Dependency validation

Focuses on in-Region dependency failures.

You choose which dependencies to target.

If you have enabled dependency discovery in the next generation of Resilience Hub, you can pick from discovered dependencies. If not, you can enter DNS endpoints manually.

This is a sustained test. The test passes if all success alarms remain in OK state until the test actions end. Use this to validate soft dependencies are truly soft – if your alarms breach, the dependency may actually be hard.

Start with a single soft dependency and build up – validate one at a time before blocking many.

If you include a hard dependency, expect your alarms to breach and the test to fail – hard dependencies cause significant impact when blocked. This is useful to confirm that a dependency is truly hard.

Choose success alarms that measure overall service health, not the health of the dependency itself.

Ensure your dependencies are actively used during the test (traffic is flowing to them) – this validates the block is having an effect. Consider adding alarms or metrics that track dependency usage (for example, request count or connection errors) to verify that the dependency is being exercised during the test.

Dependencies must be resolvable DNS endpoints – if the DNS doesn't resolve, the action will fail.

Blocking dependencies that trigger health check failures may cause compute (for example, Amazon ECS tasks) to be replaced. The packet loss action does not re-apply to replacement tasks and may report as failed.

Duration – The length of time the test actions run. It takes a few additional minutes afterward to collect final results before the test ends. Default is 30 minutes when you first create the test.

Dependencies to block – By default, the discovered soft dependency with the highest query volume is pre-selected. If no dependencies have been classified as soft, none are selected. You can adjust to target individual dependencies or specific groups, or manually add dependencies by DNS domain name. Additional dependencies added here are only used for this test and will not be saved to the service's dependency discovery. These defaults apply in the console; when using the API, you provide the dependencies explicitly.