Integrate OpsCenter with other Amazon Web Services - Amazon Systems Manager
Amazon CloudWatchAmazon CloudWatch Application InsightsAmazon DevOps GuruAmazon EventBridgeAmazon ConfigAmazon Security HubIncident Manager
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Integrate OpsCenter with other Amazon Web Services

OpsCenter, a capability of Amazon Systems Manager, integrates with multiple Amazon Web Services to diagnose and remediate issues with Amazon resources. You must set up the Amazon Web Service before you integrate it with OpsCenter.

By default, the following Amazon Web Services are integrated with OpsCenter and can create OpsItems automatically:

You have to integrate the following services with OpsCenter to create OpsItems automatically:

When any of these services create an OpsItem, you can manage and remediate the OpsItem from OpsCenter. For more information, see Manage OpsItems and Remediate OpsItem issues.

For more information about each Amazon Web Service and how it integrates with OpsCenter, see the following topics.

Amazon CloudWatch

Amazon CloudWatch monitors your Amazon resources and services, and displays metrics on every Amazon Web Service that you use. CloudWatch creates an OpsItem when an alarm enters the alarm state. For example, you can configure an alarm to automatically create an OpsItem if there is a spike in HTTP errors generated by your Application Load Balancer.

Some alarms that you can configure in CloudWatch to create OpsItems are shown in the following list:

  • Amazon DynamoDB: database read and write actions reach a threshold

  • Amazon EC2: CPU utilization reaches a threshold

  • Amazon billing: estimated charges reach a threshold

  • Amazon EC2: an instance fails a status check

  • Amazon Elastic Block Store (EBS): disk space utilization reaches a threshold

You can either create an alarm or edit an existing alarm to create an OpsItem. For more information, see Configure CloudWatch alarms to create OpsItems.

When you enable OpsCenter using Integrated Setup, it integrates CloudWatch with OpsCenter.

Amazon CloudWatch Application Insights

Using Amazon CloudWatch Application Insights, you can set up the most appropriate monitors for your application resources to continuously analyze data for signs of problems with your applications. When you configure application resources in CloudWatch Application Insights, you can choose to have the system create OpsItems in OpsCenter. An OpsItem is created on the OpsCenter console for every problem detected with the application. For information, see Set up, configure, and manage your application for monitoring in the Amazon CloudWatch User Guide.

Note

Starting October 16, 2023, the title and description for OpsItems created by CloudWatch Application Insights now use the following improved format:

OpsItem title: [<APPLICATION NAME>: <RESOURCE ID>] <PROBLEM SUMMARY>

OpsItem description:       

CloudWatch Application Insights has detected a problem in application <APPLICATION NAME>.
Problem summary: <PROBLEM SUMMARY>
Problem ID: <PROBLEM ID> (hyperlinks to the Application Insights problem summary page)
Problem Status: <PROBLEM STATUS>
Insight: <INSIGHT>

Here is an example:

Screen shot showing the new format of an OpsItem created from a CloudWatch Insight.

Amazon DevOps Guru

Amazon DevOps Guru applies machine learning to analyze your operational data, application metrics, and application events to identify behaviors that deviate from normal operating patterns. If you enable DevOps Guru to generate an OpsItem in OpsCenter, each insight generates a new OpsItem. You can use OpsCenter to manage your OpsItems.

DevOps Guru automatically creates OpsItems. You can enable Amazon DevOps Guru to create OpsItems by using Quick Setup, which is a capability of Systems Manager. The system creates OpsItems by using the AWSServiceRoleForDevOpsGuru Amazon Identity and Access Management (IAM) service-linked role.

To integrate OpsCenter with DevOps Guru

  1. Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

  2. In the navigation pane, choose Quick Setup.

  3. On the Customize DevOps Guru configuration options page, choose the Library tab.

  4. In the DevOps Guru pane, choose Create.

  5. For Configuration options, select Enable Amazon Systems Manager OpsItems.

  6. Select Create after you complete the setup.

Amazon EventBridge

Amazon EventBridge delivers a stream of events that describe changes in Amazon resources. When you enable OpsCenter using Integrated Setup, it integrates EventBridge with OpsCenter, and enables default EventBridge rules. Based on these rules, EventBridge creates OpsItems. Using rules, you can filter and route events to OpsCenter for investigation and remediation.

Note

Amazon EventBridge (formerly Amazon CloudWatch Events) provides all functionality of CloudWatch Events and some new features, such as custom event buses, third-party event sources and schema registry.

Following are some rules that you can configure in EventBridge to create an OpsItem:

  • Security Hub: security alert issued

  • Amazon DynamoDB a throttling event

  • Amazon Elastic Compute Cloud Auto Scaling: failure to launch an instance

  • Systems Manager: failure to run an automation

  • Amazon Health: an alert for scheduled maintenance

  • Amazon EC2: instance state changed from running to stop

Based on your requirements, you can either create a rule or edit an existing rule to create an OpsItems. For instructions on how to edit a rule to create an OpsItem, see Configure EventBridge rules to create OpsItems.

Amazon Config

Amazon Config provides a detailed view of the configuration of Amazon resources in your Amazon Web Services account.

Amazon Config does not integrate directly with OpsCenter. Instead, you create an Amazon Config rule that sends an event to Amazon EventBridge, such as when Amazon Config detects a noncompliant instance. Then EventBridge evaluates that event against an EventBridge rule you've created. If the rule matches, EventBridge transforms the event to an OpsItem and transmits it to OpsCenter as the destination target.

Using this OpsItem, you can track details of the noncompliant resource, record investigative actions, and provide access to consistent remediation actions.

Related info

Configure EventBridge rules to create OpsItems

Using Amazon Systems ManagerOpsCenter and Amazon Config for compliance monitoring

Amazon Security Hub

Amazon Security Hub collects security data, called findings, from across Amazon Web Services accounts and services. Using a set of rules to detect and generate findings, Security Hub helps you identify, prioritize, and remediate security issues for the resources you manage. After you configure integration, as described in this topic, Systems Manager creates OpsItems for Security Hub findings in OpsCenter.

Note

OpsCenter has bidirectional integration with Security Hub. This means that if you update the Status or Severity field for an OpsItem related to a security finding, the system synchronizes the changes with Security Hub. Likewise, any changes to a finding are automatically updated in the corresponding OpsItems in OpsCenter.

When an OpsItem is created from a Security Hub finding, Security Hub metadata is automatically added to the operational data field of the OpsItem. If this metadata is deleted, the bidirectional updates no longer function.

By default, Systems Manager creates OpsItems for critical and high severity findings. You can manually configure OpsCenter to create OpsItems for medium and low severity findings. OpsCenter doesn’t create OpsItems for informational findings as they don't require remediation. For more information about Security Hub severity levels, see Severity in the Amazon Security Hub API Reference.

Before you begin

Before you configure OpsCenter to create OpsItems based on Security Hub findings, verify that you completed the Security Hub set up tasks. For more information, see Setting up Security Hub in the Amazon Security Hub User Guide.

When you integrate Security Hub with OpsCenter, the system creates OpsItems by using the AWSServiceRoleForSystemsManagerOpsDataSync IAM service-linked role. For more information about this role, see Using roles to create OpsData and OpsItems for Explorer.

Warning

Note the following important information about pricing for OpsCenter integration with Security Hub:

  • If you are logged into the Security Hub administrator account when you configure OpsCenter and Security Hub integration, the system creates OpsItems for findings in the administrator and all member accounts. The OpsItems are all created in the administrator account. Depending on a variety of factors, this can lead to an unexpectedly large bill from Amazon.

    If you are logged into a member account when you configure integration, the system only creates OpsItems for findings in that individual account. For more information about the Security Hub administrator account, member accounts, and their relation to the EventBridge event feed for findings, see Types of Security Hub integration with EventBridge in the Amazon Security Hub User Guide.

  • For each finding that creates an OpsItem, you are charged the regular price for creating the OpsItem. You are also charged if you edit the OpsItem or if the corresponding finding is updated in Security Hub (which triggers an OpsItem update).

To configure OpsCenter to create OpsItems for Security Hub findings

  1. Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

  2. In the navigation pane, choose OpsCenter.

  3. Choose Settings.

  4. In the Security Hub findings section, choose Edit.

  5. Choose the slider to change Disabled to Enabled.

  6. If you want the system to create OpsItems for medium or low severity findings, toggle these options.

  7. Choose Save to save your configuration.

Use the following procedure if you no longer want the system to create OpsItems for Security Hub findings.

To stop receiving OpsItems for Security Hub findings

  1. Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

  2. In the navigation pane, choose OpsCenter.

  3. Choose Settings.

  4. In the Security Hub findings section, choose Edit.

  5. Choose the slider to change Enabled to Disabled. If you aren't able to toggle the slider, Security Hub hasn't been enabled for your Amazon Web Services account.

  6. Choose Save to save your configuration. OpsCenter no longer creates OpsItems based on Security Hub findings.

Important

A Systems Manager delegated administrator or the Amazon Organizations management account can enable Security Hub findings in OpsCenter for multiple accounts and Amazon Web Services Regions by creating a resource data sync in Explorer. If the Security Hub source is enabled in Explorer and a resource data sync exists that targets the member account where you disabled Security Hub integration, then the settings selected by your administrator take precedence. OpsCenter continues to create OpsItems for Security Hub findings. To stop creating OpsItems for Security Hub findings in a member account targeted by a resource data sync, contact your administrator and ask them to remove your account from the resource data sync or turn off the Security Hub source in Explorer. For information about changing settings in Explorer, see Editing Systems Manager Explorer data sources.

Incident Manager

Incident Manager, a capability of Amazon Systems Manager, provides an incident management console that helps you mitigate and recover from incidents affecting your Amazon hosted applications. An incident is any unplanned interruption or reduction in quality of services. After you set up and configure Incident Manager, the system automatically creates OpsItems in OpsCenter.

When the system creates an incident in Incident Manager, it also creates an OpsItem in OpsCenter, and displays the incident as a related item. If the OpsItem already exists, Incident Manager doesn't create an OpsItem. The first OpsItem is known as the parent OpsItem. If an incident grows in scale and scope, you can add incidents to an existing OpsItem. If required, you can manually create an incident for an OpsItem. After an incident is closed, you can create an analysis in Incident Manager to review and improve the remediation process for similar issues.

By default, OpsCenter integrates with Incident Manager. If Incident Manager is not set up, the OpsCenter page displays a message to set up Incident Manager. When Incident Manager creates an OpsItem, you can manage and remediate the OpsItem from OpsCenter. For instructions on creating an incident for an OpsItem, see Creating an incident for an OpsItem.