Building Incident Management with AWS Health Dashboard - Automating Outage Notifications and Impact Analysis
A comprehensive guide covering service outage detection, automated notifications via EventBridge integration, and organization-wide impact analysis through Organizations integration.
Two Views of the Health Dashboard
The Health Dashboard provides two views: Service Health (operational status of over 200 AWS services) and Account Health (events affecting your specific account). Service Health displays the overall operational status of AWS services, allowing you to check service outages by region. Account Health shows only events that affect your account, providing resource-specific information such as EC2 instance maintenance schedules, planned RDS failovers, and EBS volume failure notifications. Account Health events include the ARNs of affected resources, enabling you to immediately identify which resources require action. Events are classified into three categories: issue (outage), accountNotification (planned maintenance), and scheduledChange (planned change), each with different urgency levels. Issues require immediate response, while scheduledChanges allow days to weeks of lead time. Designing notification targets and escalation rules per category minimizes operational burden.
Automated Notifications via EventBridge Integration
Health events are automatically sent to EventBridge, so you can use event rules to filter specific event types and route them to Lambda or SNS. A typical workflow involves automatically posting EC2 maintenance notifications to a Slack channel with a list of affected instances attached. You can also implement automated responses where a Lambda function receives Health events, temporarily removes affected instances from an Auto Scaling group, and restores them after maintenance is complete. When combined with AWS Chatbot, rich Health event notifications are automatically posted to Slack channels. In the EventBridge rule event pattern, specify source as aws.health and detail-type as AWS Health Event, then further filter by detail.service or detail.eventTypeCategory. Rules in the us-east-1 region are required to receive global events (IAM, Route 53, CloudFront outages); rules in other regions only receive regional service events. Overlooking this design causes missed notifications for global service outages.
Organizations Integration and Organization-Wide Monitoring
By enabling the Organizations Health API (Organizational View), you can aggregate and review Health events from all accounts in your organization through the management account or a delegated administrator account. For large organizations operating hundreds of accounts, checking individual account Health Dashboards is impractical. Organizational View lets you centrally monitor events across all accounts and prioritize responses for high-impact events. The recommended approach is to use EventBridge rules to aggregate organization-wide Health events and send consolidated notifications to security and operations teams. For a systematic study of Health Dashboard from basics to advanced topics, books on Amazon are a great resource.
Incident Response Workflow Design Patterns
Incident response with Health Dashboard at its core is designed in three stages. Stage 1 (Detection): EventBridge rules receive events and immediately notify operations staff via SNS. Stage 2 (Triage): A Lambda function retrieves the list of affected resources and automatically creates an OpsItem in Systems Manager OpsCenter. The OpsItem includes related CloudWatch alarms, affected resource ARNs, and recommended actions, allowing responders to begin remediation from a single pane of glass. Stage 3 (Auto-remediation): Systems Manager Automation runbooks execute standard responses (instance restart, restore from snapshot, DNS failover) without human intervention. This three-stage design increases the number of cases where recovery completes before the on-call engineer wakes up during nighttime incidents. For integration with PagerDuty or Opsgenie, a design that automatically selects the escalation policy based on the Health event severity field is effective.
Differentiating from CloudWatch and Other Services
Health Dashboard notifies about AWS infrastructure-side outages, while CloudWatch Alarms detect anomalies in application metrics. The two are complementary and should be used together. For example, EBS volume I/O errors are notified through Health Dashboard, while volume IOPS throttling is detected via CloudWatch metrics. Trusted Advisor detects configuration risks (open security groups, underutilized resources) but does not provide real-time outage notifications. AWS Fault Injection Simulator (FIS) is a chaos engineering tool for intentionally injecting faults and can be used to verify that Health Dashboard notification pipelines function correctly. Systems Manager Incident Manager integrates the incident lifecycle (detection, escalation, response, retrospective) and in large organizations, auto-creating incidents triggered by Health Dashboard events is standard practice.
Health Dashboard Pricing
The Health Dashboard is free to use. There are no additional charges for viewing Service Health and Account Health or for sending events to EventBridge. The Health API (Organizations Organizational View) is also free. The only costs incurred are for EventBridge rule executions (approximately $1 per million events) and the usage fees for notification targets like SNS and Lambda. As a free security foundation that should be enabled across all AWS accounts, there is no reason not to adopt it. The largest actual cost impact comes from Lambda function execution fees, but Health event frequency is typically a few to a few dozen events per account per month, well within Lambda's free tier (1 million requests per month).
Summary
The Health Dashboard is a service that provides real-time notifications about AWS service outages and account-specific events. Build automated notifications and automated responses through EventBridge integration, and centrally monitor organization-wide impact through Organizations integration. Design a three-stage incident response workflow (detection, triage, auto-remediation) and combine with CloudWatch Alarms and Incident Manager to achieve hands-free outage recovery.