Identifying potential causes of incidents from other services as "findings" in Incident Manager
In Incident Manager, a finding is information about an AWS CodeDeploy deployments or AWS CloudFormation stack update that occurred around the time of an incident, and that involved one or more resources likely related to the incident. Each finding can be examined as a potential cause of the incident. Information about these potential causes is added to the Incident details page for an incident. With information about these deployments and changes readily at hand, responders don't need to manually search for this information. This lessens the time needed to evaluate potential causes, which can reduce the mean time to recover (MTTR) from an incident.
Currently, Incident Manager supports gathering findings from two AWS services: AWS CodeDeploy and AWS CloudFormation.
Findings is an opt-in feature. You can enable it in the Get prepared wizard, when you are first onboarding to Incident Manager, or later on the Settings page.
When you enable the Findings feature, Incident Manager creates a service role for you. This service role includes the permissions needed to retrieve findings from CodeDeploy and CloudFormation.
To work with findings in a cross-account scenario, enable the feature in the management account. After that, each application account in an AWS Resource Access Manager (AWS RAM) organization must create a corresponding service role.
Refer to the following topics to help you use the Findings feature.
Topics
Enable and create a service role for findings
When you enable the Findings feature, Incident Manager creates a service role named
IncidentManagerIncidentAccessServiceRole on your behalf. This
service role provides the permissions Incident Manager needs to gather information about
CodeDeploy deployments and CloudFormation stack updates that occurred around the time an incident
was created.
Note
If you are using Incident Manager with an organization, the service role is created in the management account. To work with findings across other accounts in the organization, the service role must be created in each application account. For information about using a CloudFormation template to create this role in your application accounts, see step 4 in Set up and configure cross-account incident management.
This service role is associated with an AWS managed policy. For information about the permissions in this policy, see AWS managed policy: AWSIncidentManagerIncidentAccessServiceRolePolicy.
For information about enabling findings during the Incident Manager onboarding process, see Getting started with Incident Manager.
For information about enabling findings after you have completed the onboarding process, see Managing the Findings feature.
Configure permissions for cross-account findings support
To use the Findings feature across accounts with an organization set up in AWS RAM, each application account must configure permissions for Incident Manager to assume the management account's service role on its behalf.
These permissions can be configured in an application account by deploying an AWS CloudFormation
template provided by AWS, which creates the role
IncidentManagerIncidentAccessServiceRole.
For information about downloading and deploying this template in an application account, see step 4 in Managing incidents across AWS accounts and Regions in Incident Manager.
