health

AWS Health events, by the AWS Health API

Returns how many AWS service issues are open, how many scheduled changes and account notifications are open or upcoming, and which services the open issues touch, read through the AWS Health API with an access key that may only read. The AWS Health API serves only an account with a Business, Enterprise On-Ramp or Enterprise support plan: any other account stops the collector misconfigured, with a message that says so. Three watches are offered, each one set on the probe.

Versions

Generic: the AWS Health API is one service for every account, version 2016-08-04, reached at its endpoint health.us-east-1.amazonaws.com for every region.

How it works

POST https://health.us-east-1.amazonaws.com/, the headers Content-Type: application/x-amz-json-1.1 and X-Amz-Target: AWSHealth_20160804.DescribeEvents, the body {"filter":{"eventStatusCodes":["open","upcoming"]},"maxResults":100}, with "regions":[…] in the filter when aws:health-regions is set, signed by aws.sign (Signature Version 4, region us-east-1, service health), page after page by nextToken. The API speaks the JSON protocol of AWS, where every action is a POST: this one only reads.

{"events": [{"arn": "…", "service": "EC2", "eventTypeCode": "AWS_EC2_OPERATIONAL_ISSUE", "eventTypeCategory": "issue", "region": "eu-west-3", "statusCode": "open", "startTime": 1793107815.0, …}], "nextToken": "…"}

• issues counts the events of the categories issue and investigation (AWS investigating a possible issue) whose status is open; issue-names writes each of them <service> <eventTypeCode> (<region>), joined by | .
• scheduled counts the events of the category scheduledChange, notifications those of the category accountNotification, open or upcoming.
• The events are those of the account and the public events of AWS, of every region unless aws:health-regions names some: a public issue of a service the account does not use is counted too. The regions are written as AWS writes them, separated by commas, and global names the services without a region.
• A code 400 with SubscriptionRequiredException stops the collector misconfigured, and says that the support plan is missing; any other code 400, 401 or 403 stops it misconfigured, with the error type AWS writes (UnrecognizedClientException, AccessDeniedException…); a throttled request (ThrottlingException), a code 500 or above, or any other code but 200 stops it unreachable.

The keys come from protocol:aws: the secret key never leaves the poller, only the signature it makes. Neither the body nor the answer is secret.

Prerequisites

• An AWS account with a Business, Enterprise On-Ramp or Enterprise support plan.
• An IAM user with an access key, or a role whose temporary keys are set with their session token, allowed this action and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "health:DescribeEvents", "Resource": "*" }
  ]
}

The access key ID goes in protocol:aws:access-key-id, the secret key in protocol:aws:secret-access-key, the session token, for temporary keys only, in protocol:aws:session-token.

• The poller reaches health.us-east-1.amazonaws.com in HTTPS, and its clock is right within a few minutes: AWS refuses a request signed more than fifteen minutes away from its own time. The certificates of AWS are issued by public authorities: the profile "Standard" trusts them.

Variables

Outputs

Watches

Limits

• AWS Health has a second endpoint, health.us-east-2.amazonaws.com, active when the first is not; the collector reads the first only, and a failover of AWS Health shows as unreachable.
• The events of the other accounts of an AWS Organization (the organizational view) are not read.
• Not checked against an AWS account: the action, its body and its fields are those of the AWS Health API Reference ("DescribeEvents", "Welcome": the endpoint and the support plans); the protocol (JSON 1.1), the target prefix AWSHealth_20160804 and the enumerations of the categories and the status are those of the service model AWS publishes with its SDK for Python (botocore, health/2016-08-04), the reference giving neither.