Request an Incident Response
If a critical incident occurs on your workload that isn't detected by alarms monitored by AWS Incident Detection and Response, you can create a support case to request an Incident Response. You can request an Incident Response for any workload that's subscribed to AWS Incident Detection and Response, including workloads in the process of onboarding, using the AWS Support Center Console, AWS Support API, or AWS Support App in Slack.
The following diagram illustrates the end-to-end workflow for an AWS customer requesting incident assistance from the Incident Detection and Response team, detailing the steps from the initial request through investigation, mitigation, and resolution.
To request an Incident Response for an incident that's actively impacting your workload, create an Support case. After the support case is raised, AWS Incident Detection and Response engages you on a conference bridge with the AWS experts required to accelerate the recovery of your workload.
Request an Incident Response using the AWS Support Center Console
To request an incident response, complete the following steps:
-
Open the AWS Support Center Console
to create a new support case. -
For Subject, enter a brief summary of the incident. For example,
AWS Incident Detection and Response - Active Incident - workload_name. -
For Description, enter the details of the incident. We recommend that you include the following details in your support case:
Affected AWS resource ARN(s), workload name and its function
Description of impact to the business
(Optional) Your preferred conference bridge URL. If you don't provide bridge details, AWS Incident Detection and Response creates an AWS conference bridge and sends you an invitation with the bridge URL.
-
(Optional) Attach files that can help describe the incident, such as screenshots or log excerpts.
-
Configure the following case classification fields:
Case type: Technical
Service: Incident Detection and Response
Category: Active Incident
Severity: Business-critical system down
-
Provide additional context to help AWS Incident Detection and Response engage AWS experts faster, such as the impacted AWS service, impacted AWS Region, business impact, impact start time, and affected resources.
-
Choose Submit.
-
AWS Incident Detection and Response acknowledges your case within five minutes and engages you on a conference bridge with the appropriate AWS experts.
Request an Incident Response using the AWS Support API
You can use the AWS Support API to programmatically create support cases. For more information, see About the AWS Support API in the AWS Support User Guide.
Request an Incident Response using the AWS Support App in Slack
To use the AWS Support App in Slack to request an Incident Response, complete the following steps:
-
Open the Slack channel that you configured the AWS Support App in Slack in.
-
Enter the following command:
/awssupport create
-
Enter a Subject for this incident. For example, enter AWS Incident Detection and Response - Active Incident - workload_name.
-
Enter the Problem Description for this incident. Add the following details:
Technical Information:
Affected Service(s):
Affected Resource(s):
Affected Region(s):
Workload Name:
Business Information:
Description of impact to the business:
[Optional] Customer Bridge Details:
-
Choose Next.
-
For Issue Type, choose Technical support.
-
For Service, choose Incident Detection and Response.
-
For Category, choose Active Incident.
-
For Severity, choose Business-critical system down.
-
Optionally enter up to 10 additional contacts in the Additional contacts to notify field, separated by commas. These additional contacts receive copies of email correspondence about this incident.
-
Choose Review.
-
A new message that is only visible to you appears in the Slack channel. Review the case details, then choose Create case.
-
Your Case ID is provided in a new message from the AWS Support App in Slack.
-
Incident Detection and Response acknowledges your case within 5 minutes and engages you on a conference bridge with the appropriate AWS experts.
-
Correspondence from Incident Detection and Response is updated in the case thread.
