \"eventStatusCodes\": [\"open\", \"closed\"],\n    \"eventTypeCategories\": [\"issue\", \"scheduledChange\", \"accountNotification\"]\n  }' \\\n  --max-results 100\n",[365],{"type":64,"tag":192,"props":366,"children":368},{"__ignoreMap":367},"",[369],{"type":70,"value":363},{"type":64,"tag":352,"props":371,"children":373},{"id":372},"filtering-strategies",[374],{"type":70,"value":375},"Filtering strategies",{"type":64,"tag":377,"props":378,"children":379},"table",{},[380,399],{"type":64,"tag":381,"props":382,"children":383},"thead",{},[384],{"type":64,"tag":385,"props":386,"children":387},"tr",{},[388,394],{"type":64,"tag":389,"props":390,"children":391},"th",{},[392],{"type":70,"value":393},"Strategy",{"type":64,"tag":389,"props":395,"children":396},{},[397],{"type":70,"value":398},"How to Apply",{"type":64,"tag":400,"props":401,"children":402},"tbody",{},[403,447,476,496,516,545],{"type":64,"tag":385,"props":404,"children":405},{},[406,412],{"type":64,"tag":407,"props":408,"children":409},"td",{},[410],{"type":70,"value":411},"By service",{"type":64,"tag":407,"props":413,"children":414},{},[415,417,423,425,431,432,438,439,445],{"type":70,"value":416},"Use the ",{"type":64,"tag":192,"props":418,"children":420},{"className":419},[],[421],{"type":70,"value":422},"services",{"type":70,"value":424}," filter with the AWS Health service code (e.g., ",{"type":64,"tag":192,"props":426,"children":428},{"className":427},[],[429],{"type":70,"value":430},"EC2",{"type":70,"value":165},{"type":64,"tag":192,"props":433,"children":435},{"className":434},[],[436],{"type":70,"value":437},"RDS",{"type":70,"value":165},{"type":64,"tag":192,"props":440,"children":442},{"className":441},[],[443],{"type":70,"value":444},"ELASTICLOADBALANCING",{"type":70,"value":446},"), because service-specific events are most likely to correlate with the incident.",{"type":64,"tag":385,"props":448,"children":449},{},[450,455],{"type":64,"tag":407,"props":451,"children":452},{},[453],{"type":70,"value":454},"By time range",{"type":64,"tag":407,"props":456,"children":457},{},[458,460,466,468,474],{"type":70,"value":459},"Use ",{"type":64,"tag":192,"props":461,"children":463},{"className":462},[],[464],{"type":70,"value":465},"startTimes",{"type":70,"value":467}," with a ",{"type":64,"tag":192,"props":469,"children":471},{"className":470},[],[472],{"type":70,"value":473},"from",{"type":70,"value":475}," value set to 7 days before the incident start, because events that started before the incident may still be active and causing impact.",{"type":64,"tag":385,"props":477,"children":478},{},[479,484],{"type":64,"tag":407,"props":480,"children":481},{},[482],{"type":70,"value":483},"By region",{"type":64,"tag":407,"props":485,"children":486},{},[487,488,494],{"type":70,"value":416},{"type":64,"tag":192,"props":489,"children":491},{"className":490},[],[492],{"type":70,"value":493},"regions",{"type":70,"value":495}," filter to scope events to the affected region, because regional events are more likely to impact the specific resources under investigation.",{"type":64,"tag":385,"props":497,"children":498},{},[499,504],{"type":64,"tag":407,"props":500,"children":501},{},[502],{"type":70,"value":503},"By availability zone",{"type":64,"tag":407,"props":505,"children":506},{},[507,508,514],{"type":70,"value":416},{"type":64,"tag":192,"props":509,"children":511},{"className":510},[],[512],{"type":70,"value":513},"availabilityZones",{"type":70,"value":515}," filter when the incident is isolated to a specific AZ, because AZ-scoped events have the highest correlation with AZ-specific failures.",{"type":64,"tag":385,"props":517,"children":518},{},[519,524],{"type":64,"tag":407,"props":520,"children":521},{},[522],{"type":70,"value":523},"By status",{"type":64,"tag":407,"props":525,"children":526},{},[527,529,535,537,543],{"type":70,"value":528},"Include both ",{"type":64,"tag":192,"props":530,"children":532},{"className":531},[],[533],{"type":70,"value":534},"open",{"type":70,"value":536}," and ",{"type":64,"tag":192,"props":538,"children":540},{"className":539},[],[541],{"type":70,"value":542},"closed",{"type":70,"value":544}," statuses, because recently closed events may have caused residual impact that is still being observed.",{"type":64,"tag":385,"props":546,"children":547},{},[548,553],{"type":64,"tag":407,"props":549,"children":550},{},[551],{"type":70,"value":552},"By event scope",{"type":64,"tag":407,"props":554,"children":555},{},[556,557,563,564,570],{"type":70,"value":528},{"type":64,"tag":192,"props":558,"children":560},{"className":559},[],[561],{"type":70,"value":562},"ACCOUNT_SPECIFIC",{"type":70,"value":536},{"type":64,"tag":192,"props":565,"children":567},{"className":566},[],[568],{"type":70,"value":569},"PUBLIC",{"type":70,"value":571}," events, because public service events affect all accounts in the region while account-specific events target your resources directly.",{"type":64,"tag":352,"props":573,"children":575},{"id":574},"pagination-handling",[576],{"type":70,"value":577},"Pagination handling",{"type":64,"tag":95,"props":579,"children":580},{},[581,594,613],{"type":64,"tag":99,"props":582,"children":583},{},[584,586,592],{"type":70,"value":585},"Follow the ",{"type":64,"tag":192,"props":587,"children":589},{"className":588},[],[590],{"type":70,"value":591},"nextToken",{"type":70,"value":593}," from each response to retrieve subsequent pages.",{"type":64,"tag":99,"props":595,"children":596},{},[597,599,604,606,611],{"type":70,"value":598},"Continue paginating until ",{"type":64,"tag":192,"props":600,"children":602},{"className":601},[],[603],{"type":70,"value":591},{"type":70,"value":605}," is null or a maximum of ",{"type":64,"tag":89,"props":607,"children":608},{},[609],{"type":70,"value":610},"500 events",{"type":70,"value":612},"\nhave been collected.",{"type":64,"tag":99,"props":614,"children":615},{},[616,618,624],{"type":70,"value":617},"Set ",{"type":64,"tag":192,"props":619,"children":621},{"className":620},[],[622],{"type":70,"value":623},"maxResults",{"type":70,"value":625}," to 100 per page for efficient retrieval.",{"type":64,"tag":250,"props":627,"children":628},{},[],{"type":64,"tag":79,"props":630,"children":632},{"id":631},"step-3-filter-relevant-events",[633],{"type":70,"value":634},"Step 3: Filter Relevant Events",{"type":64,"tag":73,"props":636,"children":637},{},[638,640,646],{"type":70,"value":639},"Before retrieving full event details, filter the events returned in Step 2 to\nidentify only those relevant to the current investigation. This avoids\nunnecessary ",{"type":64,"tag":192,"props":641,"children":643},{"className":642},[],[644],{"type":70,"value":645},"DescribeEventDetails",{"type":70,"value":647}," calls for events that are clearly unrelated.",{"type":64,"tag":352,"props":649,"children":651},{"id":650},"relevance-filtering-criteria",[652],{"type":70,"value":653},"Relevance filtering criteria",{"type":64,"tag":73,"props":655,"children":656},{},[657,659,664,666,671],{"type":70,"value":658},"Evaluate each event from the ",{"type":64,"tag":192,"props":660,"children":662},{"className":661},[],[663],{"type":70,"value":342},{"type":70,"value":665}," response using these fields\n(available without calling ",{"type":64,"tag":192,"props":667,"children":669},{"className":668},[],[670],{"type":70,"value":645},{"type":70,"value":672},"):",{"type":64,"tag":377,"props":674,"children":675},{},[676,692],{"type":64,"tag":381,"props":677,"children":678},{},[679],{"type":64,"tag":385,"props":680,"children":681},{},[682,687],{"type":64,"tag":389,"props":683,"children":684},{},[685],{"type":70,"value":686},"Field",{"type":64,"tag":389,"props":688,"children":689},{},[690],{"type":70,"value":691},"Relevance Signal",{"type":64,"tag":400,"props":693,"children":694},{},[695,712,745,777,807,832],{"type":64,"tag":385,"props":696,"children":697},{},[698,707],{"type":64,"tag":407,"props":699,"children":700},{},[701],{"type":64,"tag":192,"props":702,"children":704},{"className":703},[],[705],{"type":70,"value":706},"service",{"type":64,"tag":407,"props":708,"children":709},{},[710],{"type":70,"value":711},"Must match one of the affected services from the incident context, or a related service from the Service Dependency Map",{"type":64,"tag":385,"props":713,"children":714},{},[715,724],{"type":64,"tag":407,"props":716,"children":717},{},[718],{"type":64,"tag":192,"props":719,"children":721},{"className":720},[],[722],{"type":70,"value":723},"eventTypeCategory",{"type":64,"tag":407,"props":725,"children":726},{},[727,729,735,737,743],{"type":70,"value":728},"Prioritize ",{"type":64,"tag":192,"props":730,"children":732},{"className":731},[],[733],{"type":70,"value":734},"issue",{"type":70,"value":736}," events for active incidents; include ",{"type":64,"tag":192,"props":738,"children":740},{"className":739},[],[741],{"type":70,"value":742},"scheduledChange",{"type":70,"value":744}," if the incident coincides with a maintenance window",{"type":64,"tag":385,"props":746,"children":747},{},[748,757],{"type":64,"tag":407,"props":749,"children":750},{},[751],{"type":64,"tag":192,"props":752,"children":754},{"className":753},[],[755],{"type":70,"value":756},"eventTypeCode",{"type":64,"tag":407,"props":758,"children":759},{},[760,762,768,769,775],{"type":70,"value":761},"Match against known operational event patterns (e.g., ",{"type":64,"tag":192,"props":763,"children":765},{"className":764},[],[766],{"type":70,"value":767},"AWS_EC2_OPERATIONAL_ISSUE",{"type":70,"value":165},{"type":64,"tag":192,"props":770,"children":772},{"className":771},[],[773],{"type":70,"value":774},"AWS_RDS_MAINTENANCE",{"type":70,"value":776},")",{"type":64,"tag":385,"props":778,"children":779},{},[780,789],{"type":64,"tag":407,"props":781,"children":782},{},[783],{"type":64,"tag":192,"props":784,"children":786},{"className":785},[],[787],{"type":70,"value":788},"statusCode",{"type":64,"tag":407,"props":790,"children":791},{},[792,793,798,800,805],{"type":70,"value":728},{"type":64,"tag":192,"props":794,"children":796},{"className":795},[],[797],{"type":70,"value":534},{"type":70,"value":799}," events; include ",{"type":64,"tag":192,"props":801,"children":803},{"className":802},[],[804],{"type":70,"value":542},{"type":70,"value":806}," only if the event ended within 2 hours of the incident start",{"type":64,"tag":385,"props":808,"children":809},{},[810,827],{"type":64,"tag":407,"props":811,"children":812},{},[813,819,821],{"type":64,"tag":192,"props":814,"children":816},{"className":815},[],[817],{"type":70,"value":818},"startTime",{"type":70,"value":820}," \u002F ",{"type":64,"tag":192,"props":822,"children":824},{"className":823},[],[825],{"type":70,"value":826},"endTime",{"type":64,"tag":407,"props":828,"children":829},{},[830],{"type":70,"value":831},"The event's active period must overlap with the incident timeframe",{"type":64,"tag":385,"props":833,"children":834},{},[835,851],{"type":64,"tag":407,"props":836,"children":837},{},[838,844,845],{"type":64,"tag":192,"props":839,"children":841},{"className":840},[],[842],{"type":70,"value":843},"region",{"type":70,"value":820},{"type":64,"tag":192,"props":846,"children":848},{"className":847},[],[849],{"type":70,"value":850},"availabilityZone",{"type":64,"tag":407,"props":852,"children":853},{},[854],{"type":70,"value":855},"Must match the incident's affected region or AZ",{"type":64,"tag":352,"props":857,"children":859},{"id":858},"filtering-rules",[860],{"type":70,"value":861},"Filtering rules",{"type":64,"tag":265,"props":863,"children":864},{},[865,882,891,913,931],{"type":64,"tag":99,"props":866,"children":867},{},[868,873,875,880],{"type":64,"tag":89,"props":869,"children":870},{},[871],{"type":70,"value":872},"Keep",{"type":70,"value":874}," events where the ",{"type":64,"tag":192,"props":876,"children":878},{"className":877},[],[879],{"type":70,"value":706},{"type":70,"value":881}," matches an affected service or a related\nservice from the Service Dependency Map.",{"type":64,"tag":99,"props":883,"children":884},{},[885,889],{"type":64,"tag":89,"props":886,"children":887},{},[888],{"type":70,"value":872},{"type":70,"value":890}," events where the active period (startTime to endTime, or to present\nif open) overlaps with the incident timeframe.",{"type":64,"tag":99,"props":892,"children":893},{},[894,898,899,904,906,911],{"type":64,"tag":89,"props":895,"children":896},{},[897],{"type":70,"value":872},{"type":70,"value":874},{"type":64,"tag":192,"props":900,"children":902},{"className":901},[],[903],{"type":70,"value":843},{"type":70,"value":905}," or ",{"type":64,"tag":192,"props":907,"children":909},{"className":908},[],[910],{"type":70,"value":850},{"type":70,"value":912}," matches the\nincident's affected region\u002FAZ.",{"type":64,"tag":99,"props":914,"children":915},{},[916,921,923,929],{"type":64,"tag":89,"props":917,"children":918},{},[919],{"type":70,"value":920},"Discard",{"type":70,"value":922}," ",{"type":64,"tag":192,"props":924,"children":926},{"className":925},[],[927],{"type":70,"value":928},"accountNotification",{"type":70,"value":930}," events unless the incident context\nspecifically suggests an account-level issue (e.g., abuse notification,\ncertificate expiry).",{"type":64,"tag":99,"props":932,"children":933},{},[934,938,939,944],{"type":64,"tag":89,"props":935,"children":936},{},[937],{"type":70,"value":920},{"type":70,"value":922},{"type":64,"tag":192,"props":940,"children":942},{"className":941},[],[943],{"type":70,"value":542},{"type":70,"value":945}," events that ended more than 2 hours before the incident\nstarted (unlikely to be contributing).",{"type":64,"tag":352,"props":947,"children":949},{"id":948},"result",[950],{"type":70,"value":951},"Result",{"type":64,"tag":73,"props":953,"children":954},{},[955],{"type":70,"value":956},"After filtering, proceed to Step 4 only with the relevant subset of events.\nIf all events are filtered out, report that no relevant Health events were found\nand suggest alternative investigation paths (see Step 7).",{"type":64,"tag":250,"props":958,"children":959},{},[],{"type":64,"tag":79,"props":961,"children":963},{"id":962},"step-4-get-event-details",[964],{"type":70,"value":965},"Step 4: Get Event Details",{"type":64,"tag":73,"props":967,"children":968},{},[969,971,976,978,983],{"type":70,"value":970},"For each ",{"type":64,"tag":89,"props":972,"children":973},{},[974],{"type":70,"value":975},"relevant",{"type":70,"value":977}," event identified in Step 3, retrieve full descriptions\nand timelines using ",{"type":64,"tag":192,"props":979,"children":981},{"className":980},[],[982],{"type":70,"value":645},{"type":70,"value":984},".",{"type":64,"tag":352,"props":986,"children":988},{"id":987},"api-call-pattern-1",[989],{"type":70,"value":357},{"type":64,"tag":359,"props":991,"children":994},{"className":992,"code":993,"language":70},[362],"aws health describe-event-details \\\n  --region us-east-1 \\\n  --event-arns '[\"\u003Carn-1>\", \"\u003Carn-2>\", ..., \"\u003Carn-10>\"]'\n",[995],{"type":64,"tag":192,"props":996,"children":997},{"__ignoreMap":367},[998],{"type":70,"value":993},{"type":64,"tag":352,"props":1000,"children":1002},{"id":1001},"batching-rules",[1003],{"type":70,"value":1004},"Batching rules",{"type":64,"tag":95,"props":1006,"children":1007},{},[1008,1019],{"type":64,"tag":99,"props":1009,"children":1010},{},[1011,1013,1018],{"type":70,"value":1012},"The API accepts a ",{"type":64,"tag":89,"props":1014,"children":1015},{},[1016],{"type":70,"value":1017},"maximum of 10 event ARNs per request",{"type":70,"value":984},{"type":64,"tag":99,"props":1020,"children":1021},{},[1022],{"type":70,"value":1023},"If more than 10 relevant events need details, issue multiple batched calls of\nup to 10 ARNs each until all relevant events are detailed.",{"type":64,"tag":352,"props":1025,"children":1027},{"id":1026},"extract-from-each-event-detail",[1028],{"type":70,"value":1029},"Extract from each event detail",{"type":64,"tag":95,"props":1031,"children":1032},{},[1033,1051,1061,1071,1081],{"type":64,"tag":99,"props":1034,"children":1035},{},[1036,1041,1043,1049],{"type":64,"tag":89,"props":1037,"children":1038},{},[1039],{"type":70,"value":1040},"Event description",{"type":70,"value":1042}," — the ",{"type":64,"tag":192,"props":1044,"children":1046},{"className":1045},[],[1047],{"type":70,"value":1048},"latestDescription",{"type":70,"value":1050}," text explaining the event.",{"type":64,"tag":99,"props":1052,"children":1053},{},[1054,1059],{"type":64,"tag":89,"props":1055,"children":1056},{},[1057],{"type":70,"value":1058},"Timeline",{"type":70,"value":1060}," — start time, end time (null if ongoing), last updated time.",{"type":64,"tag":99,"props":1062,"children":1063},{},[1064,1069],{"type":64,"tag":89,"props":1065,"children":1066},{},[1067],{"type":70,"value":1068},"Status",{"type":70,"value":1070}," — current status (open, closed, upcoming).",{"type":64,"tag":99,"props":1072,"children":1073},{},[1074,1079],{"type":64,"tag":89,"props":1075,"children":1076},{},[1077],{"type":70,"value":1078},"Service and region",{"type":70,"value":1080}," — confirm the affected service and region.",{"type":64,"tag":99,"props":1082,"children":1083},{},[1084,1089],{"type":64,"tag":89,"props":1085,"children":1086},{},[1087],{"type":70,"value":1088},"Event type",{"type":70,"value":1090}," — the category (issue, scheduledChange, accountNotification)\nand specific type code.",{"type":64,"tag":352,"props":1092,"children":1094},{"id":1093},"handling-failedset",[1095],{"type":70,"value":1096},"Handling failedSet",{"type":64,"tag":95,"props":1098,"children":1099},{},[1100,1120,1132],{"type":64,"tag":99,"props":1101,"children":1102},{},[1103,1105,1111,1113,1119],{"type":70,"value":1104},"The response contains a ",{"type":64,"tag":192,"props":1106,"children":1108},{"className":1107},[],[1109],{"type":70,"value":1110},"successfulSet",{"type":70,"value":1112}," and a ",{"type":64,"tag":192,"props":1114,"children":1116},{"className":1115},[],[1117],{"type":70,"value":1118},"failedSet",{"type":70,"value":984},{"type":64,"tag":99,"props":1121,"children":1122},{},[1123,1125,1130],{"type":70,"value":1124},"If any event ARNs appear in ",{"type":64,"tag":192,"props":1126,"children":1128},{"className":1127},[],[1129],{"type":70,"value":1118},{"type":70,"value":1131},", report the failed ARN and error\nmessage to the operator.",{"type":64,"tag":99,"props":1133,"children":1134},{},[1135,1137,1142],{"type":70,"value":1136},"Continue processing all events from ",{"type":64,"tag":192,"props":1138,"children":1140},{"className":1139},[],[1141],{"type":70,"value":1110},{"type":70,"value":1143}," without blocking on\nfailures.",{"type":64,"tag":250,"props":1145,"children":1146},{},[],{"type":64,"tag":79,"props":1148,"children":1150},{"id":1149},"step-5-identify-affected-entities",[1151],{"type":70,"value":1152},"Step 5: Identify Affected Entities",{"type":64,"tag":73,"props":1154,"children":1155},{},[1156,1158,1164,1166,1170,1172,1178],{"type":70,"value":1157},"For events with ",{"type":64,"tag":192,"props":1159,"children":1161},{"className":1160},[],[1162],{"type":70,"value":1163},"eventScopeCode",{"type":70,"value":1165}," of ",{"type":64,"tag":89,"props":1167,"children":1168},{},[1169],{"type":70,"value":562},{"type":70,"value":1171},", retrieve the list of\naffected resources using ",{"type":64,"tag":192,"props":1173,"children":1175},{"className":1174},[],[1176],{"type":70,"value":1177},"DescribeAffectedEntities",{"type":70,"value":984},{"type":64,"tag":1180,"props":1181,"children":1182},"blockquote",{},[1183],{"type":64,"tag":73,"props":1184,"children":1185},{},[1186,1191],{"type":64,"tag":89,"props":1187,"children":1188},{},[1189],{"type":70,"value":1190},"Important",{"type":70,"value":1192},": Only call DescribeAffectedEntities for ACCOUNT_SPECIFIC events.\nPUBLIC events do not return entity data.",{"type":64,"tag":352,"props":1194,"children":1196},{"id":1195},"api-call-pattern-2",[1197],{"type":70,"value":357},{"type":64,"tag":359,"props":1199,"children":1202},{"className":1200,"code":1201,"language":70},[362],"aws health describe-affected-entities \\\n  --region us-east-1 \\\n  --filter '{\"eventArns\": [\"\u003Cevent-arn>\"]}'\n  --max-results 100\n",[1203],{"type":64,"tag":192,"props":1204,"children":1205},{"__ignoreMap":367},[1206],{"type":70,"value":1201},{"type":64,"tag":352,"props":1208,"children":1210},{"id":1209},"entity-matching",[1211],{"type":70,"value":1212},"Entity matching",{"type":64,"tag":73,"props":1214,"children":1215},{},[1216],{"type":70,"value":1217},"When the incident context includes specific resource identifiers:",{"type":64,"tag":265,"props":1219,"children":1220},{},[1221,1240,1253,1258],{"type":64,"tag":99,"props":1222,"children":1223},{},[1224,1226,1231,1233,1238],{"type":70,"value":1225},"Retrieve all affected entities for the event (paginate up to ",{"type":64,"tag":89,"props":1227,"children":1228},{},[1229],{"type":70,"value":1230},"500 entities",{"type":70,"value":1232},"\nper event using ",{"type":64,"tag":192,"props":1234,"children":1236},{"className":1235},[],[1237],{"type":70,"value":591},{"type":70,"value":1239},").",{"type":64,"tag":99,"props":1241,"children":1242},{},[1243,1245,1251],{"type":70,"value":1244},"Perform exact string matching of each entity's ",{"type":64,"tag":192,"props":1246,"children":1248},{"className":1247},[],[1249],{"type":70,"value":1250},"entityValue",{"type":70,"value":1252}," against the\nincident context resource identifiers.",{"type":64,"tag":99,"props":1254,"children":1255},{},[1256],{"type":70,"value":1257},"Present matched entities in a separate section before non-matched entities.",{"type":64,"tag":99,"props":1259,"children":1260},{},[1261,1263,1269,1270,1276,1277,1283,1284,1290],{"type":70,"value":1262},"Include entity status (",{"type":64,"tag":192,"props":1264,"children":1266},{"className":1265},[],[1267],{"type":70,"value":1268},"IMPAIRED",{"type":70,"value":165},{"type":64,"tag":192,"props":1271,"children":1273},{"className":1272},[],[1274],{"type":70,"value":1275},"UNIMPAIRED",{"type":70,"value":165},{"type":64,"tag":192,"props":1278,"children":1280},{"className":1279},[],[1281],{"type":70,"value":1282},"UNKNOWN",{"type":70,"value":165},{"type":64,"tag":192,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":70,"value":1289},"PENDING",{"type":70,"value":1291},") and\nlast updated time for each entity.",{"type":64,"tag":352,"props":1293,"children":1295},{"id":1294},"error-handling",[1296],{"type":70,"value":1297},"Error handling",{"type":64,"tag":95,"props":1299,"children":1300},{},[1301],{"type":64,"tag":99,"props":1302,"children":1303},{},[1304,1306,1311],{"type":70,"value":1305},"If ",{"type":64,"tag":192,"props":1307,"children":1309},{"className":1308},[],[1310],{"type":70,"value":1177},{"type":70,"value":1312}," returns an error for a specific event ARN,\nreport the event ARN that failed and continue processing remaining events.",{"type":64,"tag":250,"props":1314,"children":1315},{},[],{"type":64,"tag":79,"props":1317,"children":1319},{"id":1318},"step-6-correlate-with-incident",[1320],{"type":70,"value":1321},"Step 6: Correlate with Incident",{"type":64,"tag":73,"props":1323,"children":1324},{},[1325],{"type":70,"value":1326},"Score each Health event for relevance to the current incident using the\nfollowing criteria:",{"type":64,"tag":352,"props":1328,"children":1330},{"id":1329},"relevance-scoring",[1331],{"type":70,"value":1332},"Relevance scoring",{"type":64,"tag":377,"props":1334,"children":1335},{},[1336,1357],{"type":64,"tag":381,"props":1337,"children":1338},{},[1339],{"type":64,"tag":385,"props":1340,"children":1341},{},[1342,1347,1352],{"type":64,"tag":389,"props":1343,"children":1344},{},[1345],{"type":70,"value":1346},"Classification",{"type":64,"tag":389,"props":1348,"children":1349},{},[1350],{"type":70,"value":1351},"Criteria",{"type":64,"tag":389,"props":1353,"children":1354},{},[1355],{"type":70,"value":1356},"Label",{"type":64,"tag":400,"props":1358,"children":1359},{},[1360,1381,1401],{"type":64,"tag":385,"props":1361,"children":1362},{},[1363,1371,1376],{"type":64,"tag":407,"props":1364,"children":1365},{},[1366],{"type":64,"tag":89,"props":1367,"children":1368},{},[1369],{"type":70,"value":1370},"High",{"type":64,"tag":407,"props":1372,"children":1373},{},[1374],{"type":70,"value":1375},"Matching service + overlapping timeframe + matching affected resource (or matching region\u002FAZ if no resource IDs available)",{"type":64,"tag":407,"props":1377,"children":1378},{},[1379],{"type":70,"value":1380},"Likely contributing factor (if event is open)",{"type":64,"tag":385,"props":1382,"children":1383},{},[1384,1392,1397],{"type":64,"tag":407,"props":1385,"children":1386},{},[1387],{"type":64,"tag":89,"props":1388,"children":1389},{},[1390],{"type":70,"value":1391},"Medium",{"type":64,"tag":407,"props":1393,"children":1394},{},[1395],{"type":70,"value":1396},"Matching service + overlapping timeframe (no resource match)",{"type":64,"tag":407,"props":1398,"children":1399},{},[1400],{"type":70,"value":1380},{"type":64,"tag":385,"props":1402,"children":1403},{},[1404,1412,1417],{"type":64,"tag":407,"props":1405,"children":1406},{},[1407],{"type":64,"tag":89,"props":1408,"children":1409},{},[1410],{"type":70,"value":1411},"Low",{"type":64,"tag":407,"props":1413,"children":1414},{},[1415],{"type":70,"value":1416},"Matching service only (no timeframe overlap)",{"type":64,"tag":407,"props":1418,"children":1419},{},[1420],{"type":70,"value":1421},"Background context",{"type":64,"tag":352,"props":1423,"children":1425},{"id":1424},"scoring-rules",[1426],{"type":70,"value":1427},"Scoring rules",{"type":64,"tag":95,"props":1429,"children":1430},{},[1431,1441,1451,1461],{"type":64,"tag":99,"props":1432,"children":1433},{},[1434,1439],{"type":64,"tag":89,"props":1435,"children":1436},{},[1437],{"type":70,"value":1438},"Service match",{"type":70,"value":1440},": The event's service code matches one of the affected\nservices from the incident context.",{"type":64,"tag":99,"props":1442,"children":1443},{},[1444,1449],{"type":64,"tag":89,"props":1445,"children":1446},{},[1447],{"type":70,"value":1448},"Timeframe overlap",{"type":70,"value":1450},": The event's active period (start time through end time,\nor through present if still open) intersects with the incident's timeframe\n(start time through end time, or through present if ongoing).",{"type":64,"tag":99,"props":1452,"children":1453},{},[1454,1459],{"type":64,"tag":89,"props":1455,"children":1456},{},[1457],{"type":70,"value":1458},"Region\u002FAZ match",{"type":70,"value":1460},": The event's region or availability zone matches the\nincident's affected region or AZ.",{"type":64,"tag":99,"props":1462,"children":1463},{},[1464,1469,1471,1476],{"type":64,"tag":89,"props":1465,"children":1466},{},[1467],{"type":70,"value":1468},"Resource match",{"type":70,"value":1470},": At least one affected entity's ",{"type":64,"tag":192,"props":1472,"children":1474},{"className":1473},[],[1475],{"type":70,"value":1250},{"type":70,"value":1477}," matches a\nresource identifier from the incident context.",{"type":64,"tag":352,"props":1479,"children":1481},{"id":1480},"contributing-factor-labeling",[1482],{"type":70,"value":1483},"Contributing factor labeling",{"type":64,"tag":95,"props":1485,"children":1486},{},[1487,1498],{"type":64,"tag":99,"props":1488,"children":1489},{},[1490,1492,1496],{"type":70,"value":1491},"Any ",{"type":64,"tag":89,"props":1493,"children":1494},{},[1495],{"type":70,"value":534},{"type":70,"value":1497}," event classified as High or Medium relevance SHALL be labeled as\na \"likely contributing factor\" in addition to its relevance classification.",{"type":64,"tag":99,"props":1499,"children":1500},{},[1501],{"type":70,"value":1502},"Closed events with High relevance should be noted as potential recent causes\nif the incident started shortly after the event closed.",{"type":64,"tag":352,"props":1504,"children":1506},{"id":1505},"when-resource-identifiers-are-unavailable",[1507],{"type":70,"value":1508},"When resource identifiers are unavailable",{"type":64,"tag":73,"props":1510,"children":1511},{},[1512],{"type":70,"value":1513},"If the incident context does not include specific resource identifiers, score\nrelevance using only service, timeframe, and region\u002FAZ factors:",{"type":64,"tag":95,"props":1515,"children":1516},{},[1517,1526,1535],{"type":64,"tag":99,"props":1518,"children":1519},{},[1520,1524],{"type":64,"tag":89,"props":1521,"children":1522},{},[1523],{"type":70,"value":1370},{"type":70,"value":1525},": Matching service + overlapping timeframe + matching region or AZ",{"type":64,"tag":99,"props":1527,"children":1528},{},[1529,1533],{"type":64,"tag":89,"props":1530,"children":1531},{},[1532],{"type":70,"value":1391},{"type":70,"value":1534},": Matching service + overlapping timeframe",{"type":64,"tag":99,"props":1536,"children":1537},{},[1538,1542],{"type":64,"tag":89,"props":1539,"children":1540},{},[1541],{"type":70,"value":1411},{"type":70,"value":1543},": Matching service only",{"type":64,"tag":250,"props":1545,"children":1546},{},[],{"type":64,"tag":79,"props":1548,"children":1550},{"id":1549},"step-7-present-structured-output",[1551],{"type":70,"value":1552},"Step 7: Present Structured Output",{"type":64,"tag":73,"props":1554,"children":1555},{},[1556],{"type":70,"value":1557},"Present findings in a clear, structured format organized for quick\ncomprehension and action.",{"type":64,"tag":352,"props":1559,"children":1561},{"id":1560},"output-structure",[1562],{"type":70,"value":1563},"Output structure",{"type":64,"tag":265,"props":1565,"children":1566},{},[1567,1577,1605,1628,1676],{"type":64,"tag":99,"props":1568,"children":1569},{},[1570,1575],{"type":64,"tag":89,"props":1571,"children":1572},{},[1573],{"type":70,"value":1574},"Summary",{"type":70,"value":1576}," — total events found, broken down by category and status.",{"type":64,"tag":99,"props":1578,"children":1579},{},[1580,1585,1587],{"type":64,"tag":89,"props":1581,"children":1582},{},[1583],{"type":70,"value":1584},"Correlated events",{"type":70,"value":1586}," — grouped by event type category in this order:\n",{"type":64,"tag":95,"props":1588,"children":1589},{},[1590,1595,1600],{"type":64,"tag":99,"props":1591,"children":1592},{},[1593],{"type":70,"value":1594},"Issues (service disruptions) — present first",{"type":64,"tag":99,"props":1596,"children":1597},{},[1598],{"type":70,"value":1599},"Scheduled changes (maintenance) — present second",{"type":64,"tag":99,"props":1601,"children":1602},{},[1603],{"type":70,"value":1604},"Account notifications — present last",{"type":64,"tag":99,"props":1606,"children":1607},{},[1608,1613,1615],{"type":64,"tag":89,"props":1609,"children":1610},{},[1611],{"type":70,"value":1612},"Within each group",{"type":70,"value":1614}," — sort by:\n",{"type":64,"tag":95,"props":1616,"children":1617},{},[1618,1623],{"type":64,"tag":99,"props":1619,"children":1620},{},[1621],{"type":70,"value":1622},"Relevance classification (High → Medium → Low)",{"type":64,"tag":99,"props":1624,"children":1625},{},[1626],{"type":70,"value":1627},"Then by start time descending (most recent first)",{"type":64,"tag":99,"props":1629,"children":1630},{},[1631,1636,1638],{"type":64,"tag":89,"props":1632,"children":1633},{},[1634],{"type":70,"value":1635},"Per event",{"type":70,"value":1637}," — include:\n",{"type":64,"tag":95,"props":1639,"children":1640},{},[1641,1646,1651,1656,1661,1666,1671],{"type":64,"tag":99,"props":1642,"children":1643},{},[1644],{"type":70,"value":1645},"Event type category and service",{"type":64,"tag":99,"props":1647,"children":1648},{},[1649],{"type":70,"value":1650},"Region and availability zone (if applicable)",{"type":64,"tag":99,"props":1652,"children":1653},{},[1654],{"type":70,"value":1655},"Status (open\u002Fclosed\u002Fupcoming)",{"type":64,"tag":99,"props":1657,"children":1658},{},[1659],{"type":70,"value":1660},"Start time and end time (ISO 8601)",{"type":64,"tag":99,"props":1662,"children":1663},{},[1664],{"type":70,"value":1665},"Description (summarized to 256 characters max)",{"type":64,"tag":99,"props":1667,"children":1668},{},[1669],{"type":70,"value":1670},"Relevance classification and matching criteria",{"type":64,"tag":99,"props":1672,"children":1673},{},[1674],{"type":70,"value":1675},"Contributing factor label (if applicable)",{"type":64,"tag":99,"props":1677,"children":1678},{},[1679,1684,1686],{"type":64,"tag":89,"props":1680,"children":1681},{},[1682],{"type":70,"value":1683},"Actionable next steps",{"type":70,"value":1685}," — for each correlated event, include at least one\nrecommendation such as:\n",{"type":64,"tag":95,"props":1687,"children":1688},{},[1689,1694,1699,1704,1709],{"type":64,"tag":99,"props":1690,"children":1691},{},[1692],{"type":70,"value":1693},"Check specific affected resources",{"type":64,"tag":99,"props":1695,"children":1696},{},[1697],{"type":70,"value":1698},"Review related service limits or quotas",{"type":64,"tag":99,"props":1700,"children":1701},{},[1702],{"type":70,"value":1703},"Verify recent configuration changes",{"type":64,"tag":99,"props":1705,"children":1706},{},[1707],{"type":70,"value":1708},"Monitor the AWS Health Dashboard for updates",{"type":64,"tag":99,"props":1710,"children":1711},{},[1712],{"type":70,"value":1713},"Contact AWS Support if the event is ongoing",{"type":64,"tag":352,"props":1715,"children":1717},{"id":1716},"when-no-events-are-found",[1718],{"type":70,"value":1719},"When no events are found",{"type":64,"tag":73,"props":1721,"children":1722},{},[1723],{"type":70,"value":1724},"If no relevant Health events are identified:",{"type":64,"tag":95,"props":1726,"children":1727},{},[1728,1733,1738],{"type":64,"tag":99,"props":1729,"children":1730},{},[1731],{"type":70,"value":1732},"Explicitly state that no matching AWS Health events were found.",{"type":64,"tag":99,"props":1734,"children":1735},{},[1736],{"type":70,"value":1737},"Confirm the search parameters used (service, time range, region).",{"type":64,"tag":99,"props":1739,"children":1740},{},[1741,1743],{"type":70,"value":1742},"Recommend checking other potential causes:\n",{"type":64,"tag":95,"props":1744,"children":1745},{},[1746,1751,1756,1761],{"type":64,"tag":99,"props":1747,"children":1748},{},[1749],{"type":70,"value":1750},"Recent deployments or configuration changes",{"type":64,"tag":99,"props":1752,"children":1753},{},[1754],{"type":70,"value":1755},"Resource limits or quota exhaustion",{"type":64,"tag":99,"props":1757,"children":1758},{},[1759],{"type":70,"value":1760},"Network connectivity issues",{"type":64,"tag":99,"props":1762,"children":1763},{},[1764],{"type":70,"value":1765},"Application-level errors",{"type":64,"tag":250,"props":1767,"children":1768},{},[],{"type":64,"tag":79,"props":1770,"children":1772},{"id":1771},"decision-tree-event-search-strategy",[1773],{"type":70,"value":1774},"Decision Tree: Event Search Strategy",{"type":64,"tag":359,"props":1776,"children":1779},{"className":1777,"code":1778,"language":70},[362],"Is this a chat-based health report request?\n├── YES → Search the user-specified time period (default 30 days, max 90 days)\n│         Organize results by category, service, and status\n│         Present as a summary report\n└── NO → Continue with incident investigation flow below\n\nIs the affected AWS service known?\n├── YES → Search events for that service within the past 7 days\n│   ├── Events found → Proceed to Step 3 (Filter Relevant Events)\n│   └── No events found → Broaden to related services (see Service Dependency Map)\n│       ├── Events found → Proceed to Step 3\n│       └── No events found → Expand time window to 14 days and retry\n│           ├── Events found → Proceed to Step 3\n│           └── No events found → Report no events found, suggest other investigation paths\n└── NO → Search all services filtered by region and availability zone (past 7 days)\n    ├── Events found → Proceed to Step 3\n    └── No events found → Expand time window to 14 days\n        ├── Events found → Proceed to Step 3\n        └── No events found → Report no events found, suggest other investigation paths\n\nDoes the incident involve a specific availability zone?\n├── YES → Include the AZ filter in all searches above\n└── NO → Filter by region only\n",[1780],{"type":64,"tag":192,"props":1781,"children":1782},{"__ignoreMap":367},[1783],{"type":70,"value":1778},{"type":64,"tag":250,"props":1785,"children":1786},{},[],{"type":64,"tag":79,"props":1788,"children":1790},{"id":1789},"service-dependency-map",[1791],{"type":70,"value":1792},"Service Dependency Map",{"type":64,"tag":73,"props":1794,"children":1795},{},[1796],{"type":70,"value":1797},"When the initial service-specific search returns no results, broaden the search\nto related services that share infrastructure dependencies:",{"type":64,"tag":377,"props":1799,"children":1800},{},[1801,1817],{"type":64,"tag":381,"props":1802,"children":1803},{},[1804],{"type":64,"tag":385,"props":1805,"children":1806},{},[1807,1812],{"type":64,"tag":389,"props":1808,"children":1809},{},[1810],{"type":70,"value":1811},"Primary Service",{"type":64,"tag":389,"props":1813,"children":1814},{},[1815],{"type":70,"value":1816},"Related Services to Check",{"type":64,"tag":400,"props":1818,"children":1819},{},[1820,1833,1845,1858,1871,1884,1897,1910,1923,1936],{"type":64,"tag":385,"props":1821,"children":1822},{},[1823,1828],{"type":64,"tag":407,"props":1824,"children":1825},{},[1826],{"type":70,"value":1827},"ELB \u002F ALB \u002F NLB",{"type":64,"tag":407,"props":1829,"children":1830},{},[1831],{"type":70,"value":1832},"EC2, VPC, Route 53",{"type":64,"tag":385,"props":1834,"children":1835},{},[1836,1840],{"type":64,"tag":407,"props":1837,"children":1838},{},[1839],{"type":70,"value":437},{"type":64,"tag":407,"props":1841,"children":1842},{},[1843],{"type":70,"value":1844},"EC2, EBS",{"type":64,"tag":385,"props":1846,"children":1847},{},[1848,1853],{"type":64,"tag":407,"props":1849,"children":1850},{},[1851],{"type":70,"value":1852},"ECS \u002F EKS",{"type":64,"tag":407,"props":1854,"children":1855},{},[1856],{"type":70,"value":1857},"EC2, VPC, ELB",{"type":64,"tag":385,"props":1859,"children":1860},{},[1861,1866],{"type":64,"tag":407,"props":1862,"children":1863},{},[1864],{"type":70,"value":1865},"Lambda",{"type":64,"tag":407,"props":1867,"children":1868},{},[1869],{"type":70,"value":1870},"VPC, CloudWatch",{"type":64,"tag":385,"props":1872,"children":1873},{},[1874,1879],{"type":64,"tag":407,"props":1875,"children":1876},{},[1877],{"type":70,"value":1878},"CloudFront",{"type":64,"tag":407,"props":1880,"children":1881},{},[1882],{"type":70,"value":1883},"S3, Route 53",{"type":64,"tag":385,"props":1885,"children":1886},{},[1887,1892],{"type":64,"tag":407,"props":1888,"children":1889},{},[1890],{"type":70,"value":1891},"API Gateway",{"type":64,"tag":407,"props":1893,"children":1894},{},[1895],{"type":70,"value":1896},"Lambda, VPC",{"type":64,"tag":385,"props":1898,"children":1899},{},[1900,1905],{"type":64,"tag":407,"props":1901,"children":1902},{},[1903],{"type":70,"value":1904},"ElastiCache",{"type":64,"tag":407,"props":1906,"children":1907},{},[1908],{"type":70,"value":1909},"EC2, VPC",{"type":64,"tag":385,"props":1911,"children":1912},{},[1913,1918],{"type":64,"tag":407,"props":1914,"children":1915},{},[1916],{"type":70,"value":1917},"DynamoDB",{"type":64,"tag":407,"props":1919,"children":1920},{},[1921],{"type":70,"value":1922},"VPC (if VPC endpoints used)",{"type":64,"tag":385,"props":1924,"children":1925},{},[1926,1931],{"type":64,"tag":407,"props":1927,"children":1928},{},[1929],{"type":70,"value":1930},"S3",{"type":64,"tag":407,"props":1932,"children":1933},{},[1934],{"type":70,"value":1935},"CloudFront, VPC (if VPC endpoints used)",{"type":64,"tag":385,"props":1937,"children":1938},{},[1939,1944],{"type":64,"tag":407,"props":1940,"children":1941},{},[1942],{"type":70,"value":1943},"Kinesis",{"type":64,"tag":407,"props":1945,"children":1946},{},[1947],{"type":70,"value":1909},{"type":64,"tag":73,"props":1949,"children":1950},{},[1951,1953,1958,1960,1966],{"type":70,"value":1952},"Search up to 3 related services when broadening. Use the Health API service\ncodes from the references document (e.g., ",{"type":64,"tag":192,"props":1954,"children":1956},{"className":1955},[],[1957],{"type":70,"value":444},{"type":70,"value":1959}," for ELB,\n",{"type":64,"tag":192,"props":1961,"children":1963},{"className":1962},[],[1964],{"type":70,"value":1965},"ROUTE53",{"type":70,"value":1967}," for Route 53).",{"type":64,"tag":250,"props":1969,"children":1970},{},[],{"type":64,"tag":79,"props":1972,"children":1974},{"id":1973},"error-handling-1",[1975],{"type":70,"value":1976},"Error Handling",{"type":64,"tag":377,"props":1978,"children":1979},{},[1980,1996],{"type":64,"tag":381,"props":1981,"children":1982},{},[1983],{"type":64,"tag":385,"props":1984,"children":1985},{},[1986,1991],{"type":64,"tag":389,"props":1987,"children":1988},{},[1989],{"type":70,"value":1990},"Error Condition",{"type":64,"tag":389,"props":1992,"children":1993},{},[1994],{"type":70,"value":1995},"Agent Behavior",{"type":64,"tag":400,"props":1997,"children":1998},{},[1999,2045,2058,2071,2084,2097,2110,2123,2136],{"type":64,"tag":385,"props":2000,"children":2001},{},[2002,2015],{"type":64,"tag":407,"props":2003,"children":2004},{},[2005,2007,2013],{"type":70,"value":2006},"Missing ",{"type":64,"tag":192,"props":2008,"children":2010},{"className":2009},[],[2011],{"type":70,"value":2012},"health:Describe*",{"type":70,"value":2014}," permissions",{"type":64,"tag":407,"props":2016,"children":2017},{},[2018,2020,2025,2026,2031,2032,2037,2038,2043],{"type":70,"value":2019},"Report the missing permissions and specify the required IAM actions: ",{"type":64,"tag":192,"props":2021,"children":2023},{"className":2022},[],[2024],{"type":70,"value":197},{"type":70,"value":165},{"type":64,"tag":192,"props":2027,"children":2029},{"className":2028},[],[2030],{"type":70,"value":206},{"type":70,"value":165},{"type":64,"tag":192,"props":2033,"children":2035},{"className":2034},[],[2036],{"type":70,"value":215},{"type":70,"value":165},{"type":64,"tag":192,"props":2039,"children":2041},{"className":2040},[],[2042],{"type":70,"value":224},{"type":70,"value":2044},". Provide the IAM policy snippet needed.",{"type":64,"tag":385,"props":2046,"children":2047},{},[2048,2053],{"type":64,"tag":407,"props":2049,"children":2050},{},[2051],{"type":70,"value":2052},"Throttling (HTTP 429)",{"type":64,"tag":407,"props":2054,"children":2055},{},[2056],{"type":70,"value":2057},"Retry with exponential backoff: wait 1s → 2s → 4s (max 3 retries). If still throttled after 3 retries, report that the Health API is currently rate-limited and recommend trying again shortly.",{"type":64,"tag":385,"props":2059,"children":2060},{},[2061,2066],{"type":64,"tag":407,"props":2062,"children":2063},{},[2064],{"type":70,"value":2065},"Service error (HTTP 5xx)",{"type":64,"tag":407,"props":2067,"children":2068},{},[2069],{"type":70,"value":2070},"Report the error code and recommend the operator check the AWS Health Dashboard directly as a fallback.",{"type":64,"tag":385,"props":2072,"children":2073},{},[2074,2079],{"type":64,"tag":407,"props":2075,"children":2076},{},[2077],{"type":70,"value":2078},"Timeout (30 seconds)",{"type":64,"tag":407,"props":2080,"children":2081},{},[2082],{"type":70,"value":2083},"Cancel the request and report a timeout error. Suggest the operator check the Health Dashboard directly or retry with narrower filters.",{"type":64,"tag":385,"props":2085,"children":2086},{},[2087,2092],{"type":64,"tag":407,"props":2088,"children":2089},{},[2090],{"type":70,"value":2091},"Zero events found",{"type":64,"tag":407,"props":2093,"children":2094},{},[2095],{"type":70,"value":2096},"Report that no events matched the specified filters. Confirm the search parameters used. Suggest broadening the search or checking other investigation paths.",{"type":64,"tag":385,"props":2098,"children":2099},{},[2100,2105],{"type":64,"tag":407,"props":2101,"children":2102},{},[2103],{"type":70,"value":2104},"Invalid time range (start > end)",{"type":64,"tag":407,"props":2106,"children":2107},{},[2108],{"type":70,"value":2109},"Report the invalid time range error. Ask the operator to provide corrected timestamps.",{"type":64,"tag":385,"props":2111,"children":2112},{},[2113,2118],{"type":64,"tag":407,"props":2114,"children":2115},{},[2116],{"type":70,"value":2117},"DescribeEventDetails failedSet",{"type":64,"tag":407,"props":2119,"children":2120},{},[2121],{"type":70,"value":2122},"Report the failed event ARNs and error messages. Continue processing events from the successfulSet.",{"type":64,"tag":385,"props":2124,"children":2125},{},[2126,2131],{"type":64,"tag":407,"props":2127,"children":2128},{},[2129],{"type":70,"value":2130},"DescribeAffectedEntities error",{"type":64,"tag":407,"props":2132,"children":2133},{},[2134],{"type":70,"value":2135},"Report the event ARN for which entity retrieval failed. Continue processing remaining events.",{"type":64,"tag":385,"props":2137,"children":2138},{},[2139,2144],{"type":64,"tag":407,"props":2140,"children":2141},{},[2142],{"type":70,"value":2143},"Unknown service name (chat report)",{"type":64,"tag":407,"props":2145,"children":2146},{},[2147],{"type":70,"value":2148},"Inform the user the service was not recognized. List services that have events in the requested time period.",{"type":64,"tag":250,"props":2150,"children":2151},{},[],{"type":64,"tag":79,"props":2153,"children":2155},{"id":2154},"tips-for-effective-health-event-review",[2156],{"type":70,"value":2157},"Tips for Effective Health Event Review",{"type":64,"tag":95,"props":2159,"children":2160},{},[2161,2171,2181,2191,2201,2211],{"type":64,"tag":99,"props":2162,"children":2163},{},[2164,2169],{"type":64,"tag":89,"props":2165,"children":2166},{},[2167],{"type":70,"value":2168},"Always check us-east-1",{"type":70,"value":2170},": The Health API endpoint is only in us-east-1,\nregardless of where your resources are located.",{"type":64,"tag":99,"props":2172,"children":2173},{},[2174,2179],{"type":64,"tag":89,"props":2175,"children":2176},{},[2177],{"type":70,"value":2178},"Start narrow, then broaden",{"type":70,"value":2180},": Begin with the specific affected service and\na 7-day window. Only expand if no results are found.",{"type":64,"tag":99,"props":2182,"children":2183},{},[2184,2189],{"type":64,"tag":89,"props":2185,"children":2186},{},[2187],{"type":70,"value":2188},"Check both open and closed events",{"type":70,"value":2190},": A recently closed event may still be\ncausing residual impact.",{"type":64,"tag":99,"props":2192,"children":2193},{},[2194,2199],{"type":64,"tag":89,"props":2195,"children":2196},{},[2197],{"type":70,"value":2198},"Correlate with support cases",{"type":70,"value":2200},": If a Health event references a service\ndisruption, check if related support cases exist using the support-cases skill.",{"type":64,"tag":99,"props":2202,"children":2203},{},[2204,2209],{"type":64,"tag":89,"props":2205,"children":2206},{},[2207],{"type":70,"value":2208},"Account-specific vs public events",{"type":70,"value":2210},": Account-specific events directly affect\nyour resources. Public events are service-wide but may still impact you.",{"type":64,"tag":99,"props":2212,"children":2213},{},[2214,2219],{"type":64,"tag":89,"props":2215,"children":2216},{},[2217],{"type":70,"value":2218},"Look at scheduled changes",{"type":70,"value":2220},": Upcoming or recent maintenance windows can\nexplain transient issues that resolve on their own.",{"items":2222,"total":2395},[2223,2241,2256,2269,2284,2294,2309,2325,2339,2356,2369,2381],{"slug":2224,"name":2224,"fn":2225,"description":2226,"org":2227,"tags":2228,"stars":2238,"repoUrl":2239,"updatedAt":2240},"agents-build","add capabilities to existing agent projects","Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal. Triggers: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"agent auth\", \"streaming\", \"VPC\", \"VPC connectivity\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"migration issue\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"add payments capability to my agent\", \"wire payments plugin\", \"integrate x402 payments with the agent I'm building\", \"add MPP payments\", \"Machine Payments Protocol\". External APIs via Gateway: use agents-connect. New project: use agents-get-started. CLI\u002Fdev-server errors: use agents-debug. Runtime x402\u002FMPP payments: use agents-pay. Migration-specific Strands vs LangGraph routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2229,2231,2234,2235],{"name":2230,"slug":32,"type":15},"Agents",{"name":2232,"slug":2233,"type":15},"Automation","automation",{"name":20,"slug":8,"type":15},{"name":2236,"slug":2237,"type":15},"Engineering","engineering",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-08-20T03:27:06.137661",{"slug":2242,"name":2242,"fn":2243,"description":2244,"org":2245,"tags":2246,"stars":2238,"repoUrl":2239,"updatedAt":2255},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2247,2248,2251,2254],{"name":2230,"slug":32,"type":15},{"name":2249,"slug":2250,"type":15},"API Development","api-development",{"name":2252,"slug":2253,"type":15},"Authentication","authentication",{"name":20,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":2257,"name":2257,"fn":2258,"description":2259,"org":2260,"tags":2261,"stars":2238,"repoUrl":2239,"updatedAt":2268},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2262,2263,2264,2265],{"name":2230,"slug":32,"type":15},{"name":20,"slug":8,"type":15},{"name":22,"slug":23,"type":15},{"name":2266,"slug":2267,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":2270,"name":2270,"fn":2271,"description":2272,"org":2273,"tags":2274,"stars":2238,"repoUrl":2239,"updatedAt":2283},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2275,2276,2277,2280],{"name":2230,"slug":32,"type":15},{"name":20,"slug":8,"type":15},{"name":2278,"slug":2279,"type":15},"CI\u002FCD","ci-cd",{"name":2281,"slug":2282,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":2285,"name":2285,"fn":2286,"description":2287,"org":2288,"tags":2289,"stars":2238,"repoUrl":2239,"updatedAt":2293},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2290,2291,2292],{"name":2230,"slug":32,"type":15},{"name":20,"slug":8,"type":15},{"name":2281,"slug":2282,"type":15},"2026-07-12T08:42:51.963247",{"slug":2295,"name":2295,"fn":2296,"description":2297,"org":2298,"tags":2299,"stars":2238,"repoUrl":2239,"updatedAt":2308},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2300,2301,2302,2305],{"name":2230,"slug":32,"type":15},{"name":20,"slug":8,"type":15},{"name":2303,"slug":2304,"type":15},"Best Practices","best-practices",{"name":2306,"slug":2307,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":2310,"name":2310,"fn":2311,"description":2312,"org":2313,"tags":2314,"stars":2238,"repoUrl":2239,"updatedAt":2324},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2315,2316,2317,2320,2321],{"name":2230,"slug":32,"type":15},{"name":20,"slug":8,"type":15},{"name":2318,"slug":2319,"type":15},"Evals","evals",{"name":2266,"slug":2267,"type":15},{"name":2322,"slug":2323,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",{"slug":2326,"name":2326,"fn":2327,"description":2328,"org":2329,"tags":2330,"stars":2238,"repoUrl":2239,"updatedAt":2338},"agents-pay","handle x402 payments for agent tasks","Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits. Covers payment setup, policy, session budgets, and troubleshooting. Triggers on: \"my agent hit a 402 while calling an API\", \"a tool call returned 402 Payment Required\", \"my agent needs to pay for x402-protected content\", \"let the agent pay for content, capped at $5 per session\", \"set a spend limit for the agent\", \"ProcessPayment failed\", or \"why did my agent refuse to pay\". Not for BUILDING payment capability for end users, including wallets and framework middleware; use agents-build and references\u002Fpayments.md. For non-paid APIs via Gateway use agents-connect. For inbound auth use agents-harden. For project scaffolding use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2331,2332,2333,2336],{"name":2230,"slug":32,"type":15},{"name":2232,"slug":2233,"type":15},{"name":2334,"slug":2335,"type":15},"Payments","payments",{"name":2337,"slug":2337,"type":15},"x402","2026-08-10T04:16:31.844309",{"slug":2340,"name":2340,"fn":2341,"description":2342,"org":2343,"tags":2344,"stars":2238,"repoUrl":2239,"updatedAt":2355},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2345,2346,2349,2352],{"name":20,"slug":8,"type":15},{"name":2347,"slug":2348,"type":15},"Database","database",{"name":2350,"slug":2351,"type":15},"MySQL","mysql",{"name":2353,"slug":2354,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":2357,"name":2357,"fn":2358,"description":2359,"org":2360,"tags":2361,"stars":2238,"repoUrl":2239,"updatedAt":2368},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2362,2363,2364,2367],{"name":20,"slug":8,"type":15},{"name":2347,"slug":2348,"type":15},{"name":2365,"slug":2366,"type":15},"PostgreSQL","postgresql",{"name":2353,"slug":2354,"type":15},"2026-07-16T06:00:34.789624",{"slug":2370,"name":2370,"fn":2371,"description":2372,"org":2373,"tags":2374,"stars":2238,"repoUrl":2239,"updatedAt":2380},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching, quota health checks and throttling diagnosis, cost attribution, migrating between Claude model generations, chunking strategies, API selection (Converse vs InvokeModel), and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Coinbase CDP, Stripe Privy, 402 Payment Required, paid endpoint). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2375,2376,2377],{"name":2230,"slug":32,"type":15},{"name":20,"slug":8,"type":15},{"name":2378,"slug":2379,"type":15},"LLM","llm","2026-08-07T04:38:13.03499",{"slug":2382,"name":2382,"fn":2383,"description":2384,"org":2385,"tags":2386,"stars":2238,"repoUrl":2239,"updatedAt":2394},"amazon-braket","run quantum computing workflows on AWS","Runs quantum computing workflows on AWS through Amazon Braket — discovering devices (QPUs and simulators) and their availability, building gate-model circuits and analog Hamiltonian programs, submitting quantum tasks, program sets and hybrid jobs, looking up prices, and capping spend with spending limits. Applies to any request about quantum computing, quantum hardware, quantum simulation, AHS, OpenQASM, or running a quantum algorithm on AWS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2387,2388,2391],{"name":20,"slug":8,"type":15},{"name":2389,"slug":2390,"type":15},"Quantum Computing","quantum-computing",{"name":2392,"slug":2393,"type":15},"Simulation","simulation","2026-08-20T03:53:19.377174",139,{"items":2397,"total":2490},[2398,2405,2420,2435,2449,2461,2476],{"slug":4,"name":4,"fn":5,"description":6,"org":2399,"tags":2400,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2401,2402,2403,2404],{"name":20,"slug":8,"type":15},{"name":22,"slug":23,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":2406,"name":2406,"fn":2407,"description":2408,"org":2409,"tags":2410,"stars":24,"repoUrl":25,"updatedAt":2419},"aws-vpc-dns-investigation","investigate VPC DNS resolution issues","Use this skill when a name is not resolving as expected inside a VPC, or before applying a DNS control-plane change. Activate on symptoms such as NXDOMAIN or SERVFAIL from an EC2 instance, a hostname resolving to a public address when a private endpoint was expected, an AWS service endpoint that stopped resolving after a VPC endpoint or Route 53 change, an application reaching the wrong IP, resolution that works from one instance but not another, IPv6 or dualstack resolution differences, a suspected on-premises forwarding or hybrid DNS problem, or a request to check whether enabling private DNS, adding a Resolver rule, associating a private hosted zone, attaching DNS Firewall, or associating a Route 53 Profile would break anything. It drives the aws-vpc-dns-diagnostics MCP server to observe live resolution from inside the subnet and to simulate a proposed change before it is applied.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2411,2412,2413,2416],{"name":20,"slug":8,"type":15},{"name":22,"slug":23,"type":15},{"name":2414,"slug":2415,"type":15},"DNS","dns",{"name":2417,"slug":2418,"type":15},"Networking","networking","2026-08-20T03:53:46.027593",{"slug":2421,"name":2421,"fn":2422,"description":2423,"org":2424,"tags":2425,"stars":24,"repoUrl":25,"updatedAt":2434},"crm-production-investigation-guidelines","investigate CRM production incidents","Guidelines for investigating production incidents in the CRM application. Use when triaging any alert or incident involving the CRM REST API, SQS queues, Lambda functions, or Aurora DSQL database in this AWS account. Ensures thorough root cause analysis using AWS-native observability tools.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2426,2427,2430,2431,2432],{"name":20,"slug":8,"type":15},{"name":2428,"slug":2429,"type":15},"CRM","crm",{"name":22,"slug":23,"type":15},{"name":17,"slug":18,"type":15},{"name":59,"slug":2433,"type":15},"operations","2026-08-20T03:53:23.532781",{"slug":2436,"name":2436,"fn":2437,"description":2438,"org":2439,"tags":2440,"stars":24,"repoUrl":25,"updatedAt":2448},"database-migration-service-expertise","troubleshoot AWS Database Migration Service","AWS Database Migration Service (DMS) operational review and troubleshooting skill. Conducts best practices validation, health assessments, performance diagnostics, cost optimization reviews, and migration cutover guidance. Triggers on requests like \"DMS review\", \"DMS health check\", \"DMS troubleshooting\", \"migration assessment\", \"DMS best practices audit\", \"DMS cost optimization\", \"replication instance review\", \"CDC latency issue\", or \"DMS task failure\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2441,2442,2443,2444,2447],{"name":20,"slug":8,"type":15},{"name":2347,"slug":2348,"type":15},{"name":22,"slug":23,"type":15},{"name":2445,"slug":2446,"type":15},"Migration","migration",{"name":59,"slug":2433,"type":15},"2026-08-20T03:53:23.927999",{"slug":2450,"name":2450,"fn":2451,"description":2452,"org":2453,"tags":2454,"stars":24,"repoUrl":25,"updatedAt":2460},"database-rds-devops","diagnose Aurora MySQL and PostgreSQL databases","Database-level data-plane diagnostics for Aurora MySQL and Aurora PostgreSQL. Executes predefined read-only health check queries via RDS Data API to analyze buffer pool, connections, locks, replication, storage, performance, and index efficiency. Requires the rds-aidba MCP server for database-internal access beyond what CloudWatch and RDS APIs provide.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2455,2456,2457,2458,2459],{"name":20,"slug":8,"type":15},{"name":2347,"slug":2348,"type":15},{"name":22,"slug":23,"type":15},{"name":2350,"slug":2351,"type":15},{"name":2365,"slug":2366,"type":15},"2026-08-20T03:53:41.560344",{"slug":2462,"name":2462,"fn":2463,"description":2464,"org":2465,"tags":2466,"stars":24,"repoUrl":25,"updatedAt":2475},"eks-operation-review","audit Amazon EKS cluster operations","Comprehensive Amazon EKS operational review aligned with the AWS EKS Best Practices Guide. Use this skill when a user asks to review, audit, or assess EKS clusters for best practices compliance, operational readiness, security posture, cost optimization, reliability, networking, scalability, or upgrade readiness. Triggers on requests like \"EKS review\", \"EKS best practices audit\", \"EKS operational assessment\", \"review my EKS cluster\", or \"EKS health check\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2467,2470,2471,2474],{"name":2468,"slug":2469,"type":15},"Audit","audit",{"name":20,"slug":8,"type":15},{"name":2472,"slug":2473,"type":15},"Kubernetes","kubernetes",{"name":59,"slug":2433,"type":15},"2026-08-20T03:53:20.524374",{"slug":2477,"name":2477,"fn":2478,"description":2479,"org":2480,"tags":2481,"stars":24,"repoUrl":25,"updatedAt":2489},"enrich-with-aws-security-agent","investigate security root causes in AWS","Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or authorization failures, injection attacks, data exposure, or suspicious application behavior. Query AWS Security Agent CloudWatch logs to retrieve detailed code review findings with actionable, low-level details (file, line number, vulnerability type) that customers can directly fix.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2482,2485,2486,2487,2488],{"name":2483,"slug":2484,"type":15},"Auth","auth",{"name":20,"slug":8,"type":15},{"name":22,"slug":23,"type":15},{"name":17,"slug":18,"type":15},{"name":2306,"slug":2307,"type":15},"2026-08-20T03:53:23.097965",15]