ECommerce Web App — Incident Dashboard

Application profile

Customer-facing retail. Critical journey: CloudFront → WAF → ELB → EC2 → DynamoDB, with Lambda for async workloads and S3/CloudFront for static media.

Cloud provider health

Before we check anything else, we should understand if AWS services are experiencing issues. If they are, open a support bridge with AWS and consider availability-zone or Region migration. The multi-Region footprint below shows which AWS Regions this application is deployed in, for correlation. Remember AWS Health reports can lag real-time events — double-check downdetector.com to see if other customers are reporting issues.

Multi-Region footprint

Where this application is deployed. Note that some global services (CloudFront, IAM, Route 53) always report from us-east-1, so a us-east-1 event can affect you even though your workloads run in eu-west-2.

Data-transfer footprint

Month-to-date data transfer by path — so near the start of a month this is naturally sparse. Multiple transfers to the internet mean multiple routes to investigate; it also maps where transfer is happening, so if AWS has an issue in a specific Region you can see whether you depend on it.

CloudWatch alarms

Every ACME application ships with CloudWatch alarms watching for trouble. Under normal operation none should be in ALARM. Anything firing here is a place to investigate as a possible cause of the production impact.

Recent changes

CloudTrail records what changed in the last 24 hours. If you have an exact start time for the impact, search that window to see whether a single change can be isolated as the likely root cause.

Capacity & quotas

AWS caps each service with Service Quotas. A service at its quota can be a direct cause of an incident — aim for headroom above peak demand. If something is at the limit, raise a quota-increase request, then keep analysing: hitting a quota is often a symptom (e.g. load from unusual traffic), not the root cause.

Network perimeter

For an internet-facing application, look at the edge for unusual traffic — it may be legitimate growth, or malicious activity degrading the service.

If you suspect a security incident, the public-exposure audit shows where an attacker could be reaching the system. Each service listed as critical should be locked down, where that can be done without further risk.

Security reporting

Look for discovered security issues that could be actively exploited. Start with findings — you can search by CVE to see whether a known vulnerability on internet-reachable compute is under active attack.

Security compliance

Security Hub aggregates compliance-standard findings across the account.

Security posture

A scorecard against common-sense rules. During an incident the items worth checking are: IAM user compromise (a user set up without MFA), security groups open to the internet, use of the root account in the last 24 hours, and aged access keys.

Access Analyzer

Cross-account roles are used in ACME for account management, and outward to payment gateways and SaaS services. These are also routes an attacker could use — so the CloudTrail logs should be checked for use of these roles, to see whether they could have been used maliciously.

IAM access keys

Shows which users have accessed the system as IAM users recently — normally only for emergency break-glass. Stale keys are a long-term risk and should be cleaned up, but a key showing as stale or unused is probably not the cause of a current production change.

Change analysis

This is a pipeline-managed production environment, so we're looking for changes outside CloudFormation — a manual IAM change, or drift from the deployed templates. Filter the CloudTrail search below to IAM to spot an unexpected role making a change.

CloudFormation drift shows stacks modified outside of a deployment.

AWS Config rules monitor drift between ACME Corp's cloud standards and the running environment. A gap can mean an operational-stability or security control hasn't been correctly implemented, and should be investigated.

Key & secret expiry

Expired keys are a common cause of stack communication failures. Look for KMS keys overdue for rotation or not centrally managed — and note the inverse: a key or secret rotated in the last day is equally worth investigating.

Cost

A cost abnormality against recent trend can flag a demand spike that later shows up as a capacity problem — useful corroboration during an incident.

Service end-of-life

Lambda functions on deprecated runtimes are eventually blocked from new invocations. This view lists every function and flags any at or near end-of-life.

Inventory

The application owner's list of expected services (last revised 1 April 2026), alongside the live discovered resources — compare the two to spot discrepancies.

Discovered — edge & network

Discovered — compute

Discovered — storage & data

Discovered — keys & certificates