Subscribe a workload to Incident Detection and Response
To subscribe a workload to AWS Incident Detection and Response, create a new support case for each workload. When you create the support case, keep the following in mind:
-
To onboard a workload that's in a single AWS account, create the support case either from the workload's account or from your payer account.
To onboard a workload that spans multiple AWS accounts, create the support case from your payer account. In the body of the support case, list all account IDs to onboard.
Important
If you create a support case to subscribe a workload to Incident Detection and Response from the incorrect account, you might experience delays and requests for additional information before your workloads can be subscribed.
To subscribe a workload
Go to the AWS Support Center
, and then select Create case as shown in the following example. You can only subscribe workloads from accounts that are enrolled in Enterprise Support. 
Complete the support case form:
Select Technical support.
For Service, choose Incident Detection and Response.
For Category, choose Onboard New Workload.
For Severity, choose General guidance.
Enter a Subject for this change. For example:
[Onboard] AWS Incident Detection and Response -
workload_name-
Enter a Description for this change. For example, enter "This request is to onboard a workload to AWS Incident Detection and Response". Make sure that you include the following information in your request:
-
Workload name: Your workload name.
-
Account ID(s): ID1, ID2, ID3, and so on. These are the accounts that you want to onboard to AWS Incident Detection and Response.
-
Subscription start date: The date that you want to start the AWS Incident Detection and Response subscription.
-
-
In the Additional contacts - optional section, enter any email IDs that you want to receive correspondence about this request.
The following is an example of the Addtional contacts - optional section:
Important
Failure to add email IDs in the Additional contacts - optional section might delay the AWS Incident Detection and Response onboarding process.
-
Choose Submit.
After you submit the request, you can add additional emails from your organization. To add emails, reply to the case, and then add the email IDs in the Additional contacts - optional section.
The following is an example of the Addtional contacts - optional section:
After you create a support case for the subscription request, keep the following two documents ready to proceed with the workload onboarding process:
-
AWS workload architecture diagram.
-
Workload onboarding and alarm ingestion questionnaires in Incident Detection and Response: Complete all of the information in the questionnaire that's related to the workload that you're onboarding. If you have multiple workloads to be onboarded, then create a new onboarding questionnaire for each workload. If you have questions about completing the onboarding questionnaire, then contact your Technical Account Manager (TAM).
Note
DO NOT attach these two documents to the case using the Attach files option. AWS Incident Detection and Response team will reply to the case with an Amazon Simple Storage Service Uploader link for you to upload the documents.
For information on how to create a case with AWS Incident Detection and Response to request changes to an existing onboarded workload, see Request changes to an onboarded workload in Incident Detection and Response. For information on how to offboard a workload, see Offboard a workload from Incident Detection and Response.
