Incident Detection and Response (IDR)
Language: English
Content related to Incident Detection and Response (IDR)
6
Landing page for Incident Detection and Response (IDR) which includes articles to assist current and future IDR customers.
- Topics
- Management & Governance
IDR Alarm Best Practices
AWS Incident Detection and Response provides 24/7 proactive monitoring for critical workloads. These guides provide CloudWatch alarm configurations that detect business impact - metric names, thresholds, and periods validated across IDR customer workloads.
Choose your path:
- By Industry - Find alarm recommendations for your industry's workload patterns. See Customer Industries below.
- By AWS Service - Get alarm configurations for a specific service. See AWS Service Alarms below.
- Third-party APM - Integrate Dynatrace or Splunk with IDR. See IDR Guides below.
Quick Start: Start with Elastic Load Balancer, ECS/EKS, and RDS. These three layers cover the critical path for most workloads.
Critical Path Model
User -> CDN -> Load Balancer -> Compute -> Database
| | | |
CloudFront ELB ECS/EKS RDS
Alarm on services in the request path that directly impact end users.
IDR Alarm Best Practices - Customer Industries
Looking for baseline CloudWatch alarm recommendations by AWS service? See the AWS Service Alarms section below. The industry pages below identify which services sit on the critical path for your industry, why they matter, and where thresholds may differ from the defaults.
How to Use This Guide
- Start with baseline alarms — Configure alarms for your core AWS services using the service-specific articles.
- Find your industry below — Add industry-specific alarms and considerations from your industry page.
- Request help — Contact your AWS account team or raise a support case for assistance identifying appropriate alarms for your workload.
Industries
| Industry | Key Workload Patterns |
|---|---|
| Sports | Event-driven, live scoring, ticket sales |
| Retail & CPG | Flash sales, seasonal peaks, order fulfillment |
| Financial Services | Real-time transactions, compliance, low-latency |
| Healthcare & Life Sciences | EHR systems, telemedicine, clinical data exchange |
| Media & Entertainment | Live streaming, VOD, content delivery |
| Telecommunications | 5G core, RAN, OSS/BSS |
| Games | Multiplayer, matchmaking, leaderboards |
| Public Sector | Emergency response, social services, education |
| Energy & Utilities | SCADA, grid monitoring, IoT telemetry |
| Automotive & Manufacturing | Connected vehicles, supply chain, IoT |
| Travel & Hospitality | Booking engines, loyalty, seasonal demand |
Workload Patterns (Cross-Industry Guide)
Not sure which industry page fits your workload? Use the patterns below:
| Workload Pattern | Characteristics | Relevant Industries | Key Alarm Strategy |
|---|---|---|---|
| Event-driven / Bursty | Spiky traffic tied to events or sales | Sports, Retail, Games | Anomaly detection, dynamic thresholds, pre-event validation |
| Steady-state / Mission-critical | Consistent traffic, zero-downtime requirements | Healthcare, Financial Services, Public Sector | Static thresholds, breaching on missing data, tight SLOs |
| Real-time Streaming | Low-latency media or data delivery | Media, Sports, Games | Latency-focused alarms, processing lag, buffer/queue metrics |
| IoT / Edge | High device count, telemetry ingestion | Automotive, Energy, Telco | Connection state, message throughput, device shadow metrics |
IDR Alarm Best Practices - AWS Service Alarms
Production-ready CloudWatch alarm configurations for many AWS services. Each article provides metric names, statistics, periods, and thresholds.
Compute and Containers
| Service | Description |
|---|---|
| EC2 | Detect instance status check failures |
| ECS | Container orchestration - detect running task count drops and CPU/memory saturation |
| EKS | Kubernetes clusters - detect pod failures, crash loops, node failures, and API server errors |
| Lambda | Detect error rates, throttling, and concurrency limits |
| SageMaker | ML inference endpoints - detect invocation errors, model latency, and traffic drops |
Networking and Content Delivery
| Service | Description |
|---|---|
| API Gateway | Detect 4XX/5XX error rates, latency, and integration errors |
| CloudFront | Detect elevated 5XX error rates from your CDN |
| Direct Connect | Dedicated network link - detect connection state changes, errors, and bitrate drops |
| Elastic Load Balancer | Detect 5XX spikes, unhealthy targets, and rejected connections |
| Network Firewall | Traffic inspection - detect TLS inspection errors |
| Route 53 | Detect health check failures, DNSSEC issues, and resolver endpoint degradation |
| Transit Gateway | Cross-VPC networking - detect blackhole drops, no-route drops, and traffic loss |
| VPN | Detect tunnel state changes (up/down) |
Databases and Caching
| Service | Description |
|---|---|
| Amazon Aurora | Detect connection exhaustion, replication lag, read/write latency, and storage pressure |
| DynamoDB and DAX | Detect system errors, read/write throttle events, latency, and replication lag |
| ElastiCache | In-memory caching - detect memory saturation, connection spikes, and CPU utilization |
| OpenSearch | Search and analytics - detect cluster red status, storage exhaustion, and blocked writes |
| RDS | Detect disk queue depth, storage exhaustion, replication lag, and read/write latency |
| Redshift | Data warehouse - detect health status failures, disk space, and read/write latency |
Messaging and Streaming
| Service | Description |
|---|---|
| Amazon MQ | Message broker - detect connection loss, storage exhaustion, and unacknowledged messages |
| Amazon MSK | Managed Kafka - detect offline partitions, replication issues, and consumer lag |
| EventBridge | Detect failed invocations, DLQ delivery failures, and throttled rules |
| Kinesis Data Streams | Real-time streaming - detect throughput exceeded, iterator age growth, and failed records |
| SNS | Detect notification failures, filtered-out messages, and DLQ redirects |
| SQS | Message queuing - detect queue backlog growth and stale messages |
| Step Functions | Detect execution failures, timeouts, and throttled executions |
Storage
| Service | Description |
|---|---|
| EFS / FSx | File storage - detect I/O limits, throughput saturation, and storage capacity pressure |
| S3 | Detect 5XX errors, replication latency, and request latency |
Migration
| Service | Description |
|---|---|
| DMS | Database migration - detect CDC replication delays and storage exhaustion |
Specialty Services
| Service | Description |
|---|---|
| Amazon Connect | Contact center - detect concurrent capacity limits, contact flow errors, and recording failures |
| Amazon Lex V2 | Conversational AI - detect system errors, throttling, Lambda failures, and Polly errors |
| Elemental Media Services | Live/VOD media - detect encoding quality drops, output 5XX errors, and transcoding failures |
| IoT | Device fleet communication - detect connection failures, publish errors, and throttling |
| Outposts | On-premises AWS infrastructure - detect service link and BGP session failures |
IDR Guides
2 Comments
Relevant content
asked 2 years ago
