Building centralized Health Dashboards for multi-account Organizations

Introduction

Managed service providers, consulting partners, or enterprises with a multi-account strategy encounter challenges when AWS Health Dashboard sends notifications to an individual account.

An organization that manages multiple linked accounts under a single payer encounters the following limitations:

• You don't have the ability to view health events across accounts.

• Operations teams must manually check dashboards one by one.

• Critical issues that affect multiple accounts go undetected.

• AWS Health tracks scheduled maintenance in spreadsheets instead of dashboards.

• You don't have visibility into the specific resources, such as Amazon Elastic Compute Cloud (Amazon EC2) instances and Amazon Relational Database Service (Amazon RDS) databases, that your notifications affect.

Solution overview

Use AWS Health API operations for Organizations in the management, or payer, account to access health events across all member accounts in an organization. Activate the AWS Health organizational view to aggregate AWS Health events across accounts. You can combine the AWS Health organizational view with serverless services to build a fully automated, centralized Health Dashboard with the following benefits:

• Real-time event aggregation across all linked accounts

• Affected resource identification, such as specific EC2 instances and Amazon RDS clusters

• Web dashboard with filtering and expandable event details

The solution consists of the following components:

• Amazon EventBridge Scheduler to invoke the AWS Lambda function at a set interval.

• A Lambda function that uses an AWS Health API to generate the dashboard and then uploads the dashboard to an Amazon Simple Notification Service (Amazon S3) bucket.

• An S3 bucket for users to access the dashboard.

Architecture overview

The solution uses a fully serverless architecture that you deploy within the payer account. For example, see the following AWS Health Notification Dashboard Architecture:

Solution implementation

Prerequisites

The centralized Health Dashboard requires the following prerequisites:

• You must use AWS Organizations with All Features activated.

• Create an S3 bucket to host the dashboard.

• You must have an AWS Business Support+, Enterprise Support, or Unified Operations plan for the payer account to access AWS Health.

• Run the following enable-health-service-access-for-organization command to activate organizational health view:

 aws health enable-health-service-access-for-organization
  --region us-east-1

Note: You must use the US East (N. Virginia) AWS Region endpoint.

Create an IAM role and attach a policy

Create an AWS Identity and Access Management (IAM) execution role for the Lambda function and attach a policy to the role that grants least privilege access.

Example policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "health:DescribeEventsForOrganization",
                "health:DescribeEventDetailsForOrganization",
                "health:DescribeAffectedAccountsForOrganization",
                "health:DescribeAffectedEntitiesForOrganization",
                "health:DescribeEntityAggregatesForOrganization",
                "health:DescribeHealthServiceStatusForOrganization"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "organizations:ListAccounts",
                "organizations:DescribeOrganization",
                "organizations:DescribeAccount"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::S3_BUCKET /*"
            ],
            "Effect": "Allow"
        }
    ]
}

Note: Replace S3_BUCKET with the name of your S3 bucket.

Create a Lambda function

Create a Python-based Lambda function. Configure the function to use the IAM execution role, and then increase the Lambda function timeout configuration to 60 seconds.

Download the HealthDashboard code on the GitHub website.

Create the following environment variables in the Lambda code:

DASHBOARD_BUCKET	YOUR BUCKET NAME
HEALTH_API_REGION	us-east-1

In the following example image, the solution displays the health events in your organization:

Static website for the solution. For best practices on how to host a secure static website on Amazon S3, see Get started with a secure static website.

Event types that the dashboard captures

Category	Description	Examples
issue	Active service disruptions	EC2 connectivity issues, RDS performance degradation
scheduledChange	Planned maintenance	Instance retirements, engine upgrades, maintenance windows
accountNotification	Account-level advisories	Security notifications, quota changes, billing updates

Cost

You incur costs to use serverless AWS services, such as Lambda, Amazon S3, and EventBridge. However, the cost scales with usage and is usually minimal for most organizations because all components use pay-per-use pricing with no upfront commitments. For example, the charge is approximately a few dollars each month for an organization that manages 50 linked accounts.

For pricing details, see the following service pricing pages:

• AWS Lambda pricing

• Amazon S3 pricing

Conclusion

Managing health notifications across a multi-account organization doesn't need to be a manual, reactive process. The dashboard gives your Operations team proactive visibility into every health event across your entire organization. AWS Enterprise Support customers can work with their Technical Account Manager (TAM) to customize this solution. For more information about AWS Support plans, see Compare AWS Support plans.

About the author

Rajat Antil is a Technical Consultant at AWS with experience in cloud infrastructure, operations, and automation. A passionate technology enthusiast, he enjoys solving complex problems, automating mundane tasks, and building solutions for large scale enterprises that are secure, scalable, and resilient.

Anant Jain is a Technical Consultant at AWS specializing in storage, resilience, and networking. He architects data protection and migration solutions for large-scale enterprise customers, helping them build secure, highly available cloud infrastructures. As a trusted advisor, he partners with organizations to design tailored cloud strategies that align technical solutions with business objectives.