Notice: This Workshop requires a laptop computer and an active AWS account with Administrator privileges. It can be challenging to optimize AWS resources across cost, performance, security, and fault tolerance, much less do it automatically. AWS Trusted Advisor, an online resource, provides real-time guidance to help you provision your resources following AWS best practices. AWS Health provides ongoing visibility into the state of your AWS resources and remediation guidance for resource performance or availability issues that may affect your applications. Learn how to safely automate these best practices using Amazon CloudWatch Events and AWS Lambda, with samples for you to use. We also introduce you to AWS Health tools, a community-based source of tools to automate remediation actions and customize health alerts. See how to automate AWS best practices from Trusted Advisor and implement remediation from the AWS Health API on your AWS resources. Attendees should bring their own laptops.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:Invent
Automate Best Practices and Operational
Health for AWS Resources with AWS
Trusted Advisor and AWS Health
T i p u Q u r e s h i H o M i n g L i S c o t t A l l i s o n H a s a n K h a n
E N T 3 3 8
N o v e m b e r 3 0 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What to expect from this session:
• Learn about AWS Trusted Advisor best practices
• Get familiar with AWS Health and the Personal Health
Dashboard (PHD)
• Learn how to automate remediation actions and
customize Health alerts using AWS Lambda and
Amazon CloudWatch events

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What’s in your AWS accounts?

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
As you expand and change, entropy starts increasing

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Too much complexity… it’s time to optimize!

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is Trusted Advisor?
AWS Trusted Advisor (TA) provides best practices
(or checks) in four categories: cost optimization, security,
fault tolerance, and performance improvement.
Red (action recommended)
Yellow (investigation recommended)
Green (no problem detected)

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Trusted Advisor
Over 50 million recommendations
provided to AWS customers
resulted in $500M+ in cost savings
for users of Trusted Advisor

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How does it work?

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Case study: Hungama Digital Media
“We estimate an average 33 percent monthly savings on our total AWS spend.”
- Amit Vora, CTO for Hungama
How did Trusted Advisor help Hungama? It highlighted the three following
things:
• Underutilized EC2 Instances
• Amazon EC2 Reserved Instances
• Underutilized Amazon EBS Volumes

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
New features
CloudWatch Metrics Integration
• Shows check status trends over time
• Allows custom service limit alert thresholds
• Provides customizable alerts for individual checks
Service Limit Dashboard
• Provides detailed data about service utilization against 39 limits
across 10 services
• Each limit is an independently refreshable and retrievable check

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Using Trusted Advisor as a web service
Poll a Trusted Advisor check for status changes
Request a Trusted Advisor check result
describeTrustedAdvisorCheckResult(checkResultRequest);
DescribeTrustedAdvisorCheckRefreshStatusesResult
.withCheckIds(java.util.Arrays.asList(checkId)));

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Building automation
AWS Trusted
Advisor
AWS
Lambda
Actions on AWS resources
Amazon
CloudWatch
Events
Notifications

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
With (not so) great automation come great risks
Production databases/instances could be considered idle
- Low traffic period
- Different system resource (ex: memory) might be in use

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Automation setup—safety first!
Tag resources subject to TA optimization
actions
Create an IAM policy and role for the
Lambda function to use
Setup up a CloudWatch event rule to
trigger the Lambda function
Setup the Lambda function to take
actions recommended by Trusted Advisor

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Let’s look at an example
You, an AWS customer, use many EC2 instances to power your
applications.
But how do you know that the instances you pay for are being
fully utilized?
• Are the instances you’ve purchased the right size for the
workloads you have?
• Can you achieve cost-savings by combining workloads from
several instances onto a single instance?

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scenario 1
Stop Low Utilization EC2 Instances
amzn.to/WorkshopAutomateTAHealth
T r u s t e d A d v i s o r A u t o m a t i o n

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Low Utilization Amazon EC2 Instances
Warns when EC2 instances appear to be underused
Alert Criteria
Yellow: An instance had 10% or less daily average CPU
utilization and 5 MB or less network I/O on at least 4 of the
previous 14 days
Recommended Action
Consider stopping or terminating instances that have low
utilization

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Show me the money!

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Examples available in GitHub
https://github.com/aws/Trusted-Advisor-Tools
Trusted Advisor Best Practices
https://aws.amazon.com/premiumsupport/trustedadvisor/best-practices/

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Health and Personal Health Dashboard
(PHD)
AWS service health, notifications, and automation

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PHD
Amazon
CloudWatch
Events
AWS Health and Personal Health Dashboard
Visibility and transparency
into your resources
Custom notifications and
automated actions
Remediation guidance
and knowledge articles

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Personal Health Dashboard

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Increased transparency and visibility:
- Service Health Dashboard too generic
- Increased transparency into underlying infrastructure
- Remediation guidance for faster time-to-resolution
- AWS Health API for easy integration
- Custom notifications with predictable delivery
- Automated actions for auto-remediation

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How does the Personal Health
Dashboard work?

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS services and
resources you use
Personal Health
Dashboard
••describe-events
••describe-event-details
••describe-affected-entities
••…
API
••Set rules to extract events of
interest
••Set targets for rules (Amazon
SNS, Amazon SQS, AWS
Lambda, Amazon Kinesis)
Push notifications
through
CloudWatch
Events
Health
Service
In-house or
third-party
monitoring
and event
management
systems

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Collects AWS Service
changes and pulls them
into Datadog
• Creates events with
structured title, tags,
description, and affected
entities
• Datadog customers can
view these in a feed, add
them to dashboards, and
create alerts to get notified
as soon as AWS is having
issues
AWS Health <> Datadog integration

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Getting started with the Personal Health Dashboard
- From AWS Service Health Dashboard
- From AWS website
- From AWS Management
Console navigation bar alert

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tools
• Automated actions in response to AWS Health events
• Open source, community driven
• Customized alerts in response to AWS Health events

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How does it work?

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scenario 2
Send Custom Texts
When an Issue Occurs
amzn.to/WorkshopAutomateTAHealth
A W S H e a l t h A u t o m a t i o n

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
This tool can be used to send custom text or SMS
notifications via Amazon SNS when an AWS Health event
happens by using AWS Lambda and Amazon CloudWatch
Events
https://github.com/aws/aws-health-tools/tree/master/sms-notifier
Launch the CloudFormation Stack
AWS Health SMS Notifier

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
It could be done with Slack, too!

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scenario 3
Pause a Deployment
When an Issue Occurs
amzn.to/WorkshopAutomateTAHealth
A W S H e a l t h A u t o m a t i o n

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Health Issue: Amazon CloudWatch event
trigger AWS CodePipeline disable stage
transition using AWS Lambda
You can automatically stop a deployment when an
Amazon EC2 issue occurs by disabling the stage transition
in AWS Code Pipeline in response to an AWS Health Issue
CloudWatch event

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

40. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS CodePipeline stage transition disabled:

41. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scenario 4
Stop and Start EC2 Instances
Automatically When a Retirement
Notification is Received (Extra Credit)
A W S H e a l t h A u t o m a t i o n
amzn.to/WorkshopAutomateTAHealth

42. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon EC2 Systems Manager
A set of capabilities that...
...enable automated configuration...
...and ongoing management of systems at scale...
...across all of your Windows and Linux workloads...
...running in Amazon EC2 or on-premises…
...at no charge; only pay for AWS resources you manage

43. Amazon EC2 Systems Manager
Run Command State Manager Inventory Maintenance Window
Patch Manager Automation Parameter Store

44. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Take action on retired EC2 instances

45. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Conclusion
You can leverage AWS Trusted Advisor and AWS Health
to automate best practices and operational health.
The samples in the following open-source repos make it easy:
https://github.com/aws/aws-health-tools
https://github.com/aws/Trusted-Advisor-Tools/

46. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!