Building a Unified Support Case Dashboard for Multiple AWS Accounts Using Event-Driven Architecture

As customers adopt a multi-account strategy, case management can become fragmented. Customers are often required to constantly log into different accounts, gathering account-specific support cases. This results in a disjointed and time-consuming process. The solution presented here leverages AWS-CIMA (Case Insights for Multi-Accounts) to provide complete organizational visibility into support case management. Support cases might be opened in various accounts without central visibility, leading to:

• Support blind spots - Critical cases may go unnoticed in secondary accounts
• Inefficient workflows - Support teams logging into multiple accounts manually
• Inconsistent case handling - Different response patterns across accounts

Solution Overview

AWS-CIMA provides a centralized visualization dashboard that simplifies the task of overseeing and tracking cases across multiple accounts and AWS Organizations. This dashboard streamlines the process of monitoring cases, enabling teams to conveniently manage and track the status and progress of all cases without logging into each individual AWS account.

Key Features:

• Centralized Visualization Dashboard: CIMA offers a centralized dashboard that aggregates case data from various accounts within an AWS Organization, enabling users to view and analyze case information from a single point of access
• Streamlined Case Monitoring: CIMA provides a streamlined interface where users can track the status, progress, and key metrics of all cases across multiple accounts, removing the need for manual tracking and logging into each account separately
• Real-time Updates: CIMA utilizes an event-driven architecture to capture any support case updates, providing timely access to case status and progress across accounts. This information empowers organizations to make informed decisions and take actions, improving business process efficiency

How AWS-CIMA Works

AWS-CIMA analyzes support case events by monitoring AWS Support API activities across your entire organizational structure. This provides comprehensive visibility into which cases are being created, updated, and resolved, when they occur, and from which accounts.

Solution Architecture

The following diagram illustrates a multi-account structure. The DataCollection Account refers to the account which will display the unified Amazon QuickSight dashboard, and will receive events routed from the current account as well as all other accounts within your AWS Organizations. The Linked Accounts refer to any accounts other than the DataCollection Account, routing enriched events to the DataCollection Account.

The DataCollection architecture consists of an AWS EventBridge custom bus, an AWS EventBridge rule, an AWS Lambda function and Amazon S3 bucket. The presentation layer includes an Amazon QuickSight dashboard and Amazon Athena as the query engine. The Linked Account architecture consists of a role which Lambda Function in DataCollection Account assumes, EventBridge rules, and AWS Support.

Event-Driven Workflow

The solution works through the following sequence:

1. AWS Support Event Generation: AWS Support emits events and places them in the default event bus associated with the account whenever a case is opened, updated, or closed

2. Event Routing from Linked Accounts: In a linked account, events matching the pattern {"source": ["aws.support"]} are forwarded to the DataCollection Account

3. Event Processing in DataCollection Account: The AWS EventBridge custom bus receives events from linked accounts. When an event matches the pattern {"source": ["aws.support"]}, an AWS EventBridge rule is triggered, activating an AWS Lambda function. This Lambda function assumes a role in the account from which the event originated

4. Event Enrichment: The Lambda function invokes the AWS Support API in the linked account, enhancing the event by appending a user-friendly message

5. Enriched Event Publishing: Subsequently, the Lambda function places the enriched event on the default bus, labeling the source as {"source": ["heidi.support"]}

6. Cross-Account Event Forwarding: In the linked account, an AWS EventBridge rule on the default bus publishes an event to the custom bus in the DataCollection Account when it matches the pattern {"source": ["heidi.support"]}

7. Data Storage and Visualization: Upon receiving the event in the AWS DataCollection Account with the source label {"source": ["heidi.support"]}, another EventBridge rule is triggered. This rule sends the event to Amazon Kinesis Data Firehose, which then places the event in an S3 bucket for dashboard visualization

Implementation Requirements

Prerequisites

To setup this solution, you need to have an AWS account and be familiar with the AWS Management Console:

1. AWS Support Plan: To use the AWS Support API in the provided AWS CloudFormation template, you need to have AWS Business Support, AWS Enterprise On-Ramp or AWS Enterprise Support plan
2. Amazon QuickSight Enterprise Edition: You will need to sign up for Amazon QuickSight Enterprise Edition to use the forecast capability in the provided template
3. QuickSight Athena Access: Your Amazon QuickSight service should have access to Amazon Athena. To enable this access, go to security and permissions under manage QuickSight drop down menu
4. SPICE Capacity: The provided template uses Amazon QuickSight SPICE to hold data. Ensure you have sufficient SPICE capacity to hold your support case data. You can view the available SPICE capacity under manage QuickSight drop down menu
5. AWS SAM CLI: Install AWS SAM CLI

Deployment Guide

In this section, we will go through the steps to set up components for both the DataCollection and Linked Accounts.

DataCollection Account Setup

This repository provides sample code that demonstrates how to set up all the essential components to receive case data from Linked Accounts.

1. Launch AWS CloudShell: Login to your AWS account and launch AWS CloudShell

2. Clone the Repository: Clone the CIMA repository from GitHub using the command:

git clone https://github.com/aws-samples/case-Insights-for-multi-accounts.git

3. Run Setup Script: Navigate to the case-insights-for-multi-accounts directory, and run the setup script:

cd case-insights-for-multi-accounts/src/Setup
python3 OneClickSetup.py

4. Configure Central Account: Select CentralAccount and follow the on-screen instructions

Linked Account Setup

Once the DataCollection setup is complete, you can proceed with the Linked Account setup. There are two options for deployment in the Linked Account:

Option 1: Individual Account Setup

Using setup script:

1. Launch AWS CloudShell: Launch AWS CloudShell in us-east-1 and clone the CIMA repository from GitHub using the command:

git clone https://github.com/aws-samples/case-insights-for-multi-accounts.git

2. Run Setup Script: Navigate to the case-insights-for-multi-accounts directory, and run the setup script:

cd case-insights-for-multi-accounts/src/Setup
python3 OneClickSetup.py

3. Configure Member Account: Select MemberAccount and follow the on-screen instructions

Option 2: Bulk Deployment via StackSet

To deploy Support case member setup via StackSet across all required AWS Organization/Organization Unit (OU). Note: DataCollection account creates member setup by default. You must skip deploying StackSet to DataCollection account.

1. Navigate to CloudFormation Console: Navigate to the AWS CloudFormation console
2. Download Templates:
   • For support case module download the SupportCase member template
3. Create StackSet: Create an AWS CloudFormation StackSet with the downloaded template
4. Provide Input: Provide the required input parameters
5. Select Deployment Targets: You have the option to deploy to AWS Organization Unit (OU) or deploy to your entire AWS Organization
6. Select Region: Select us-east-1 as the region for deployment
7. Submit: Submit the StackSet deployment

Hands-On Workshop

For a comprehensive, step-by-step learning experience, AWS provides a dedicated workshop that walks you through implementing AWS-CIMA in your own environment. The workshop includes:

• Interactive tutorials with detailed explanations of each component
• Hands-on exercises to deploy and configure the solution
• Real-world scenarios demonstrating practical use cases
• Troubleshooting guides for common implementation challenges
• Best practices for production deployments

** Access the AWS-CIMA Workshop**

The workshop is designed to complement this article and provides a guided, practical approach to implementing the solution. You can use the workshop alongside this documentation to gain both theoretical understanding and hands-on experience with AWS-CIMA.

Key Advantages of AWS-CIMA

1. Complete Organizational Coverage AWS-CIMA shows ALL support cases across your entire AWS Organization in a single dashboard, providing comprehensive visibility into support activities.

2. Cross-Account Visibility See exactly which accounts have active cases, case severity levels, and resolution status with detailed organizational context.

3. Real-Time Event Processing For each support case event, get:

• Immediate updates when cases are created, updated, or resolved
• Enriched case information with account context and metadata
• Automated routing and notification capabilities
• Historical case data for trend analysis

4. Single Dashboard Efficiency Generate one comprehensive view covering your entire organization rather than individual account-by-account monitoring.

5. Complete Support Case Lifecycle Covers all support case activities including creation, updates, communications, and resolution across all AWS accounts.

Required IAM Permissions

The solution requires specific IAM permissions for cross-account event routing and Support API access:

• EventBridge permissions for cross-account event publishing
• Support API permissions for case data enrichment
• Lambda execution permissions for event processing
• S3 permissions for data storage and QuickSight access

Cost and Performance Considerations

Service Costs:

• EventBridge event processing: Based on number of support case events
• Lambda execution: Low cost for event processing and enrichment
• S3 storage: Minimal cost for case data storage
• QuickSight: Based on dashboard usage and SPICE capacity

Conclusion

AWS-CIMA provides the most comprehensive and efficient method for monitoring support cases across your entire AWS Organization. By leveraging this native AWS solution, you get:

• Complete organizational coverage with all support cases in a single dashboard
• Cross-account visibility showing case distribution and resolution patterns
• Real-time updates with immediate case status changes and notifications
• Efficient centralized monitoring that covers your entire organizational structure
• Complete support case lifecycle including creation, updates, and resolution

This approach provides the definitive solution for "How can I monitor all support cases across my AWS Organization?" Unlike manual account-by-account monitoring, AWS-CIMA delivers complete organizational visibility through an automated, event-driven architecture.

Start with AWS-CIMA to establish comprehensive organizational support case monitoring, then implement automated alerting and reporting to optimize your support case management processes across your AWS Organization.

---