12.1 AWS Health, CloudTrail Events & Operational Notification

AWS Health: Personal Health Dashboard vs. Service Health Dashboard

In modern cloud operations, detecting infrastructure impairments and scheduled maintenance before they trigger severe application outages is paramount. AWS provides two distinct health visibility mechanisms that candidates on the AWS Certified DevOps Engineer - Professional (DOP-C02) exam must clearly differentiate.

Architectural Comparison of Health Dashboards

Public Outage Status ──> [ AWS Service Health Dashboard (status.aws.amazon.com) ]
                                      │ (Macro-level regional view)
                                      ▼
Account Resource Health ─> [ AWS Health Dashboard (Personal Health Dashboard) ]
                                      │ (Micro-level specific resource ARNs)
                                      ├──> Amazon EventBridge (Real-Time Rules)
                                      └──> AWS Health API (Enterprise Tooling)

AWS Health Event Categories and Lifecycle States

AWS Health categorizes operational occurrences into three distinct event types:

1. issue: Active, open operational events indicating degraded performance or localized failure in the underlying AWS infrastructure affecting your resources (e.g., an underlying EC2 physical host degradation, degraded EBS storage volume throughput, or an Availability Zone network connectivity interruption).
2. scheduledChange: Planned lifecycle operations and mandatory infrastructure maintenance that require proactive customer scheduling or awareness (e.g., upcoming EC2 instance retirement, scheduled Amazon RDS database operating system or engine updates, hardware maintenance reboots, or network device replacements).
3. accountNotification: Administrative and operational notifications specific to the AWS account (e.g., deprecated runtime deprecation schedules such as Node.js or Python runtime end-of-support in AWS Lambda, upcoming AWS Certificate Manager (ACM) public certificate expiration, or billing threshold alerts).

Each health event progresses through well-defined lifecycle states: open (event is currently active and impacting resources), upcoming (event is scheduled for a future maintenance window), and closed (the event has completed or underlying issues have resolved).

---

AWS Health Organizational View & Multi-Account Aggregation

In an enterprise landing zone containing dozens or hundreds of AWS accounts managed under AWS Organizations, checking individual account dashboards is operationally untenable. AWS Health Organizational View provides centralized, cross-account aggregation of all AWS Health events across the entire organization.

Prerequisites and Delegation Architecture

• Support Plan Requirement: Access to the AWS Health API and AWS Health Organizational View requires an active Business, Enterprise On-Ramp, or Enterprise Support plan.
• Enabling Organization Access: The organization management account enables service access using the AWS Health CLI or console:

aws health enable-health-service-access-for-organization

• Delegated Administrator: To maintain separation of concerns and avoid operating out of the management account, organizations can designate a member account (such as a centralized Security, Operations, or Shared Services account) as a delegated administrator for AWS Health:

aws organizations register-delegated-administrator \
    --account-id 111122223333 \
    --service-principal health.amazonaws.com

The delegated administrator account can query aggregated organizational health events across all accounts or filter by specific Organizational Units (OUs) using DescribeEventsForOrganization and DescribeAffectedEntitiesForOrganization.

---

AWS CloudTrail Architecture: Management, Data & Insights Events

AWS CloudTrail serves as the foundational auditing and compliance backbone for AWS accounts, capturing API activities, operational actions, and administrative modifications.

Event Categories Deep Dive

CloudTrail categorizes events into three primary types:

1. Management Events (Control Plane): Operations executed against the control plane of AWS resources. Examples include ec2:RunInstances, iam:CreateRole, s3:CreateBucket, and ec2:AuthorizeSecurityGroupIngress. CloudTrail trails log management events by default. They can be filtered as read-only, write-only, or all.
2. Data Events (Data Plane): Operations executed against or within the resource itself. Examples include s3:GetObject, s3:PutObject, s3:DeleteObject, lambda:InvokeFunction, and Amazon DynamoDB item-level operations (PutItem, GetItem). Data events are disabled by default due to extreme event volume and ingestion costs ($0.10 per 100,000 events). They must be selectively enabled by specifying resource ARNs or prefix patterns.
3. Insights Events (Behavioral Anomalies): CloudTrail Insights analyzes selected management or data events against a rolling baseline. For management events, API call-rate Insights analyze write-only calls, while API error-rate Insights can analyze read events, write events, or both. Trails can also analyze data-event call and error rates; data-event Insights are not supported by CloudTrail Lake event data stores. CloudTrail builds the initial baseline from the preceding 28 days and recalculates it daily. Examples include an unusual surge in mutating calls such as CreateRole or DeleteBucket, or a surge in errors such as AccessDenied and ThrottlingException.

CloudTrail Lake

Traditionally, analyzing CloudTrail events across multiple accounts required deploying complex ETL pipelines: CloudTrail delivered gzipped JSON logs to Amazon S3, triggering Amazon SNS notifications to Amazon SQS, which crawled logs using AWS Glue and queried them using Amazon Athena.

CloudTrail Lake eliminates this architecture by providing a fully managed, serverless, SQL-queryable event data store (EDS):

• Retention & Immutability: Provides tamper-evident, write-once storage with retention configurable from 7 days up to 3,653 days (10 years) for strict regulatory compliance.
• Multi-Account & Multi-Region: Can ingest management events, data events, Insights events, and external third-party audit logs (via CloudTrail Lake Integrations for GitHub, Okta, Jira, and CrowdStrike).
• ANSI-SQL Querying: Enables direct, complex SQL analysis without managing partitions or Glue schemas:

SELECT
    eventTime,
    eventName,
    userIdentity.arn AS principal_arn,
    sourceIPAddress,
    errorMessage
FROM
    eds-ab12cd34ef56gh78
WHERE
    errorCode = 'AccessDenied'
    AND eventTime > '2026-09-01 00:00:00'
ORDER BY
    eventTime DESC
LIMIT 50;

---

Real-Time Operational Notifications & Automated Remediation via EventBridge

[!IMPORTANT] DOP-C02 Exam Critical Insight: CloudTrail typically delivers trail log files to Amazon S3 in about five minutes on average, but that timing is not guaranteed. For prompt security detection and remediation (for example, an engineer opening port 22 to 0.0.0.0/0), use best-effort CloudTrail service events delivered to the default EventBridge bus instead of waiting for S3 objects.

EventBridge Event Patterns for Operational Incident Pipelines

1. AWS Health Event Pattern (Impending Hardware Retirement or Issue)

{
  "source": ["aws.health"],
  "detail-type": ["AWS Health Event"],
  "detail": {
    "service": ["EC2", "RDS"],
    "eventTypeCategory": ["issue", "scheduledChange"],
    "eventTypeCode": [
      "AWS_EC2_PERSISTENT_INSTANCE_RETIREMENT_SCHEDULED",
      "AWS_RDS_MAINTENANCE_SCHEDULED"
    ]
  }
}

2. CloudTrail Management API Call Pattern (Security Group Modification)

{
  "source": ["aws.ec2"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["ec2.amazonaws.com"],
    "eventName": [
      "AuthorizeSecurityGroupIngress",
      "RevokeSecurityGroupIngress"
    ]
  }
}

3. CloudTrail Insights Anomaly Event Pattern

{
  "source": ["aws.cloudtrail"],
  "detail-type": ["AWS Insight via CloudTrail"],
  "detail": {
    "insightDetails": {
      "state": ["Start"],
      "insightType": ["ApiCallRateInsight", "ApiErrorRateInsight"]
    }
  }
}

Automated Remediation Architecture

When EventBridge matches an operational or security event pattern, it immediately dispatches the event payload to automated targets:

1. AWS Systems Manager (SSM) Automation: Automatically executes runbooks. For an AWS_EC2_PERSISTENT_INSTANCE_RETIREMENT_SCHEDULED event, SSM Automation can schedule a graceful instance stop and start during an off-peak maintenance window, migrating the instance to healthy physical hardware.
2. AWS Lambda: Evaluates the ingress rules in an AuthorizeSecurityGroupIngress event. If an ingress rule allows unrestricted access (0.0.0.0/0 on sensitive ports like 22 or 3389), Lambda immediately invokes ec2:RevokeSecurityGroupIngress to revoke the rule, publishes an alert to Amazon SNS, and posts a notification to Slack or PagerDuty.
3. Amazon SNS & Incident Ticketing: Fans out incident details to operations engineers, PagerDuty, Jira Service Management, or ServiceNow via webhooks or Amazon EventBridge API Destinations.

Incident Detection Mechanisms Comparison