$npx -y skills add aws-samples/sample-devops-agent-tools --skill aws-health-eventsALWAYS use this skill in the beginning of any incident investigation, root cause
| 1 | # AWS Health Event Review |
| 2 | |
| 3 | Use this skill when investigating an incident and you need to check for AWS-side |
| 4 | service events that may be causing or contributing to the observed issue. Also |
| 5 | use this skill when a user requests a summary report of AWS Health events over a |
| 6 | configurable time period. |
| 7 | |
| 8 | ## When to Use This Skill |
| 9 | |
| 10 | **Incident Investigation (automatic activation):** |
| 11 | |
| 12 | - An active incident may be caused by an AWS service disruption or degradation. |
| 13 | - You observe service degradation, elevated error rates, latency spikes, |
| 14 | connection failures, throttling, or capacity issues. |
| 15 | - You need to determine whether an AWS-side event is the root cause or a |
| 16 | contributing factor to the current incident. |
| 17 | - You want to correlate observed symptoms with known AWS Health events. |
| 18 | |
| 19 | **Chat Reporting (on-demand activation):** |
| 20 | |
| 21 | - A user requests a health event summary or report for their account. |
| 22 | - A user wants to review the health posture of their AWS environment over a |
| 23 | specific time period. |
| 24 | - A user asks about recent AWS service issues affecting their account or region. |
| 25 | |
| 26 | ## Prerequisites |
| 27 | |
| 28 | - The account must have an **AWS Business Support+**, **Enterprise Support**, or |
| 29 | **Unified Operations** support plan to access the AWS Health API. |
| 30 | - The agent must have permissions to call the following IAM actions: |
| 31 | - `health:DescribeEvents` |
| 32 | - `health:DescribeEventDetails` |
| 33 | - `health:DescribeAffectedEntities` |
| 34 | - `health:DescribeEventTypes` |
| 35 | - The AWS Health API is only available in the **us-east-1** region. All API |
| 36 | calls must target the `us-east-1` endpoint regardless of where the affected |
| 37 | resources are located. |
| 38 | - Health event data is available for up to 90 days. Events older than 90 days |
| 39 | cannot be retrieved via the API. |
| 40 | |
| 41 | --- |
| 42 | |
| 43 | ## Step 1: Gather Incident Context |
| 44 | |
| 45 | Before searching Health events, extract key details from the current incident: |
| 46 | |
| 47 | 1. **Affected AWS services** — identify the service(s) experiencing issues |
| 48 | (e.g., EC2, RDS, Lambda, ELB, ECS). |
| 49 | 2. **Timeframe** — determine when the incident started and its current duration. |
| 50 | Use ISO 8601 timestamps. |
| 51 | 3. **Affected resources** — collect specific resource identifiers (instance IDs, |
| 52 | ARNs, endpoint names, cluster names). |
| 53 | 4. **Region and availability zone** — identify the AWS region and, if known, the |
| 54 | specific availability zone(s) affected. |
| 55 | 5. **Symptoms** — note the observed symptoms (latency spikes, 5xx errors, |
| 56 | connection timeouts, throttling, capacity errors). |
| 57 | |
| 58 | Use these details as filter criteria in subsequent steps. |
| 59 | |
| 60 | --- |
| 61 | |
| 62 | ## Step 2: Search Health Events |
| 63 | |
| 64 | Use the AWS Health API `DescribeEvents` operation to retrieve events matching |
| 65 | the incident context. All calls must target the **us-east-1** endpoint. |
| 66 | |
| 67 | ### API call pattern |
| 68 | |
| 69 | ``` |
| 70 | aws health describe-events \ |
| 71 | --region us-east-1 \ |
| 72 | --filter '{ |
| 73 | "services": ["<SERVICE_CODE>"], |
| 74 | "startTimes": [{"from": "<ISO-8601-start>"}], |
| 75 | "regions": ["<affected-region>"], |
| 76 | "eventStatusCodes": ["open", "closed"], |
| 77 | "eventTypeCategories": ["issue", "scheduledChange", "accountNotification"] |
| 78 | }' \ |
| 79 | --max-results 100 |
| 80 | ``` |
| 81 | |
| 82 | ### Filtering strategies |
| 83 | |
| 84 | | Strategy | How to Apply | |
| 85 | |----------|-------------| |
| 86 | | By service | Use the `services` filter with the AWS Health service code (e.g., `EC2`, `RDS`, `ELASTICLOADBALANCING`), because service-specific events are most likely to correlate with the incident. | |
| 87 | | By time range | Use `startTimes` with a `from` value set to 7 days before the incident start, because events that started before the incident may still be active and causing impact. | |
| 88 | | By region | Use the `regions` filter to scope events to the affected region, because regional events are more likely to impact the specific resources under investigation. | |
| 89 | | By availability zone | Use the `availabilityZones` filter when the incid |