/dt-obs-aws

name: dt-obs-aws
description: >-
  AWS cloud resource monitoring including EC2, RDS, Lambda, ECS/EKS, VPC networking, load balancers,
  S3, DynamoDB, SQS/SNS, and cost optimization. Use when analyzing AWS infrastructure, resource
  inventory, security compliance, capacity planning, or cost savings.
  Trigger: "show EC2 instances", "find RDS databases", "VPC resources", "AWS cost optimization",
  "Lambda functions", "ECS services", "security groups", "unattached EBS volumes",
  "AWS load balancer topology", "publicly accessible databases", "AWS dashboards".
  Do NOT use for explaining existing queries, product documentation questions,
  generic host CPU/memory metrics (use dt-obs-hosts), application-level tracing
  (use dt-obs-tracing), or log analysis (use dt-obs-logs).
license: Apache-2.0

AWS Cloud Infrastructure

Monitor and analyze AWS resources using Dynatrace Smartscape and DQL. Query AWS services, optimize costs, manage security, and plan capacity across your AWS infrastructure.

When to Use This Skill

Use this skill when the user needs to work with AWS resources in Dynatrace. Load the reference file for the task type:

• **Inventory:** "Show me all EC2 instances in us-east-1"
• **Network:** "Find all resources in VPC vpc-abc123"
• **Database:** "List all RDS instances with Multi-AZ enabled"
• **Serverless:** "Show Lambda functions with VPC access"
• **Cost:** "Find unattached EBS volumes for cost savings"
• **Security:** "Identify publicly accessible databases"
• **Compliance:** "Find resources missing Environment tags"
• **Capacity:** "Analyze subnet IP utilization"
• **Troubleshoot:** "Map load balancer to instances through target groups"
• **Problem Analysis:** "What changed before this AWS problem?" / "What events affected this resource?"
• **Workload Context:** "Is this instance behind a load balancer, in an EKS cluster, or managed by ECS?"
• **Events:** "Have there been any recent events in AWS affecting this resource?"

---

Core Concepts

Entity Types

AWS resources use the `AWS_*` prefix and can be queried using the `smartscapeNodes` function. All AWS entities are automatically discovered and modeled in Dynatrace Smartscape.

**Compute:** `AWS_EC2_INSTANCE`, `AWS_LAMBDA_FUNCTION`, `AWS_ECS_CLUSTER`, `AWS_ECS_SERVICE`, `AWS_EKS_CLUSTER` **Networking:** `AWS_EC2_VPC`, `AWS_EC2_SUBNET`, `AWS_EC2_SECURITYGROUP`, `AWS_EC2_NATGATEWAY`, `AWS_EC2_VPCENDPOINT` **Database:** `AWS_RDS_DBINSTANCE`, `AWS_RDS_DBCLUSTER`, `AWS_DYNAMODB_TABLE`, `AWS_ELASTICACHE_CACHECLUSTER` **Storage:** `AWS_S3_BUCKET`, `AWS_EC2_VOLUME`, `AWS_EFS_FILESYSTEM` **Load Balancing:** `AWS_ELASTICLOADBALANCINGV2_LOADBALANCER`, `AWS_ELASTICLOADBALANCINGV2_TARGETGROUP` **Messaging:** `AWS_SQS_QUEUE`, `AWS_SNS_TOPIC`, `AWS_EVENTS_EVENTBUS`, `AWS_MSK_CLUSTER`

Common AWS Fields

All AWS entities include:

• `aws.account.id` - AWS account identifier
• `aws.region` - AWS region (e.g., us-east-1)
• `aws.resource.id` - Unique resource identifier
• `aws.resource.name` - Resource name
• `aws.arn` - Amazon Resource Name
• `aws.vpc.id` - VPC identifier (for VPC-attached resources)
• `aws.subnet.id` - Subnet identifier
• `aws.availability_zone` - Availability zone
• `aws.security_group.id` - Security group IDs (array)
• `tags` - Resource tags (use `tags[TagName]`)

AWS Fields on Logs and Bizevents

AWS-originated **logs** (`fetch logs`) carry these fields — no exploration needed:

• `aws.region`, `aws.account.id`, `aws.service`, `aws.log_group`, `aws.log_stream`
• Plus standard log fields: `content`, `loglevel`, `timestamp`, `k8s.*`, `dt.smartscape.*`

AWS-originated **bizevents** (`fetch bizevents`) carry:

• `aws.region`, `aws.account.id`, `event.type`, `event.provider`

Use `filter isNotNull(aws.region)` to scope to AWS-originated records.

Relationship Types

AWS entities use these relationship types:

• `is_attached_to` - Exclusive attachment (e.g., volume to instance)
• `uses` - Dependency relationship (e.g., instance uses security group)
• `runs_on` - Vertical relationship (e.g., instance runs on AZ)
• `is_part_of` - Composition (e.g., instance in cluster)
• `belongs_to` - Aggregation (e.g., service belongs to cluster)
• `balances` - Load balancing (e.g., target group balances instances)
• `balanced_by` - Inverse load-balancing relationship (e.g., load balancer balanced by target group)

AWS Metric Key Naming Convention

Dynatrace ingests AWS CloudWatch metrics using this pattern:

cloud.aws.<service>.<MetricName>.By.<DimensionName>

The `<service>` is the lowercase AWS service name, `<MetricName>` is the CloudWatch metric name (case-preserved), and `<DimensionName>` is the CloudWatch dimension.

Examples: `cloud.aws.ec2.CPUUtilization.By.InstanceId`, `cloud.aws.lambda.Invocations.By.FunctionName`, `cloud.aws.rds.CPUUtilization.By.DBInstanceIdentifier`

Use `timeseries`, not `fetch`, for these metrics. Group by `dt.smartscape_source.id` to split by entity.

→ See [references/metrics-performance.md](references/metrics-performance.md) for the complete metric catalog by service with DQL query templates.

---

Key Workflows

1. AWS Resource Discovery

Get all AWS resources by type:

smartscapeNodes "AWS_*"
| summarize count = count(), by: {type}
| sort count desc

Filter by account and region:

smartscapeNodes "AWS_*"
| filter aws.account.id == "123456789012" and aws.region == "us-east-1"
| fields type, name, aws.resource.id

Using tags for filtering:

smartscapeNodes "AWS_*"
| filter tags[Environment] == "production"
| summarize count = count(), by: {type, aws.region}

→ For complete resource inventory patterns, see [references/resource-management.md](references/resource-management.md)

2. VPC Networking Analysis

List all VPCs:

smartscapeNodes "AWS_EC2_VPC"
| fields name, aws.account.id, aws.region, aws.vpc.id

Find resources in a VPC:

smartscapeNodes "AWS_*"
| filter aws.vpc.id == "vpc-0be61db7c5d2d1bd1"
| summar