Dt Obs Aws

AWS Cloud Infrastructure

Monitor and analyze AWS resources using Dynatrace Smartscape and DQL. Query AWS services, optimize costs, manage security, and plan capacity across your AWS infrastructure.

When to Use This Skill

Use this skill when the user needs to work with AWS resources in Dynatrace. Load the reference file for the task type:

• Inventory: "Show me all EC2 instances in us-east-1"
• Network: "Find all resources in VPC vpc-abc123"
• Database: "List all RDS instances with Multi-AZ enabled"
• Serverless: "Show Lambda functions with VPC access"
• Cost: "Find unattached EBS volumes for cost savings"
• Security: "Identify publicly accessible databases"
• Compliance: "Find resources missing Environment tags"
• Capacity: "Analyze subnet IP utilization"
• Troubleshoot: "Map load balancer to instances through target groups"
• Problem Analysis: "What changed before this AWS problem?" / "What events affected this resource?"
• Workload Context: "Is this instance behind a load balancer, in an EKS cluster, or managed by ECS?"
• Events: "Have there been any recent events in AWS affecting this resource?"

---

Core Concepts

Entity Types

AWS resources use the AWS_* prefix and can be queried using the smartscapeNodes function. All AWS entities are automatically discovered and modeled in Dynatrace Smartscape.

Compute: AWS_EC2_INSTANCE, AWS_LAMBDA_FUNCTION, AWS_ECS_CLUSTER, AWS_ECS_SERVICE, AWS_EKS_CLUSTER Networking: AWS_EC2_VPC, AWS_EC2_SUBNET, AWS_EC2_SECURITYGROUP, AWS_EC2_NATGATEWAY, AWS_EC2_VPCENDPOINT Database: AWS_RDS_DBINSTANCE, AWS_RDS_DBCLUSTER, AWS_DYNAMODB_TABLE, AWS_ELASTICACHE_CACHECLUSTER Storage: AWS_S3_BUCKET, AWS_EC2_VOLUME, AWS_EFS_FILESYSTEM Load Balancing: AWS_ELASTICLOADBALANCINGV2_LOADBALANCER, AWS_ELASTICLOADBALANCINGV2_TARGETGROUP Messaging: AWS_SQS_QUEUE, AWS_SNS_TOPIC, AWS_EVENTS_EVENTBUS, AWS_MSK_CLUSTER

Common AWS Fields

All AWS entities include:

• aws.account.id - AWS account identifier
• aws.region - AWS region (e.g., us-east-1)
• aws.resource.id - Unique resource identifier
• aws.resource.name - Resource name
• aws.arn - Amazon Resource Name
• aws.vpc.id - VPC identifier (for VPC-attached resources)
• aws.subnet.id - Subnet identifier
• aws.availability_zone - Availability zone
• aws.security_group.id - Security group IDs (array)
• tags - Resource tags (use tags[TagName])

AWS Fields on Logs and Bizevents

AWS-originated logs (fetch logs) carry these fields — no exploration needed:

• aws.region, aws.account.id, aws.service, aws.log_group, aws.log_stream
• Plus standard log fields: content, loglevel, timestamp, k8s.*, dt.smartscape.*

AWS-originated bizevents (fetch bizevents) carry:

• aws.region, aws.account.id, event.type, event.provider

Use filter isNotNull(aws.region) to scope to AWS-originated records.

Relationship Types

AWS entities use these relationship types:

• is_attached_to - Exclusive attachment (e.g., volume to instance)
• uses - Dependency relationship (e.g., instance uses security group)
• runs_on - Vertical relationship (e.g., instance runs on AZ)
• is_part_of - Composition (e.g., instance in cluster)
• belongs_to - Aggregation (e.g., service belongs to cluster)
• balances - Load balancing (e.g., target group balances instances)
• balanced_by - Inverse load-balancing relationship (e.g., load balancer balanced by target group)

AWS Metric Key Naming Convention

Dynatrace ingests AWS CloudWatch metrics using this pattern:

cloud.aws.<service>.<MetricName>.By.<DimensionName>

The <service> is the lowercase AWS service name, <MetricName> is the CloudWatch metric name (case-preserved), and <DimensionName> is the CloudWatch dimension.

Examples: cloud.aws.ec2.CPUUtilization.By.InstanceId, cloud.aws.lambda.Invocations.By.FunctionName, cloud.aws.rds.CPUUtilization.By.DBInstanceIdentifier

Use timeseries, not fetch, for these metrics. Group by dt.smartscape_source.id to split by entity.

→ See references/metrics-performance.md for the complete metric catalog by service with DQL query templates.

---

Key Workflows

1. AWS Resource Discovery

Get all AWS resources by type:

smartscapeNodes "AWS_*"
| summarize count = count(), by: {type}
| sort count desc

Filter by account and region:

smartscapeNodes "AWS_*"
| filter aws.account.id == "123456789012" and aws.region == "us-east-1"
| fields type, name, aws.resource.id

Using tags for filtering:

smartscapeNodes "AWS_*"
| filter tags[Environment] == "production"
| summarize count = count(), by: {type, aws.region}

→ For complete resource inventory patterns, see references/resource-management.md

2. VPC Networking Analysis

List all VPCs:

smartscapeNodes "AWS_EC2_VPC"
| fields name, aws.account.id, aws.region, aws.vpc.id

Find resources in a VPC:

smartscapeNodes "AWS_*"
| filter aws.vpc.id == "vpc-0be61db7c5d2d1bd1"
| summarize resource_count = count(), by: {type, aws.subnet.id}
| sort resource_count desc

Analyze security group usage:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter contains(aws.security_group.id, "sg-abc123")
| fields name, aws.resource.id, aws.vpc.id, aws.subnet.id

→ For VPC networking, see references/vpc-networking-security.md → For security group patterns, see references/security-compliance.md

3. Database Monitoring

List all RDS instances:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| fields name, aws.account.id, aws.region, aws.vpc.id, aws.availability_zone

Find Multi-AZ databases:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd multiAZ = awsjson[configuration][multiAZ]
| filter multiAZ == true
| fields name, aws.resource.id, aws.region

Group by engine type:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd engine = awsjson[configuration][engine]
| summarize db_count = count(), by: {engine, aws.region}
| sort db_count desc

→ For database monitoring, see references/database-monitoring.md

4. Serverless and Container Workloads

List Lambda functions:

smartscapeNodes "AWS_LAMBDA_FUNCTION"
| fields name, aws.account.id, aws.region, aws.vpc.id

Find ECS services in a cluster:

smartscapeNodes "AWS_ECS_SERVICE"
| traverse "belongs_to", "AWS_ECS_CLUSTER"
| fields name, aws.resource.id, aws.region

List EKS clusters:

smartscapeNodes "AWS_EKS_CLUSTER"
| fields name, aws.account.id, aws.region, aws.vpc.id

→ For serverless, see references/serverless-containers.md → For containers, see references/serverless-containers.md

5. Load Balancer Topology

Complete load balancer to instance mapping:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| parse aws.object, "JSON:awsjson"
| fieldsAdd dnsName = awsjson[configuration][dnsName], scheme = awsjson[configuration][scheme]
| filter scheme == "internet-facing"
| traverse "balanced_by", "AWS_ELASTICLOADBALANCINGV2_TARGETGROUP", direction:backward, fieldsKeep:{dnsName, id}
| fieldsAdd targetGroupName = aws.resource.name
| traverse "balances", "AWS_EC2_INSTANCE", fieldsKeep: {targetGroupName, id}
| fieldsAdd loadBalancerDnsName = dt.traverse.history[-2][dnsName],
            loadBalancerId = dt.traverse.history[-2][id],
            targetGroupId = dt.traverse.history[-1][id]

→ For load balancing, see references/load-balancing-api.md

6. Cost Optimization

Find unattached EBS volumes:

smartscapeNodes "AWS_EC2_VOLUME"
| parse aws.object, "JSON:awsjson"
| fieldsAdd state = awsjson[configuration][state]
| filter state == "available"
| fields name, aws.resource.id, aws.availability_zone, aws.account.id

Analyze EBS costs by type:

smartscapeNodes "AWS_EC2_VOLUME"
| parse aws.object, "JSON:awsjson"
| fieldsAdd volumeType = awsjson[configuration][volumeType],
            size = awsjson[configuration][size],
            state = awsjson[configuration][state]
| summarize total_volumes = count(), total_size_gb = sum(size), by: {volumeType, state}
| sort total_size_gb desc

→ For cost optimization, see references/cost-optimization.md

7. Security and Compliance

Find publicly accessible databases:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd publiclyAccessible = awsjson[configuration][publiclyAccessible]
| filter publiclyAccessible == true
| fields name, aws.resource.id, aws.vpc.id, aws.account.id

Security group blast radius:

smartscapeNodes "AWS_EC2_INSTANCE"
| traverse "uses", "AWS_EC2_SECURITYGROUP"
| summarize instance_count = count(), by: {aws.resource.name, aws.vpc.id}
| sort instance_count desc
| limit 20

→ For security, see references/security-compliance.md

8. Resource Ownership and Tagging

Find untagged resources:

smartscapeNodes "AWS_*"
| filter isNull(tags)
| fields type, name, aws.resource.id, aws.account.id, aws.region

Cost allocation by cost center:

smartscapeNodes "AWS_*"
| filter isNotNull(tags[CostCenter])
| summarize resource_count = count(), by: {tags[CostCenter], type}
| sort resource_count desc

→ For resource ownership, see references/resource-ownership.md

---

Common Query Patterns

---

Best Practices

Query Optimization

1. Filter early by account and region 2. Use specific entity types (avoid "AWS_*" wildcards when possible) 3. Limit results with | limit N for exploration 4. Use isNotNull() checks before accessing nested fields

Configuration Parsing

1. Always parse aws.object with JSON parser: parse aws.object, "JSON:awsjson" 2. Use consistent field naming: fieldsAdd configField = awsjson[configuration][field] 3. Check for null values after parsing 4. Use toString() for complex nested objects

Security Fields

1. Security group IDs are arrays - use contains() or expand 2. Parse aws.object for detailed security context 3. Check publiclyAccessible, storageEncrypted, and similar flags 4. Validate IAM role assumptions

Tagging Strategy

1. Use tags[TagName] for filtering by specific tag value 2. tags is a JSON object, not an array — use isNull(tags) for untagged resources, never arraySize(tags) 3. Use isNull(tags[TagName]) to find resources missing a specific tag 4. Implement consistent tag naming conventions 5. Track tag coverage with summarize operations

---

Limitations and Notes

Smartscape Limitations

• AWS object configuration requires parsing with parse aws.object, "JSON:awsjson"
• AWS metrics are available as Dynatrace metrics using the cloud.aws.* naming convention (see AWS Metric Naming Convention)
• Resource discovery depends on AWS integration configuration
• Tag synchronization may have slight delays

Relationship Traversal

• Use direction:backward for reverse relationships (e.g., target group → load balancer)
• Use fieldsKeep to maintain important fields through traversal
• Access traversal history with dt.traverse.history[-N]
• Complex topologies may require multiple traverse operations

General Tips

• Use getNodeName() for human-readable resource names
• Handle null values gracefully with isNotNull() and isNull()
• Combine region and account filters for large environments
• Use countDistinct() for unique resource counts

---

When to Load References

This skill uses progressive disclosure. Start here for 80% of use cases. Load reference files for detailed specifications when needed.

Load vpc-networking-security.md when:

• Analyzing VPC topology and connectivity
• Investigating security group configurations
• Finding resources by security group
• Troubleshooting network interface issues

Load database-monitoring.md when:

• Managing RDS instances and clusters
• Analyzing database engine distributions
• Checking Multi-AZ configurations
• Monitoring cache clusters

Load serverless-containers.md when:

• Working with Lambda functions
• Analyzing ECS/EKS deployments
• Investigating container networking
• Planning serverless migrations

Load load-balancing-api.md when:

• Mapping load balancer topologies
• Analyzing target group health
• Working with API Gateway
• Configuring CloudFront

Load messaging-event-streaming.md when:

• Managing SQS queues and SNS topics
• Analyzing EventBridge event buses
• Working with Kinesis or MSK
• Monitoring Step Functions

Load resource-management.md when:

• Conducting resource audits
• Analyzing tag compliance
• Finding unattached resources
• Planning regional distribution

Load cost-optimization.md when:

• Identifying cost savings opportunities
• Analyzing storage costs
• Finding unused resources
• Optimizing instance types

Load capacity-planning.md when:

• Planning capacity expansions
• Analyzing resource utilization
• Monitoring subnet IP usage
• Sizing auto-scaling groups

Load security-compliance.md when:

• Conducting security audits
• Checking encryption status
• Analyzing IAM roles
• Finding public resources

Load resource-ownership.md when:

• Implementing chargeback
• Tracking resource ownership
• Allocating costs by team
• Managing multi-account environments

Load events.md when:

• Investigating what changed before or during a problem
• Checking for recent CloudFormation stack deployments
• Reviewing AWS Auto Scaling activity (scale-in/scale-out)
• Checking AWS Health service events affecting a resource

Load workload-detection.md when:

• Determining how an EC2 instance is orchestrated (ECS, EKS, Batch, ASG, standalone)
• Following a resolution path that depends on the workload pattern
• Understanding the blast radius of an instance failure

Check health alerts when:

• Verifying whether Dynatrace health alerts are configured for an AWS resource type
• Confirming alert coverage before or after a problem

Use dtctl to query the builtin:health-experience.cloud-alert settings schema. Replace CpuUtilization with the metric name relevant to the resource type being investigated:

dtctl get settings --schema builtin:health-experience.cloud-alert -o json --plain \
  | jq '[.[] | select(.value.alertKey | test("CpuUtilization"))]'

---

References

• vpc-networking-security.md - VPC infrastructure, security groups, and network connectivity
• database-monitoring.md - RDS, DynamoDB, ElastiCache, and Redshift monitoring
• serverless-containers.md - Lambda, ECS, EKS, and App Runner workloads
• load-balancing-api.md - Load balancers, API Gateway, and CloudFront
• messaging-event-streaming.md - SQS, SNS, EventBridge, Kinesis, and MSK
• resource-management.md - Resource inventory and lifecycle management
• cost-optimization.md - Cost savings and spending optimization
• capacity-planning.md - Capacity analysis and growth planning
• security-compliance.md - Security configurations and compliance monitoring
• resource-ownership.md - Cost allocation and ownership tracking
• events.md - AWS AutoScaling, Health, and CloudFormation events for problem timeline analysis
• workload-detection.md - Identify how an EC2 instance is orchestrated (LB, ASG, ECS, EKS, Batch)

---

AWS Capacity Planning

Analyze resource capacity and plan for growth.

Table of Contents

• Compute Capacity
• Network Capacity
• Container & Serverless Capacity
• Database & Storage Capacity
• Infrastructure Capacity

Compute Capacity

Instance type distribution across regions:

smartscapeNodes "AWS_EC2_INSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd instanceType = awsjson[configuration][instanceType],
            state = awsjson[configuration][state][name]
| summarize instance_count = count(), by: {instanceType, state, aws.region}
| sort instance_count desc

Auto Scaling group capacity and headroom:

smartscapeNodes "AWS_AUTOSCALING_AUTOSCALINGGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd minSize = awsjson[configuration][minSize],
            maxSize = awsjson[configuration][maxSize],
            desiredCapacity = awsjson[configuration][desiredCapacity]
| fields name, minSize, maxSize, desiredCapacity, aws.region
| sort desiredCapacity desc

Network Capacity

Subnet IP address utilization (critical for capacity planning):

smartscapeNodes "AWS_EC2_SUBNET"
| parse aws.object, "JSON:awsjson"
| fieldsAdd availableIpCount = awsjson[configuration][availableIpAddressCount],
            cidrBlock = awsjson[configuration][cidrBlock]
| fields name, cidrBlock, availableIpCount, aws.vpc.id, aws.availability_zone
| sort availableIpCount asc

Network interface usage by type:

smartscapeNodes "AWS_EC2_NETWORKINTERFACE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd interfaceType = awsjson[configuration][interfaceType],
            status = awsjson[configuration][status]
| summarize eni_count = count(), by: {interfaceType, status}
| sort eni_count desc

Route tables per VPC:

smartscapeNodes "AWS_EC2_ROUTETABLE"
| summarize route_table_count = count(), by: {aws.vpc.id, aws.region}
| sort route_table_count desc

Container & Serverless Capacity

ECS service desired vs running counts:

smartscapeNodes "AWS_ECS_SERVICE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd desiredCount = awsjson[configuration][desiredCount],
            runningCount = awsjson[configuration][runningCount]
| fields name, desiredCount, runningCount, aws.region

Lambda function memory allocations:

smartscapeNodes "AWS_LAMBDA_FUNCTION"
| parse aws.object, "JSON:awsjson"
| fieldsAdd memory = awsjson[configuration][memorySize]
| summarize function_count = count(), by: {memory, aws.region}
| sort memory desc

EKS node groups, ECR repositories, and launch templates can be counted with the standard discovery pattern using their respective entity types: AWS_EKS_NODEGROUP, AWS_ECR_REPOSITORY, AWS_EC2_LAUNCHTEMPLATE.

Database & Storage Capacity

RDS storage type distribution:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd storageType = awsjson[configuration][storageType]
| summarize db_count = count(), by: {storageType, aws.region}
| sort db_count desc

Infrastructure Capacity

Transit gateways for multi-VPC connectivity:

smartscapeNodes "AWS_EC2_TRANSITGATEWAY"
| fields name, aws.account.id, aws.region, aws.resource.id

AWS Cost Optimization

Identify cost savings opportunities and optimize AWS spending.

Table of Contents

• Compute Costs
• Storage Costs
• Network Costs
• Database Costs
• Serverless & Cache Costs
• Infrastructure Management Costs
• Idle Resource Detection

Compute Costs

Analyze running instance types for right-sizing:

smartscapeNodes "AWS_EC2_INSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd instanceType = awsjson[configuration][instanceType],
            state = awsjson[configuration][state][name]
| filter state == "running"
| summarize instance_count = count(), by: {instanceType, aws.region}
| sort instance_count desc

Find recently terminated instances:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter aws.state == "terminated"
| fields name, aws.resource.id, aws.region, aws.account.id, id
| limit 20

Storage Costs

Analyze EBS volumes by type and state (identify unattached volumes):

smartscapeNodes "AWS_EC2_VOLUME"
| parse aws.object, "JSON:awsjson"
| fieldsAdd volumeType = awsjson[configuration][volumeType],
            size = awsjson[configuration][size],
            state = awsjson[configuration][state]
| summarize total_volumes = count(), total_size_gb = sum(size), by: {volumeType, state}
| sort total_size_gb desc

Check S3 bucket versioning for storage cost analysis:

smartscapeNodes "AWS_S3_BUCKET"
| parse aws.object, "JSON:awsjson"
| fieldsAdd versioning = awsjson[configuration][versioningConfiguration][status]
| summarize bucket_count = count(), by: {versioning, aws.region}

Count RDS cluster snapshots for backup cost analysis:

smartscapeNodes "AWS_RDS_DBCLUSTERSNAPSHOT"
| parse aws.object, "JSON:awsjson"
| fieldsAdd snapshotType = awsjson[configuration][snapshotType]
| summarize snapshot_count = count(), by: {snapshotType, aws.region}
| sort snapshot_count desc

Network Costs

Analyze NAT gateway costs by VPC:

smartscapeNodes "AWS_EC2_NATGATEWAY"
| parse aws.object, "JSON:awsjson"
| fieldsAdd state = awsjson[configuration][state]
| filter state == "available"
| summarize nat_count = count(), by: {aws.vpc.id, aws.availability_zone}
| sort nat_count desc

Analyze VPC endpoint types for cost optimization:

smartscapeNodes "AWS_EC2_VPCENDPOINT"
| parse aws.object, "JSON:awsjson"
| fieldsAdd vpcEndpointType = awsjson[configuration][vpcEndpointType],
            serviceName = awsjson[configuration][serviceName]
| summarize endpoint_count = count(), by: {vpcEndpointType, serviceName, aws.vpc.id}
| sort endpoint_count desc

Database Costs

Analyze RDS instance costs by class:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd instanceClass = awsjson[configuration][dbInstanceClass]
| summarize db_count = count(), by: {instanceClass, aws.region}
| sort db_count desc

Serverless & Cache Costs

Identify Lambda runtime distribution (for upgrade planning):

smartscapeNodes "AWS_LAMBDA_FUNCTION"
| parse aws.object, "JSON:awsjson"
| fieldsAdd runtime = awsjson[configuration][runtime]
| summarize function_count = count(), by: {runtime, aws.region}
| sort function_count desc

Review ElastiCache node types:

smartscapeNodes "AWS_ELASTICACHE_REPLICATIONGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd nodeType = awsjson[configuration][cacheNodeType]
| summarize cluster_count = count(), by: {nodeType, aws.region}
| sort cluster_count desc

Infrastructure Management Costs

Find KMS keys pending deletion:

smartscapeNodes "AWS_KMS_KEY"
| parse aws.object, "JSON:awsjson"
| fieldsAdd keyState = awsjson[configuration][keyState]
| filter keyState == "PendingDeletion"
| fields name, aws.resource.id, aws.region, aws.account.id

Review CloudFormation stack states:

smartscapeNodes "AWS_CLOUDFORMATION_STACK"
| parse aws.object, "JSON:awsjson"
| fieldsAdd stackStatus = awsjson[configuration][stackStatus]
| summarize stack_count = count(), by: {stackStatus, aws.region}
| sort stack_count desc

Idle Resource Detection

Idle resources are running and incurring charges but performing no useful work. Detecting them is one of the highest-impact cost optimization activities because idle resources represent pure waste — they can be terminated, downsized, or cleaned up with no service impact.

The queries below use metric thresholds and entity state to surface idle candidates across common AWS resource types.

EC2 — Low CPU Utilization

Instances averaging less than 5% CPU over 14 days are likely idle or significantly over-provisioned. These are candidates for downsizing to a smaller instance type or termination if no longer needed.

timeseries avg_cpu = avg(cloud.aws.ec2.CPUUtilization.By.InstanceId),
  by: { dt.smartscape_source.id },
  from: now()-14d
| filter isNotNull(avg_cpu) 
| fieldsAdd avg_cpu_val = arrayAvg(avg_cpu)
| filter avg_cpu_val < 5.0
| sort avg_cpu_val asc
| fields dt.smartscape_source.id, avg_cpu_val

What to look for:

• Instances at 0% CPU are almost certainly unused and safe to terminate after confirming no attached services depend on them.
• Instances between 1–5% may be running scheduled jobs or health checks — verify with network I/O metrics before acting.
• Cross-reference with the Compute Costs query to see the instance types involved; large instance types with low CPU yield the biggest savings.

Lambda — Zero Invocations

Functions with zero invocations over 30 days are likely abandoned or replaced. They still consume storage for deployment packages and may hold reserved concurrency that blocks other functions.

timeseries total_invocations = sum(cloud.aws.lambda.Invocations.By.FunctionName),
  by: { dt.smartscape_source.id },
  from: now()-30d
| fieldsAdd total = arraySum(total_invocations)
| filter total == 0 or isNull(total)
| fields dt.smartscape_source.id, total

What to look for:

• Functions with zero invocations for 30 days are strong candidates for deletion.
• Check whether the function is triggered by a schedule that runs less frequently than 30 days (e.g., quarterly reports) before removing.
• Review CloudFormation or IaC ownership to avoid deleting functions that would be recreated on the next deployment.

DynamoDB — Zero Consumed Capacity

Tables with no read or write activity over 30 days are likely unused. DynamoDB tables in provisioned mode incur charges for allocated capacity even with zero traffic.

timeseries {
  reads = sum(cloud.aws.dynamodb.ConsumedReadCapacityUnits.By.TableName),
           writes = sum(cloud.aws.dynamodb.ConsumedWriteCapacityUnits.By.TableName)
},
  by: { dt.smartscape_source.id },
  from: now()-30d
| fieldsAdd total_reads = arraySum(reads), total_writes = arraySum(writes)
| filter (total_reads == 0 or isNull(total_reads)) and (total_writes == 0 or isNull(total_writes))
| fields dt.smartscape_source.id, total_reads, total_writes

What to look for:

• Tables in provisioned mode with zero consumed capacity are paying for unused read/write units — switch to on-demand or delete.
• Tables in on-demand mode with zero traffic have minimal cost but still incur storage charges if they hold data.
• Check for DynamoDB Streams or global table replicas that may justify keeping the table even without direct application traffic.

EBS — Unattached Volumes

Volumes in the available state are not attached to any instance. They still incur storage charges based on size and volume type.

smartscapeNodes "AWS_EC2_VOLUME"
| parse aws.object, "JSON:awsjson"
| fieldsAdd volumeType = awsjson[configuration][volumeType],
            size = awsjson[configuration][size],
            state = awsjson[configuration][state]
| filter state == "available"
| fields name, aws.resource.id, aws.region, volumeType, size
| sort size desc

What to look for:

• Large gp3 or io2 volumes in available state are the most expensive idle resources — prioritize these.
• Volumes left behind after instance termination are a common source of waste. Create a snapshot before deleting if the data may be needed.
• Cross-reference with snapshots to confirm backup exists before cleanup.

EBS — Attached but Zero I/O

Volumes that are attached to instances but have had no read or write operations over 14 days. These may be leftover data volumes or misconfigured mounts.

timeseries {
  reads = sum(cloud.aws.ebs.VolumeReadOps.By.VolumeId),
  writes = sum(cloud.aws.ebs.VolumeWriteOps.By.VolumeId)
},
by: { dt.smartscape_source.id },
from: now()-14d
| fieldsAdd total_reads = arraySum(reads), total_writes = arraySum(writes)
| filter (total_reads == 0 or isNull(total_reads)) and (total_writes == 0 or isNull(total_writes))
| fields dt.smartscape_source.id, total_reads, total_writes

What to look for:

• Volumes with zero I/O that are attached to running instances may be mounted but unused — check the instance OS for unmounted or orphaned block devices.
• Some volumes serve as infrequently-accessed archives; confirm the access pattern before detaching.
• Detaching and snapshotting zero-I/O volumes can recover ongoing storage costs while preserving data.

Summary

AWS Database Monitoring

Monitor and analyze AWS database services including RDS, DynamoDB, ElastiCache, and Redshift.

Table of Contents

• Database Entity Types
• RDS Monitoring
• Other Database Services
• Database Security
• Cross-Service Analysis

Database Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, aws.account.id, aws.region, ...

RDS Monitoring

Find Multi-AZ databases:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd multiAZ = awsjson[configuration][multiAZ]
| filter multiAZ == true
| fields name, aws.resource.id, aws.region, aws.availability_zone

Analyze by engine type:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd engine = awsjson[configuration][engine]
| summarize db_count = count(), by: {engine, aws.region}
| sort db_count desc

Find RDS cluster members (instance → cluster relationship):

smartscapeNodes "AWS_RDS_DBINSTANCE"
| traverse "is_part_of", "AWS_RDS_DBCLUSTER"
| fields name, aws.resource.id, aws.region

Other Database Services

Find ElastiCache clusters by engine:

smartscapeNodes "AWS_ELASTICACHE_CACHECLUSTER"
| parse aws.object, "JSON:awsjson"
| fieldsAdd engine = awsjson[configuration][engine]
| summarize cluster_count = count(), by: {engine, aws.region}

Database Security

For public access detection on RDS databases, see the Public Access Detection section in security-compliance.md.

Analyze database security groups:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| fields name, aws.resource.id, aws.vpc.id, aws.security_group.id
| expand aws.security_group.id

Find what security groups a specific database uses:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| filter aws.resource.id == "<AWS_RDS_DBINSTANCE_ID>"
| traverse "uses", "AWS_EC2_SECURITYGROUP"
| fields name, aws.resource.id

Cross-Service Analysis

Find all databases in a specific VPC:

smartscapeNodes "AWS_RDS_DBINSTANCE", "AWS_ELASTICACHE_CACHECLUSTER", "AWS_REDSHIFT_CLUSTER"
| filter aws.vpc.id == "<VPC_ID>"
| fields type, name, aws.resource.id, aws.subnet.id

Count databases across regions:

smartscapeNodes "AWS_RDS_DBINSTANCE", "AWS_DYNAMODB_TABLE", "AWS_ELASTICACHE_CACHECLUSTER"
| summarize db_count = count(), by: {type, aws.region}
| sort aws.region, db_count desc

AWS Events Reference

Event queries for problem timeline analysis. Use these during incident investigation to determine what changed before or during a problem on an AWS resource.

Placeholder Reference

---

Auto Scaling Events

List recent Auto Scaling activity. Run this first during any EC2 instance problem to detect scale-in/scale-out events, lifecycle hooks, or capacity changes that may have caused or contributed to the issue.

fetch events
| filter source == "aws.autoscaling"
| fields timestamp, event.type, event.name, data
| sort timestamp desc
| limit 50

Note: This query returns the most recent 50 events globally. For incident-scoped analysis, add a time range:

fetch events, from: <PROBLEM_START>, to: <PROBLEM_END>
| filter source == "aws.autoscaling"
| fields timestamp, event.type, event.name, data
| sort timestamp desc

---

AWS Health Events

Query for AWS Health service events affecting the specific resource. AWS Health events indicate service disruptions, scheduled maintenance, or account-level notifications from AWS.

fetch events, from: <PROBLEM_START - 1h>, to: <PROBLEM_END + 1h>
| filter source == "aws.health"
| filter dt.smartscape_source.id == toSmartscapeId("<ROOT_CAUSE_ENTITY_ID>")
| fieldsAdd event.description = jsonData[`eventDescription`][0][`latestDescription`]
| fieldsAdd event.name = jsonData[`eventTypeCode`]
| fieldsAdd event.category = jsonData[actionability]
| fieldsAdd affected_entity_ids = dt.smartscape_source.id
| fields timestamp, event.name, event.description, event.category, affected_entity_ids
| sort timestamp desc

What to look for:

• event.category != "INFORMATIONAL" — active service disruption from AWS or planned maintenance that may be impacting your resource

---

CloudFormation Events

Check for recent CloudFormation stack deployments or changes. Infrastructure changes via CloudFormation are a common cause of problems — correlate stack events with the problem timeline.

fetch events, from: <PROBLEM_START - 1h>, to: <PROBLEM_END + 1h>
| filter source == "aws.cloudformation"
| parse data, "JSON:jsonData"
| fieldsAdd event.name = jsonData[eventName]
| fieldsAdd event.errorCode = jsonData[errorCode]
| fieldsAdd event.errorMessage = jsonData[errorMessage]
| fieldsAdd event.status = jsonData[`status-details`][status]
| fields jsonData, event.name, event.errorCode, event.status
| limit 20

Check for CloudFormation events related to the specific resource:

fetch events
| filter source == "aws.cloudformation"
| parse data, "JSON:jsonData"
| fieldsAdd event.name = jsonData[eventName]
| fieldsAdd event.errorCode = jsonData[errorCode]
| fieldsAdd event.errorMessage = jsonData[errorMessage]
| fieldsAdd event.status = jsonData[`status-details`][status]
| filter jsonData[`logical-resource-id`] == "<AWS_RESOURCE_NAME>"
| fields jsonData, event.name, event.errorCode, event.status, id, data
| limit 20

What to look for:

• Stack updates that completed shortly before the problem started
• Failed stack operations that may have left resources in a degraded state
• Resource replacements (e.g., instance replaced due to a launch template change)

---

CloudTrail API Events

Query AWS CloudTrail events to audit API calls. Use this during security investigations or to correlate infrastructure changes with problems.

fetch events
| filter event.type == "AWS API Call via CloudTrail"
| fields timestamp, event.type, data
| sort timestamp desc
| limit 50

Scope to a problem time window for incident analysis:

fetch events, from: <PROBLEM_START - 1h>, to: <PROBLEM_END + 1h>
| filter event.type == "AWS API Call via CloudTrail"
| fields timestamp, event.type, data
| sort timestamp desc

What to look for:

• API calls that modify infrastructure (RunInstances, TerminateInstances, ModifyDBInstance, etc.)
• API calls from unexpected IAM users or roles
• Failed API calls (error codes) that might indicate permission issues

---

EC2 Instance State Changes

Track EC2 instance launches and terminations. These events correlate with Auto Scaling activity, spot instance interruptions, or manual instance management.

fetch events
| filter event.type == "EC2 Instance Launch Successful"
    or event.type == "EC2 Instance Terminate Successful"
| fields timestamp, event.type, data
| sort timestamp desc
| limit 50

Scope to a problem time window:

fetch events, from: <PROBLEM_START - 1h>, to: <PROBLEM_END + 1h>
| filter event.type == "EC2 Instance Launch Successful"
    or event.type == "EC2 Instance Terminate Successful"
| fields timestamp, event.type, data
| sort timestamp desc

What to look for:

• Instance terminations shortly before a problem (capacity reduction)
• Rapid launch/terminate cycles (instance instability)
• Launches in unexpected regions or availability zones

---

Cloud Alert Events (Davis)

Davis automatically detects anomalies on AWS resources monitored through the cloud integration. These events cover resource contention, availability issues, performance degradation, and errors.

fetch events
| filter event.provider == "CLOUD_ALERT" and event.kind == "DAVIS_EVENT"
| fields timestamp, event.type, event.name, dt.smartscape_source.id, aws.resource.name, data
| sort timestamp desc
| limit 50

Filter by a specific event type:

fetch events
| filter event.provider == "CLOUD_ALERT" and event.kind == "DAVIS_EVENT"
| filter event.type == "<CLOUD_ALERT_EVENT_TYPE>"
| fields timestamp, event.type, event.name, dt.smartscape_source.id, aws.resource.name, data
| sort timestamp desc
| limit 50

Scope to a specific affected entity:

fetch events, from: <PROBLEM_START - 1h>, to: <PROBLEM_END + 1h>
| filter event.provider == "CLOUD_ALERT" and event.kind == "DAVIS_EVENT"
| filter dt.smartscape_source.id == toSmartscapeId("<ROOT_CAUSE_ENTITY_ID>")
| fields timestamp, event.type, event.name, data
| sort timestamp desc

What to look for:

• RESOURCE_CONTENTION_EVENT — CPU, memory, or I/O saturation
• AVAILABILITY_EVENT — service or resource unreachable
• PERFORMANCE_EVENT — latency or throughput degradation
• ERROR_EVENT — error rate anomalies

---

Event Discovery

Use this query to discover all available event sources and types in your environment. This helps identify which AWS services are forwarding events to Dynatrace.

fetch events, from:-30d
| summarize count = count(), by: {event.kind, event.type, event.provider}
| sort count desc
| limit 50

What to look for:

• New event sources that have started reporting recently
• Event types with high volume that may indicate recurring issues
• Missing event sources that should be configured but are not present

AWS Load Balancing & API Management

Monitor Application/Network Load Balancers, API Gateway, and CloudFront distributions.

Table of Contents

• Load Balancing Entity Types
• Load Balancer Topology Traversal
• Load Balancer Configuration
• Security & Networking
• API Gateway
• Cross-Service Analysis

Load Balancing Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, aws.account.id, aws.region, ...

Load Balancer Topology Traversal

Complete LB → Target Group → Instance Mapping

This is the most important query — maps internet-facing load balancers through target groups to backend instances:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| parse aws.object, "JSON:awsjson"
| fieldsAdd dnsName = awsjson[configuration][dnsName], scheme = awsjson[configuration][scheme]
| traverse "balanced_by", "AWS_ELASTICLOADBALANCINGV2_TARGETGROUP", direction:backward, fieldsKeep:{dnsName, id}
| fieldsAdd targetGroupName = aws.resource.name
| traverse "balances", "AWS_EC2_INSTANCE", fieldsKeep: {targetGroupName, id}
| fieldsAdd loadBalancerDnsName = dt.traverse.history[-2][dnsName],
            loadBalancerId = dt.traverse.history[-2][id],
            targetGroupId = dt.traverse.history[-1][id]

Simpler Traversals

LB to target groups:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| traverse "balanced_by", "AWS_ELASTICLOADBALANCINGV2_TARGETGROUP", direction:backward
| fields name, aws.resource.id

Target groups to instances:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_TARGETGROUP"
| traverse "balances", "AWS_EC2_INSTANCE"
| fields name, aws.resource.id, aws.availability_zone

Load Balancer Configuration

Find internet-facing load balancers:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| parse aws.object, "JSON:awsjson"
| fieldsAdd scheme = awsjson[configuration][scheme], dnsName = awsjson[configuration][dnsName]
| filter scheme == "internet-facing"
| fields name, dnsName, aws.resource.id, aws.vpc.id

Check multi-AZ distribution:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| fields name, aws.resource.id, aws.availability_zone
| expand aws.availability_zone

Security & Networking

List security groups attached to load balancers:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| fields name, aws.resource.id, aws.security_group.id
| expand aws.security_group.id

Filter LBs by VPC:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| filter aws.vpc.id == "<VPC_ID>"
| fields name, aws.resource.id, aws.subnet.id

API Gateway

Count APIs across regions by type:

smartscapeNodes "AWS_APIGATEWAY_RESTAPI", "AWS_APIGATEWAYV2_API"
| summarize api_count = count(), by: {type, aws.region}
| sort api_count desc

Cross-Service Analysis

Count all load balancers by type and region:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER", "AWS_ELASTICLOADBALANCING_LOADBALANCER"
| summarize lb_count = count(), by: {type, aws.region}
| sort lb_count desc

AWS Messaging & Event Streaming

Monitor SQS queues, SNS topics, EventBridge, Kinesis, and MSK clusters.

Table of Contents

• Messaging Entity Types
• Service-Specific Queries
• Name Pattern Matching
• MSK Multi-AZ Distribution
• Cross-Service Analysis

Messaging Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, aws.account.id, aws.region, aws.resource.id

To filter any type by tag, region, or account, apply standard filters: | filter tags[Environment] == "production" or | filter aws.account.id == "<AWS_ACCOUNT_ID>".

To summarize by region: | summarize count = count(), by: {aws.region}.

Service-Specific Queries

Filter for non-default EventBridge event buses:

smartscapeNodes "AWS_EVENTS_EVENTBUS"
| filter name != "default"
| fields name, aws.resource.id, aws.region

Find MSK clusters in a specific VPC:

smartscapeNodes "AWS_MSK_CLUSTER"
| filter aws.vpc.id == "<VPC_ID>"
| fields name, aws.resource.id, aws.subnet.id

Name Pattern Matching

Find queues or topics by name pattern using matchesPhrase:

smartscapeNodes "AWS_SQS_QUEUE"
| filter contains(name, "Sqs")
| fields name, aws.resource.id, aws.region

Replace "AWS_SQS_QUEUE" with "AWS_SNS_TOPIC" or any other type. Replace "orders" with the relevant pattern.

MSK Multi-AZ Distribution

Check Kafka cluster availability zone distribution:

smartscapeNodes "AWS_MSK_CLUSTER"
| fields name, aws.resource.id, aws.availability_zone, aws.vpc.id
| expand aws.availability_zone

Cross-Service Analysis

Count all messaging resources by type:

smartscapeNodes "AWS_SQS_QUEUE", "AWS_SNS_TOPIC", "AWS_EVENTS_EVENTBUS", "AWS_KINESISFIREHOSE_DELIVERYSTREAM", "AWS_MSK_CLUSTER", "AWS_STEPFUNCTIONS_STATEMACHINE"
| summarize total = count(), by: {type}
| sort total desc

Filter to a specific account:

smartscapeNodes "AWS_SQS_QUEUE", "AWS_SNS_TOPIC", "AWS_EVENTS_EVENTBUS", "AWS_MSK_CLUSTER"
| filter aws.account.id == "123456789012"
| fields type, name, aws.region, aws.resource.id

AWS Metrics & Performance

DQL timeseries patterns for AWS CloudWatch-sourced metrics. Use during investigation to determine whether a resource is saturated, erroring, or slow.

Query Template

The timeseries command with by: { dt.smartscape_source.id} splits results by Dynatrace entity, and a pipe | filter stage scopes the series to a specific resource. The By.<DimensionName> suffix in the metric key is the CloudWatch dimension used to align the metric to the entity.

timeseries cpu = avg(cloud.aws.ec2.CPUUtilization.By.InstanceId), by: { dt.smartscape_source.id},
  from: <PROBLEM_START - 30m>, to: <PROBLEM_END + 15m>
| filter dt.smartscape_source.id == toSmartscapeId("<ROOT_CAUSE_ENTITY_ID>")

Replace cloud.aws.ec2.CPUUtilization.By.InstanceId with the relevant metric key, and <ROOT_CAUSE_ENTITY_ID> with the Dynatrace entity ID (e.g. AWS_EC2_INSTANCE-1F335452CC14B245). Omit the | filter clause to get all instances of that metric.

Time windows: The template above uses <PROBLEM_START> and <PROBLEM_END> for scoping queries to a specific incident window. The per-service examples below use from: now()-1h for simplicity — substitute your incident timestamps when investigating a specific problem.

---

EC2 Metrics

Check CPU utilization for a specific instance:

timeseries cpu = avg(cloud.aws.ec2.CPUUtilization.By.InstanceId), by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<ROOT_CAUSE_ENTITY_ID>")

Check status check failures (non-zero = instance-level problem):

timeseries checks = max(cloud.aws.ec2.StatusCheckFailed.By.InstanceId), by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<ROOT_CAUSE_ENTITY_ID>")

---

Lambda Metrics

Check error rate and duration together:

timeseries {errors = sum(cloud.aws.lambda.Errors.By.FunctionName),
           duration = avg(cloud.aws.lambda.Duration.By.FunctionName)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<LAMBDA_ROOT_CAUSE_ENTITY_ID>")

Note: <LAMBDA_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the Lambda function (e.g., AWS_LAMBDA_FUNCTION-ABC123).

---

RDS Metrics

Check CPU and connections for a specific RDS instance:

timeseries {cpu = avg(cloud.aws.rds.CPUUtilization.By.DBInstanceIdentifier),
           connections = avg(cloud.aws.rds.DatabaseConnections.By.DBInstanceIdentifier)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<RDS_ROOT_CAUSE_ENTITY_ID>")

Note: <RDS_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the RDS instance (e.g., AWS_RDS_DBINSTANCE-ABC123).

---

SQS Metrics

Check queue depth over time:

timeseries {depth = max(cloud.aws.sqs.ApproximateNumberOfMessagesVisible.By.QueueName),
           age = max(cloud.aws.sqs.ApproximateAgeOfOldestMessage.By.QueueName)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<SQS_ROOT_CAUSE_ENTITY_ID>")

Note: <SQS_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the SQS queue (e.g., AWS_SQS_QUEUE-ABC123).

---

ALB Metrics

Important: HealthyHostCount.By.TargetGroup is scoped to a target group entity — use the Dynatrace entity ID for the target group as <ROOT_CAUSE_ENTITY_ID> when running that query.

Check request count and 5xx errors for a load balancer:

timeseries {requests = sum(cloud.aws.applicationelb.RequestCount.By.LoadBalancer),
           errors5xx = sum(cloud.aws.applicationelb.HTTPCode_ELB_5XX_Count.By.LoadBalancer)},
           by: { dt.smartscape_source.id},
  from: now()-1h
//| filter dt.smartscape_source.id == toSmartscapeId("<ROOT_CAUSE_ENTITY_ID>")

Important: If this returns empty the load balancer might not have any traffic during the selected time window.

Check healthy host count for a specific target group:

timeseries healthy = min(cloud.aws.applicationelb.HealthyHostCount.By.LoadBalancer.TargetGroup),
  by: { dt.smartscape_source.id , TargetGroup},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<ROOT_CAUSE_ENTITY_ID>")

---

ECS Metrics

Check CPU and memory for an ECS service:

timeseries {cpu = avg(cloud.aws.ecs.CPUUtilization.By.ClusterName.ServiceName),
           mem = avg(cloud.aws.ecs.MemoryUtilization.By.ClusterName.ServiceName)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<ECS_CLUSTER_ROOT_CAUSE_ENTITY_ID>")

Note: <ECS_CLUSTER_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the ECS cluster (e.g., AWS_ECS_CLUSTER-ABC123).

---

DynamoDB Metrics

Check capacity consumption and latency for a table:

timeseries {reads = avg(cloud.aws.dynamodb.ConsumedReadCapacityUnits.By.TableName),
           writes = avg(cloud.aws.dynamodb.ConsumedWriteCapacityUnits.By.TableName),
           latency = avg(cloud.aws.dynamodb.SuccessfulRequestLatency.By.Operation.TableName)},
           by: { dt.smartscape_source.id, TableName},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<DYNAMODB_TABLE_ROOT_CAUSE_ENTITY_ID>")

Note: <DYNAMODB_TABLE_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the DynamoDB table (e.g., AWS_DYNAMODB_TABLE-ABC123).

Check if provisioned capacity is being approached:

timeseries {readsProvisioned = avg(cloud.aws.dynamodb.ProvisionedReadCapacityUnits.By.TableName),
    writesProvisioned = avg(cloud.aws.dynamodb.ProvisionedWriteCapacityUnits.By.TableName),
    readsConsumed = avg(cloud.aws.dynamodb.ConsumedReadCapacityUnits.By.TableName),
    writesConsumed = avg(cloud.aws.dynamodb.ConsumedWriteCapacityUnits.By.TableName)},
  by: { dt.smartscape_source.id, TableName},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<DYNAMODB_TABLE_ROOT_CAUSE_ENTITY_ID>")

Note: <DYNAMODB_TABLE_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the DynamoDB table (e.g., AWS_DYNAMODB_TABLE-ABC123).

Note: This can be empty if the table is using on_demand instead of provisioned throughput).

---

NLB Metrics

Check TCP resets and flow counts for a specific NLB:

timeseries {clientResets = sum(cloud.aws.networkelb.TCP_Client_Reset_Count.By.LoadBalancer),
           targetResets = sum(cloud.aws.networkelb.TCP_Target_Reset_Count.By.LoadBalancer),
           elbResets = sum(cloud.aws.networkelb.TCP_ELB_Reset_Count.By.LoadBalancer)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<NLB_ROOT_CAUSE_ENTITY_ID>")

Note: <NLB_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the Network Load Balancer (e.g., AWS_ELASTICLOADBALANCINGV2_LOADBALANCER-ABC123).

Check healthy vs unhealthy targets per target group:

timeseries {healthy = min(cloud.aws.networkelb.HealthyHostCount.By.LoadBalancer.TargetGroup),
           unhealthy = max(cloud.aws.networkelb.UnHealthyHostCount.By.LoadBalancer.TargetGroup)},
           by: { dt.smartscape_source.id, TargetGroup},
  from: now()-1h

---

ElastiCache Metrics

Check CPU, memory, and evictions for a cache cluster:

timeseries {cpu = avg(cloud.aws.elasticache.EngineCPUUtilization.By.CacheClusterId),
           memory = avg(cloud.aws.elasticache.DatabaseMemoryUsagePercentage.By.CacheClusterId),
           evictions = sum(cloud.aws.elasticache.Evictions.By.CacheClusterId)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<ELASTICACHE_ROOT_CAUSE_ENTITY_ID>")

Note: <ELASTICACHE_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the ElastiCache cluster (e.g., AWS_ELASTICACHE_CLUSTER-ABC123).

Check cache hit ratio to detect cache effectiveness issues:

timeseries {hits = sum(cloud.aws.elasticache.CacheHits.By.CacheClusterId),
           misses = sum(cloud.aws.elasticache.CacheMisses.By.CacheClusterId)},
           by: { dt.smartscape_source.id},
  from: now()-1h

---

NAT Gateway Metrics

Check for port allocation errors and dropped packets (critical capacity indicators):

timeseries {portErrors = sum(cloud.aws.natgateway.ErrorPortAllocation.By.NatGatewayId),
           dropped = sum(cloud.aws.natgateway.PacketsDropCount.By.NatGatewayId),
           activeConns = max(cloud.aws.natgateway.ActiveConnectionCount.By.NatGatewayId)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<NAT_GW_ROOT_CAUSE_ENTITY_ID>")

Note: <NAT_GW_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the NAT Gateway (e.g., AWS_EC2_NATGATEWAY-ABC123). ErrorPortAllocation > 0 means the NAT Gateway cannot allocate more source ports — consider adding additional NAT Gateways or reducing connection volume.

Check traffic throughput for a NAT Gateway:

timeseries {bytesIn = sum(cloud.aws.natgateway.BytesInFromSource.By.NatGatewayId),
           bytesOut = sum(cloud.aws.natgateway.BytesOutToDestination.By.NatGatewayId)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<NAT_GW_ROOT_CAUSE_ENTITY_ID>")

---

API Gateway Metrics

API Gateway has two flavors with different metric keys: REST APIs (prefix cloud.aws.apigateway) use ApiName dimensions, while HTTP APIs use ApiId dimensions. Error metric names also differ: 4XXError/5XXError for REST, 4xx/5xx for HTTP APIs.

Check REST API error rates and latency:

timeseries {calls = sum(cloud.aws.apigateway.Count.By.ApiName),
           errors4xx = sum(cloud.aws.apigateway.4XXError.By.ApiName),
           errors5xx = sum(cloud.aws.apigateway.5XXError.By.ApiName),
           latency = avg(cloud.aws.apigateway.Latency.By.ApiName)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<APIGW_ROOT_CAUSE_ENTITY_ID>")

Note: <APIGW_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the API Gateway (e.g., AWS_APIGATEWAY_RESTAPI-ABC123).

Check HTTP API error rates and latency:

timeseries {calls = sum(cloud.aws.apigateway.Count.By.ApiId),
           errors4xx = sum(cloud.aws.apigateway.4xx.By.ApiId),
           errors5xx = sum(cloud.aws.apigateway.5xx.By.ApiId),
           latency = avg(cloud.aws.apigateway.Latency.By.ApiId)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<APIGW_ROOT_CAUSE_ENTITY_ID>")

---

SNS Metrics

Check publish volume and delivery failures for a topic:

timeseries {published = sum(cloud.aws.sns.NumberOfMessagesPublished.By.TopicName),
           delivered = sum(cloud.aws.sns.NumberOfNotificationsDelivered.By.TopicName),
           failed = sum(cloud.aws.sns.NumberOfNotificationsFailed.By.TopicName)},
           by: { dt.smartscape_source.id},
  from: now()-1h

Check delivery health for a specific topic:

timeseries {published = sum(cloud.aws.sns.NumberOfMessagesPublished.By.TopicName),
           delivered = sum(cloud.aws.sns.NumberOfNotificationsDelivered.By.TopicName),
           failed = sum(cloud.aws.sns.NumberOfNotificationsFailed.By.TopicName)},
           by: { dt.smartscape_source.id},
  from: now()-1h
| filter dt.smartscape_source.id == toSmartscapeId("<SNS_TOPIC_ROOT_CAUSE_ENTITY_ID>")

Note: <SNS_TOPIC_ROOT_CAUSE_ENTITY_ID> is the Dynatrace entity ID for the SNS topic (e.g., AWS_SNS_TOPIC-A281598EF3D8B475). If NumberOfNotificationsFailed is non-zero, check the subscriber endpoint (Lambda, SQS, HTTP) for errors.

---

S3 Metrics

S3 request metrics require a CloudWatch request metrics filter configured on the bucket. Without this filter, only storage-level metrics are available (via entity data — see security-compliance.md). All request metrics use the .By.BucketName.FilterId dimension pattern. The Dynatrace entity type is AWS_S3_BUCKET.

Check request volume and error rates for all buckets:

timeseries {
  requests = sum(cloud.aws.s3.AllRequests.By.BucketName.FilterId),
  errors4xx = sum(cloud.aws.s3.4xxErrors.By.BucketName.FilterId),
  errors5xx = sum(cloud.aws.s3.5xxErrors.By.BucketName.FilterId)
},
by: { dt.smartscape_source.id },
from: now()-2h

Check latency for a specific bucket:

timeseries {
  firstByte = avg(cloud.aws.s3.FirstByteLatency.By.BucketName.FilterId),
  totalLatency = avg(cloud.aws.s3.TotalRequestLatency.By.BucketName.FilterId)
},
by: { dt.smartscape_source.id },
from: now()-24h
| filter dt.smartscape_source.id == toSmartscapeId("<S3_BUCKET_ENTITY_ID>")

Note: <S3_BUCKET_ENTITY_ID> is the Dynatrace entity ID for the S3 bucket (e.g., AWS_S3_BUCKET-8278109BE96166BE). Per-operation metrics (GetRequests, PutRequests, etc.) are only available if the bucket's CloudWatch request metrics filter is configured to report them. If these return empty, check the S3 bucket metrics configuration in AWS.

---

MSK (Managed Kafka) Metrics

MSK metrics are split across three dimension patterns: cluster-level (.By.Cluster_Name), broker-level (.By.Broker_ID.Cluster_Name), and consumer-group-level (.By.Cluster_Name.Consumer_Group.Topic). The Dynatrace entity type is AWS_MSK_CLUSTER.

Cluster Health

Check cluster-level health — offline partitions and controller count are the most critical MSK indicators:

timeseries {
  offlinePartitions = max(cloud.aws.kafka.OfflinePartitionsCount.By.Cluster_Name),
  activeControllers = max(cloud.aws.kafka.ActiveControllerCount.By.Cluster_Name),
  globalPartitions = max(cloud.aws.kafka.GlobalPartitionCount.By.Cluster_Name),
  globalTopics = max(cloud.aws.kafka.GlobalTopicCount.By.Cluster_Name)
},
by: { dt.smartscape_source.id },
from: now()-2h
| filter dt.smartscape_source.id == toSmartscapeId("<MSK_CLUSTER_ENTITY_ID>")

Note: <MSK_CLUSTER_ENTITY_ID> is the Dynatrace entity ID for the MSK cluster (e.g., AWS_MSK_CLUSTER-4B5BA4FE313B7C3A). OfflinePartitionsCount > 0 means producers/consumers cannot read/write affected partitions — treat as a P1 incident.

Broker Resource Utilization

Check broker CPU and memory to identify overloaded brokers:

timeseries cpu = avg(cloud.aws.kafka.CpuUser.By.Broker_ID.Cluster_Name),
           cpuIdle = avg(cloud.aws.kafka.CpuIdle.By.Broker_ID.Cluster_Name),
           memUsed = avg(cloud.aws.kafka.MemoryUsed.By.Broker_ID.Cluster_Name),
           heapAfterGC = avg(cloud.aws.kafka.HeapMemoryAfterGC.By.Broker_ID.Cluster_Name),
           by: { dt.smartscape_source.id },
  from: now()-2h
| filter dt.smartscape_source.id == toSmartscapeId("<MSK_CLUSTER_ENTITY_ID>")

Check disk usage and burst balance for storage pressure:

timeseries diskUsed = avg(cloud.aws.kafka.KafkaDataLogsDiskUsed.By.Broker_ID.Cluster_Name),
           burstBalance = min(cloud.aws.kafka.BurstBalance.By.Broker_ID.Cluster_Name),
           by: { dt.smartscape_source.id },
  from: now()-2h
| filter dt.smartscape_source.id == toSmartscapeId("<MSK_CLUSTER_ENTITY_ID>")

Broker Throughput & Networking

Check throughput and connections across all brokers:

timeseries bytesIn = sum(cloud.aws.kafka.BytesInPerSec.By.Broker_ID.Cluster_Name),
           bytesOut = sum(cloud.aws.kafka.BytesOutPerSec.By.Broker_ID.Cluster_Name),
           connections = max(cloud.aws.kafka.ConnectionCount.By.Broker_ID.Cluster_Name),
           by: { dt.smartscape_source.id },
  from: now()-2h

Topic-Level Throughput

Consumer Group Lag

Check consumer group lag by topic — critical for detecting consumer processing failures:

timeseries lag = max(cloud.aws.kafka.EstimatedMaxTimeLag.By.Cluster_Name.Consumer_Group.Topic),
           offsetLag = max(cloud.aws.kafka.MaxOffsetLag.By.Cluster_Name.Consumer_Group.Topic),
           by: { dt.smartscape_source.id, Consumer_Group, Topic },
  from: now()-2h

Interpretation: If EstimatedMaxTimeLag is growing while BytesInPerSec is stable, the consumer is falling behind and needs scaling or debugging. If both lag and ingest rate spike, the issue may be upstream traffic growth rather than consumer failure.

---

Metric Discovery

When investigating a service not listed above, or when you need to verify which metrics are actually available on the tenant, use these discovery queries.

Find all available metrics for a given AWS service prefix:

fetch metric.series
| filter startsWith(metric.key, "cloud.aws.<SERVICE_PREFIX>")
| summarize count = count(), by: { metric.key }
| sort count desc

Replace <SERVICE_PREFIX> with any prefix (e.g., s3, kafka, networkelb, elasticache, natgateway, apigateway) to discover metrics for a specific service.

Find all AWS metrics available on the tenant:

fetch metric.series
| filter startsWith(metric.key, "cloud.aws.")
| summarize count = count(), by: { metric.key }
| sort count desc
| limit 200

---

Combining Entity Queries with Metrics

Find a set of entities by filter, then query metrics for all of them. Example: are all EC2 instances in a VPC experiencing high CPU, or just one?

Step 1 — Find resource IDs for the group:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter aws.vpc.id == "<VPC_ID>"
| fields name, aws.resource.id

Step 2 — Query metrics for all instances in the group (no filter = all series):

timeseries cpu = avg(cloud.aws.ec2.CPUUtilization.By.InstanceId),
           by: { dt.smartscape_source.id},
  from: now()-1h

Cross-reference the dt.smartscape_source.id dimension values against the entity IDs from Step 1 to identify which instances in the VPC are affected.

Cross-Service Correlation Patterns

When investigating an incident, a single service's metrics rarely tell the whole story. Use these patterns to correlate metrics across connected services and identify the actual bottleneck.

SQS + Lambda Consumer Health

When a Lambda function consumes from SQS, correlate queue depth growth with Lambda errors and throttles to identify consumer bottlenecks.

Query SQS queue depth and message age:

timeseries {
  queue_depth = max(cloud.aws.sqs.ApproximateNumberOfMessagesVisible.By.QueueName),
  queue_age = max(cloud.aws.sqs.ApproximateAgeOfOldestMessage.By.QueueName)
},
by: { dt.smartscape_source.id },
from: now()-6h

Query Lambda consumer errors and performance:

timeseries {
  errors = sum(cloud.aws.lambda.Errors.By.FunctionName),
  throttles = sum(cloud.aws.lambda.Throttles.By.FunctionName),
  duration = avg(cloud.aws.lambda.Duration.By.FunctionName)
},
by: { dt.smartscape_source.id },
from: now()-6h

Run both queries over the same time window. If queue depth grows while Lambda errors or throttles increase, the consumer is failing. If queue depth grows with no Lambda activity, the consumer may have been disconnected.

ALB + Backend Saturation

When ALB response time degrades, check whether backend targets are saturated.

Query ALB response time and error rates:

timeseries {
  response_time = avg(cloud.aws.applicationelb.TargetResponseTime.By.LoadBalancer),
  requests = sum(cloud.aws.applicationelb.RequestCount.By.LoadBalancer),
  errors_5xx = sum(cloud.aws.applicationelb.HTTPCode_ELB_5XX_Count.By.LoadBalancer)
},
by: { dt.smartscape_source.id },
from: now()-2h

Query ECS backend resource utilization:

timeseries {
  cpu = avg(cloud.aws.ecs.CPUUtilization.By.ClusterName.ServiceName),
  mem = avg(cloud.aws.ecs.MemoryUtilization.By.ClusterName.ServiceName)
},
by: { dt.smartscape_source.id },
from: now()-2h

If ALB 5xx errors spike while ECS CPU or memory is at 85%+, the service needs scaling. If ALB response time degrades but the backend looks healthy, the issue may be network or DNS.

RDS + Application Performance

When application errors spike, check whether the database is the bottleneck.

Query RDS latency, connections, and CPU:

timeseries {
  read_latency = avg(cloud.aws.rds.ReadLatency.By.DBInstanceIdentifier),
  write_latency = avg(cloud.aws.rds.WriteLatency.By.DBInstanceIdentifier),
  connections = avg(cloud.aws.rds.DatabaseConnections.By.DBInstanceIdentifier),
  cpu = avg(cloud.aws.rds.CPUUtilization.By.DBInstanceIdentifier)
},
by: { dt.smartscape_source.id },
from: now()-2h

If read or write latency spikes above 20ms while connections are near the instance limit, the database is saturated. If CPU is low but latency is high, the bottleneck is likely I/O rather than compute — check FreeStorageSpace and IOPS metrics.

Correlation tip: Always query both sides of a dependency over the same time window (from / to). Mismatched windows make it impossible to confirm whether two signals are actually correlated.

---

Metric Availability Note

Not all metrics are ingested by default — depends on which services are enabled in the AWS integration configuration. If a timeseries query returns no data:

1. Verify the entity exists: run the smartscapeNodes query from Step 1 of rca-workflow.md 2. Confirm the metric is collected in the AWS integration settings

Do not interpret empty timeseries results as "no problem" — it may mean the metric is not configured for this resource type.

AWS Resource Management & Optimization

Analyze AWS resource usage, identify optimization opportunities, and manage resource tagging.

Table of Contents

• Resource Inventory
• Tag Compliance
• Resource Lifecycle
• Regional & VPC Distribution
• Storage & Security Resources

Resource Inventory

Count all AWS resources by type:

smartscapeNodes "AWS_*"
| summarize resource_count = count(), by: {type}
| sort resource_count desc

View resource distribution across accounts:

smartscapeNodes "AWS_*"
| summarize resource_count = count(), by: {aws.account.id, aws.region}
| sort resource_count desc

Find resource types spanning multiple regions:

smartscapeNodes "AWS_*"
| summarize
    region_count = countDistinct(aws.region),
    total_resources = count(),
    by: {type}
| filter region_count > 1
| sort region_count desc

Tag Compliance

Find completely untagged resources:

smartscapeNodes "AWS_*"
| filter tags == record()
| fields type, name, aws.resource.id, aws.account.id, aws.region

Find resources missing a specific required tag:

smartscapeNodes "AWS_*"
| filter isNull(tags[Environment]) or tags[Environment] == ""
| summarize count = count(), by: {type, aws.account.id}

Calculate tag coverage percentages across resource types:

smartscapeNodes "AWS_*"
| fieldsAdd has_owner_tag = if(isNotNull(tags[Owner]), 1)
| fieldsAdd has_env_tag = if(isNotNull(tags[Environment]), 1)

| summarize
    total = count(),
    with_env = sum(has_env_tag),
    with_owner = sum(has_owner_tag),
  by: { type }
| fieldsAdd
    env_coverage_pct = (with_env * 100.0) / total,
    owner_coverage_pct = (with_owner * 100.0) / total
| sort env_coverage_pct asc

Find resources by tag value:

smartscapeNodes "AWS_*"
| filter tags[`<TAG_NAME>`] == "<TAG_VALUE>"
| summarize count = count(), by: {type, aws.region}

Find resources by naming convention:

smartscapeNodes "AWS_*"
| filter matchesPhrase(name, "prod")
| fields type, name, aws.resource.id, aws.region, tags[Environment]

Resource Lifecycle

Detect deleted resources:

smartscapeNodes "AWS_*"
| filter cloud.acquisition.status == "DELETED"
| fields type, name, aws.resource.id, aws.account.id, aws.region

Find resources with acquisition issues:

smartscapeNodes "AWS_*"
| filter cloud.acquisition.status != "OK"
| fields type, name, aws.resource.id, cloud.acquisition.status, aws.account.id

Find unattached EBS volumes:

smartscapeNodes "AWS_EC2_VOLUME"
| parse aws.object, "JSON:awsjson"
| fieldsAdd state = awsjson[configuration][state]
| filter state == "available"
| fields name, aws.resource.id, aws.availability_zone, aws.account.id

Find unassociated Elastic IPs:

smartscapeNodes "AWS_EC2_EIP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd associationId = awsjson[configuration][associationId]
| filter isNull(associationId)
| fields name, aws.resource.id, aws.region, aws.account.id

Regional & VPC Distribution

View resources by region:

smartscapeNodes "AWS_*"
| summarize resource_count = count(), by: {aws.region}
| sort resource_count desc

Count resources per VPC:

smartscapeNodes "AWS_*"
| filter isNotNull(aws.vpc.id)
| summarize resource_count = count(), by: {aws.vpc.id, type}
| sort resource_count desc

Storage & Security Resources

Count storage services:

smartscapeNodes "AWS_S3_BUCKET", "AWS_EC2_VOLUME", "AWS_EFS_FILESYSTEM"
| summarize count = count(), by: {type, aws.region}
| sort count desc

Count IAM and security resources:

smartscapeNodes "AWS_IAM_ROLE", "AWS_IAM_USER", "AWS_IAM_GROUP", "AWS_KMS_KEY", "AWS_EC2_SECURITYGROUP"
| summarize count = count(), by: {type}
| sort count desc

List S3 buckets:

smartscapeNodes "AWS_S3_BUCKET"
| fields name, aws.account.id, aws.region, aws.resource.id

Find EC2 snapshots:

smartscapeNodes "AWS_EC2_SNAPSHOT"
| fields name, aws.resource.id, aws.region, aws.account.id

AWS Resource Ownership & Chargeback

Track resource ownership and enable cost allocation across teams.

Table of Contents

• Tag-Based Ownership Pattern
• Common Ownership Tags
• Service-Specific Ownership
• Multi-Account Resource Summary

Tag-Based Ownership Pattern

All ownership queries follow the same pattern — filter by a tag, then summarize by that tag and a grouping dimension:

smartscapeNodes "AWS_*"
| filter isNotNull(tags[`<TAG_NAME>`])
| summarize resource_count = count(), by: {tags[`<TAG_NAME>`], type}
| sort resource_count desc

Replace <TAG_NAME> with any tag from the table below. Replace type with aws.region or aws.account.id for alternative groupings. Replace "AWS_*" with a specific entity type to scope to one service.

Common Ownership Tags

Service-Specific Ownership

To scope ownership queries to a specific AWS service, replace "AWS_*" with the entity type:

For service-specific queries, you can also select detail fields instead of summarizing:

smartscapeNodes "AWS_RDS_DBCLUSTER"
| filter isNotNull(tags[`<TAG_NAME>`])
| fields name, aws.resource.id, tags[`<TAG_NAME>`], aws.region

Multi-Account Resource Summary

Summarize resources across accounts (independent of tags):

smartscapeNodes "AWS_*"
| summarize resource_count = count(), by: {aws.account.id, type}
| sort resource_count desc
| limit 50

AWS Security & Compliance

Monitor security configurations and compliance across AWS resources.

Table of Contents

• Security Group Rule Analysis
• Overly Permissive Inbound Rules
• Security Group Blast Radius
• S3 Public Access & Encryption
• EBS Volume Encryption
• IAM & Key Management
• Public Access Detection
• Network Security

Security Group Rule Analysis

Security group rules are stored in aws.object as ipPermissions (ingress) and ipPermissionsEgress (egress) arrays. Convert these to strings with toString() and use contains() to search for risky patterns.

Find security groups with any ingress rule open to the internet (0.0.0.0/0 or ::/0):

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    ipPermissions = toString(awsjson[configuration][ipPermissions]),
    groupName = awsjson[configuration][groupName]
| filter contains(ipPermissions, "0.0.0.0/0") or contains(ipPermissions, "::/0")
| fields groupName, aws.resource.id, aws.vpc.id, ipPermissions

Count open security groups per VPC:

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd ipPermissions = toString(awsjson[configuration][ipPermissions])
| filter contains(ipPermissions, "0.0.0.0/0") or contains(ipPermissions, "::/0")
| summarize open_sg_count = count(), by: {aws.vpc.id}

Find security groups that are wide open — all traffic allowed from the internet (protocol -1 or port range 0-65535 combined with 0.0.0.0/0):

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    ipPermissions = toString(awsjson[configuration][ipPermissions]),
    groupName = awsjson[configuration][groupName]
| filter contains(ipPermissions, "0.0.0.0/0")
| filter contains(ipPermissions, "\"ipProtocol\":\"-1\"")
    or contains(ipPermissions, "\"fromPort\":0")
| fields groupName, aws.resource.id, aws.vpc.id, ipPermissions

Audit egress rules — count security groups with unrestricted outbound traffic per VPC:

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    ipPermissionsEgress = toString(awsjson[configuration][ipPermissionsEgress]),
    groupName = awsjson[configuration][groupName]
| filter contains(ipPermissionsEgress, "0.0.0.0/0")
| summarize egress_open_count = count(), by: {aws.vpc.id}

Tip: The ipPermissions field is a JSON array. To detect specific open ports (e.g., SSH 22, RDP 3389, PostgreSQL 5432), combine the 0.0.0.0/0 filter with a port-specific string match: contains(ipPermissions, "\"fromPort\":22"). For a full list of risky ports, repeat with 3389 (RDP), 3306 (MySQL), 5432 (PostgreSQL), 6379 (Redis), 27017 (MongoDB).

Overly Permissive Inbound Rules

The queries above use string-based contains() for quick detection. The queries below use expand to inspect individual rules, enabling per-rule filtering by port and protocol.

Find all security groups with any 0.0.0.0/0 inbound rule:

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd ipPermissions = awsjson[configuration][ipPermissions]
| filter contains(toString(ipPermissions), "0.0.0.0/0")
| fields name, aws.resource.id, aws.vpc.id

Find security groups allowing 0.0.0.0/0 on all traffic or all ports — the highest-risk configuration:

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd ipPermissions = awsjson[configuration][ipPermissions]
| expand ipPermissions
| filter contains(toString(ipPermissions[ipRanges]), "0.0.0.0/0")
| filter ipPermissions[ipProtocol] == "-1"
    or (ipPermissions[fromPort] == 0 and ipPermissions[toPort] == 65535)
| fieldsAdd protocol = ipPermissions[ipProtocol],
            fromPort = ipPermissions[fromPort],
            toPort = ipPermissions[toPort]
| fields name, aws.resource.id, aws.vpc.id, protocol, fromPort, toPort

Find security groups allowing 0.0.0.0/0 on dangerous ports (SSH, RDP, databases). Adjust the port list to match your organization's policy:

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd ipPermissions = awsjson[configuration][ipPermissions]
| expand ipPermissions
| filter contains(toString(ipPermissions[ipRanges]), "0.0.0.0/0")
| fieldsAdd protocol = ipPermissions[ipProtocol],
            fromPort = ipPermissions[fromPort],
            toPort = ipPermissions[toPort]
| filter in(toPort, array(22, 3389, 3306, 5432, 1433, 6379, 27017, 9200))
| fields name, aws.resource.id, aws.vpc.id, protocol, fromPort, toPort
| sort toPort

Dangerous ports reference: 22 (SSH), 3389 (RDP), 3306 (MySQL), 5432 (PostgreSQL), 1433 (MSSQL), 6379 (Redis), 27017 (MongoDB), 9200 (Elasticsearch).

Summarize open-to-internet inbound rules by port — useful for audit dashboards:

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| parse aws.object, "JSON:awsjson"
| fieldsAdd ipPermissions = awsjson[configuration][ipPermissions]
| expand ipPermissions
| filter contains(toString(ipPermissions[ipRanges]), "0.0.0.0/0")
| fieldsAdd protocol = ipPermissions[ipProtocol],
            toPort = ipPermissions[toPort]
| summarize sg_count = count(), by: {protocol, toPort}
| sort sg_count desc

Security Group Blast Radius

Find security groups with the most instances (blast radius):

smartscapeNodes "AWS_EC2_INSTANCE"
| traverse "uses", "AWS_EC2_SECURITYGROUP"
| summarize instance_count = count(), by: {aws.resource.name, aws.vpc.id}
| sort instance_count desc
| limit 20

Find instances with multiple security groups:

smartscapeNodes "AWS_EC2_INSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd sg_count = arraySize(awsjson[configuration][securityGroups])
| filter sg_count > 1
| fields name, aws.resource.id, aws.security_group.id, sg_count
| sort sg_count desc

List security groups (for finding unused ones, cross-reference with instance usage):

smartscapeNodes "AWS_EC2_SECURITYGROUP"
| fields name, aws.resource.id, aws.vpc.id
| limit 100

S3 Public Access & Encryption

S3 bucket security configuration is in supplementary_configuration within aws.object. The four publicAccessBlockConfiguration booleans should all be true for a properly secured bucket.

Audit Public Access Block settings across all S3 buckets:

smartscapeNodes "AWS_S3_BUCKET"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    blockPublicAcls = awsjson[supplementary_configuration][publicAccessBlockConfiguration][blockPublicAcls],
    ignorePublicAcls = awsjson[supplementary_configuration][publicAccessBlockConfiguration][ignorePublicAcls],
    blockPublicPolicy = awsjson[supplementary_configuration][publicAccessBlockConfiguration][blockPublicPolicy],
    restrictPublicBuckets = awsjson[supplementary_configuration][publicAccessBlockConfiguration][restrictPublicBuckets]
| fields name, aws.account.id, aws.region,
         blockPublicAcls, ignorePublicAcls, blockPublicPolicy, restrictPublicBuckets

Find S3 buckets missing any Public Access Block setting (potential public exposure):

smartscapeNodes "AWS_S3_BUCKET"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    blockPublicAcls = awsjson[supplementary_configuration][publicAccessBlockConfiguration][blockPublicAcls],
    ignorePublicAcls = awsjson[supplementary_configuration][publicAccessBlockConfiguration][ignorePublicAcls],
    blockPublicPolicy = awsjson[supplementary_configuration][publicAccessBlockConfiguration][blockPublicPolicy],
    restrictPublicBuckets = awsjson[supplementary_configuration][publicAccessBlockConfiguration][restrictPublicBuckets]
| filter blockPublicAcls != true
    or ignorePublicAcls != true
    or blockPublicPolicy != true
    or restrictPublicBuckets != true
| fields name, aws.account.id, aws.region,
         blockPublicAcls, ignorePublicAcls, blockPublicPolicy, restrictPublicBuckets

Find S3 buckets with no Public Access Block configuration at all:

smartscapeNodes "AWS_S3_BUCKET"
| parse aws.object, "JSON:awsjson"
| fieldsAdd pubBlock = awsjson[supplementary_configuration][publicAccessBlockConfiguration]
| filter isNull(pubBlock)
| fields name, aws.account.id, aws.region

Detect S3 buckets with public ACL grants (AllUsers or AuthenticatedUsers):

smartscapeNodes "AWS_S3_BUCKET"
| parse aws.object, "JSON:awsjson"
| fieldsAdd acl = toString(awsjson[supplementary_configuration][accessControlList][grants])
| filter contains(acl, "AllUsers") or contains(acl, "AuthenticatedUsers")
| fields name, aws.account.id, aws.region, acl

Summarize S3 security posture — encryption algorithm and public access block status:

smartscapeNodes "AWS_S3_BUCKET"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    blockPublicAcls = awsjson[supplementary_configuration][publicAccessBlockConfiguration][blockPublicAcls],
    sseAlgorithm = awsjson[supplementary_configuration][serverSideEncryptionConfiguration][rules][0][applyServerSideEncryptionByDefault][sseAlgorithm]
| summarize bucket_count = count(), by: {blockPublicAcls, sseAlgorithm}

EBS Volume Encryption

Summarize EBS volume encryption status by volume type:

smartscapeNodes "AWS_EC2_VOLUME"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    encrypted = awsjson[configuration][encrypted],
    volumeType = awsjson[configuration][volumeType],
    state = awsjson[configuration][state]
| summarize volume_count = count(), by: {encrypted, volumeType}
| sort volume_count desc

List unencrypted EBS volumes with size and location:

smartscapeNodes "AWS_EC2_VOLUME"
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    encrypted = awsjson[configuration][encrypted],
    volumeType = awsjson[configuration][volumeType],
    size = awsjson[configuration][size]
| filter encrypted != true
| fields name, aws.resource.id, aws.availability_zone, volumeType, size

IAM & Key Management

Note: IAM analysis in Dynatrace is limited to role-level metadata. For policy-level analysis (overly permissive policies, unused access keys, MFA status), use AWS IAM Access Analyzer or Security Hub.

Identify IAM roles used by Lambda functions:

smartscapeNodes "AWS_IAM_ROLE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd assumeRolePolicyDocument = awsjson[configuration][assumeRolePolicyDocument]
| filter contains(toString(assumeRolePolicyDocument), "lambda")
| fields name, aws.account.id

Monitor KMS encryption key states:

smartscapeNodes "AWS_KMS_KEY"
| parse aws.object, "JSON:awsjson"
| fieldsAdd keyState = awsjson[configuration][keyState],
            keyUsage = awsjson[configuration][keyUsage]
| summarize key_count = count(), by: {keyState, keyUsage}
| sort key_count desc

Check RDS database encryption:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd storageEncrypted = awsjson[configuration][storageEncrypted]
| summarize db_count = count(), by: {storageEncrypted, aws.region}

Count IAM roles by account:

smartscapeNodes "AWS_IAM_ROLE"
| summarize role_count = count(), by: {aws.account.id}
| sort role_count desc

Public Access Detection

Find publicly accessible RDS databases:

smartscapeNodes "AWS_RDS_DBINSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd publiclyAccessible = awsjson[configuration][publiclyAccessible]
| filter publiclyAccessible == true
| fields name, aws.resource.id, aws.vpc.id, aws.account.id

Identify internet-facing load balancers:

smartscapeNodes "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER"
| parse aws.object, "JSON:awsjson"
| fieldsAdd scheme = awsjson[configuration][scheme]
| filter scheme == "internet-facing"
| fields name, aws.resource.id, aws.vpc.id, aws.region

Audit VPC attachment coverage across Lambda functions — use to verify functions requiring private connectivity have VPC configured. For per-function networking detail, see references/serverless-containers.md.

smartscapeNodes "AWS_LAMBDA_FUNCTION"
| filter isNotNull(aws.vpc.id)
| fields name, aws.resource.id, aws.vpc.id, aws.security_group.id
| summarize function_count = count(), by: {aws.vpc.id}

Network Security

Analyze VPC endpoint private connectivity:

smartscapeNodes "AWS_EC2_VPCENDPOINT"
| parse aws.object, "JSON:awsjson"
| fieldsAdd serviceName = awsjson[configuration][serviceName]
| summarize endpoint_count = count(), by: {serviceName, aws.vpc.id}
| sort endpoint_count desc

List Route53 hosted zones:

smartscapeNodes "AWS_ROUTE53_HOSTEDZONE"
| summarize zone_count = count(), by: {aws.account.id}

AWS Serverless & Container Workloads

Monitor AWS Lambda, ECS, EKS, and App Runner services.

Table of Contents

• Serverless & Container Entity Types
• Lambda Monitoring
• ECS Monitoring
• EKS Monitoring
• App Runner
• Cross-Service Analysis

Serverless & Container Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, aws.account.id, aws.region, ...

Lambda Monitoring

Find Lambda functions with VPC access — use for networking troubleshooting and dependency mapping. For a security audit of VPC attachment coverage, see security-compliance.md#public-access-detection.

smartscapeNodes "AWS_LAMBDA_FUNCTION"
| filter isNotNull(aws.vpc.id)
| fields name, aws.resource.id, aws.vpc.id, aws.subnet.id, aws.security_group.id

Filter functions by tag:

smartscapeNodes "AWS_LAMBDA_FUNCTION"
| filter tags[Environment] == "production"
| fields name, aws.resource.id, aws.region

ECS Monitoring

Map ECS services to their clusters using traversal:

smartscapeNodes "AWS_ECS_SERVICE"
| traverse "belongs_to", "AWS_ECS_CLUSTER"
| fields name, aws.resource.id, aws.region

Find which services use which task definitions:

smartscapeNodes "AWS_ECS_SERVICE"
| traverse "uses", "AWS_ECS_TASKDEFINITION"
| fields name, aws.resource.id

Analyze ECS service networking (subnet attachment):

smartscapeNodes "AWS_ECS_SERVICE"
| traverse "is_attached_to", "AWS_EC2_SUBNET"
| fields name, aws.resource.id, aws.vpc.id

Find ECS service security groups:

smartscapeNodes "AWS_ECS_SERVICE"
| traverse "uses", "AWS_EC2_SECURITYGROUP"
| fields name, aws.resource.id

EKS Monitoring

List EKS clusters with VPC context:

smartscapeNodes "AWS_EKS_CLUSTER"
| fields name, aws.account.id, aws.region, aws.vpc.id

App Runner

Find App Runner VPC connectors (for private connectivity):

smartscapeNodes "AWS_APPRUNNER_VPCCONNECTOR"
| fields name, aws.resource.id, aws.vpc.id

Cross-Service Analysis

Count all container platforms by type and region:

smartscapeNodes "AWS_ECS_CLUSTER", "AWS_EKS_CLUSTER", "AWS_APPRUNNER_SERVICE"
| summarize count = count(), by: {type, aws.region}
| sort count desc

AWS VPC Networking & Security

Monitor and troubleshoot AWS VPC network infrastructure, security groups, and connectivity.

Table of Contents

• VPC Discovery
• Security Group Analysis
• Subnet & Instance Distribution
• Internet-Facing Resources
• Network Infrastructure
• Availability Zone Distribution

VPC Discovery

List all VPCs:

smartscapeNodes "AWS_EC2_VPC"
| fields name, aws.account.id, aws.region, aws.resource.id, aws.vpc.id

Get all resources in a VPC grouped by type:

smartscapeNodes "AWS_*"
| filter aws.vpc.id == "<VPC_ID>"
| summarize resource_count = count(), by: {type, aws.subnet.id}
| sort resource_count desc

Security Group Analysis

Find all instances and their security groups:

smartscapeNodes "AWS_EC2_INSTANCE"
| fields name, aws.resource.id, aws.vpc.id, aws.security_group.id
| expand aws.security_group.id

Locate all resources using a specific security group:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter contains(aws.security_group.id, "<EC2_SECURITY_GROUP>")
| fields name, aws.resource.id, aws.vpc.id, aws.subnet.id

Find instances with multiple security groups:

smartscapeNodes "AWS_EC2_INSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd sg_count = arraySize(awsjson[configuration][securityGroups])
| filter sg_count > 0
| fields name, aws.resource.id, aws.security_group.id, sg_count
| sort sg_count desc

Subnet & Instance Distribution

Count instances per subnet:

smartscapeNodes "AWS_EC2_INSTANCE"
| summarize instance_count = count(), by: {aws.vpc.id, aws.subnet.id}
| sort instance_count desc

Find EC2 instances in a specific VPC:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter aws.vpc.id == "<VPC_ID>"
| fields name, aws.resource.id, aws.subnet.id, aws.availability_zone

Internet-Facing Resources

Locate instances with public IPs:

smartscapeNodes "AWS_EC2_INSTANCE"
| parse aws.object, "JSON:awsjson"
| fieldsAdd publicIp = awsjson[configuration][networkInterfaces][0][association][publicIp]
| filter isNotNull(publicIp)
| fields name, aws.resource.id, publicIp, aws.vpc.id

Network Infrastructure

List network interfaces:

smartscapeNodes "AWS_EC2_NETWORKINTERFACE"
| fields name, aws.resource.id, aws.vpc.id, aws.subnet.id, aws.security_group.id

NAT gateways by VPC:

smartscapeNodes "AWS_EC2_NATGATEWAY"
| fields name, aws.resource.id, aws.vpc.id, aws.subnet.id
| summarize nat_count = count(), by: {aws.vpc.id}

VPN gateways:

smartscapeNodes "AWS_EC2_VPNGATEWAY"
| fields name, aws.resource.id, aws.vpc.id, aws.region

VPC endpoints:

smartscapeNodes "AWS_EC2_VPCENDPOINT"
| fields name, aws.resource.id, aws.vpc.id, aws.subnet.id

VPC peering connections:

smartscapeNodes "AWS_EC2_VPCPEERINGCONNECTION"
| fields name, aws.resource.id, aws.vpc.id, aws.region

Availability Zone Distribution

View instance distribution across AZs:

smartscapeNodes "AWS_EC2_INSTANCE"
| summarize
    instance_count = count(),
    by: {aws.region, aws.availability_zone, aws.vpc.id}
| sort aws.region, instance_count desc

Workload Detection Reference

Identify how an EC2 instance is orchestrated. Run these detection queries during problem analysis to determine which orchestration system manages the affected instance — this determines the correct resolution path.

Table of Contents

• Overview
• 1. Load Balancer Detection
• 2. Auto Scaling Group Detection
• 3. ECS Detection
• 4. EKS / Kubernetes Node Detection
• 5. AWS Batch Detection

Overview

EC2 instances can be managed by different orchestration systems, each requiring a different resolution approach. Run the detection queries below to identify the workload pattern before following a resolution path.

Workload Pattern Summary

Replace <WORKLOAD_EC2_INSTANCE> with the Dynatrace entity ID of the affected instance (e.g., AWS_EC2_INSTANCE-ABC123).

---

1. Load Balancer Detection

Determine if the instance is registered in a target group behind an Application or Network Load Balancer.

smartscapeNodes "AWS_EC2_INSTANCE"
| filter id == "<WORKLOAD_EC2_INSTANCE>"
| traverse "balanced_by", "AWS_ELASTICLOADBALANCINGV2_TARGETGROUP", direction:backward
| fieldsAdd targetGroupName = aws.resource.name, targetGroupId = id
| traverse "balanced_by", "AWS_ELASTICLOADBALANCINGV2_LOADBALANCER", fieldsKeep:{targetGroupName, targetGroupId}
| parse aws.object, "JSON:awsjson"
| fieldsAdd
    lbDnsName = awsjson[configuration][dnsName],
    lbScheme = awsjson[configuration][scheme],
    lbType = awsjson[configuration][type]
| fields name, lbDnsName, lbScheme, lbType, targetGroupName,
         dt.traverse.history[-1][targetGroupId]

If results returned: The instance is behind a load balancer. Record the ALB/NLB name and lbScheme (internet-facing vs internal) — this is critical for resolution (e.g., traffic can be shifted away before remediation).

---

2. Auto Scaling Group Detection

Determine if the instance is part of an Auto Scaling Group and check current capacity vs configured limits.

smartscapeNodes "AWS_EC2_INSTANCE"
| filter id == toSmartscapeId("<WORKLOAD_EC2_INSTANCE>")
| traverse "*", "AWS_AUTOSCALING_AUTOSCALINGGROUP", direction:"backward"
| parse aws.object, "JSON:awsjson"
| fieldsAdd asgMin = awsjson[`configuration`][`minSize`]
| fieldsAdd asgMax = awsjson[`configuration`][`maxSize`]
| fieldsAdd asgDesired = awsjson[`configuration`][`desiredCapacity`]
| fields name, id, asgMin, asgMax, asgDesired

If results returned: Record name, asgMin, asgMax, and asgDesired — if asgDesired < asgMax, scale-out is possible. If asgDesired == asgMax, the ASG is at capacity and cannot scale further without a limit change.

---

3. ECS Detection

Detect whether the instance is an ECS container instance, managed by ECS for running containerized tasks.

Step 1 — Detect by tag:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter id == "<WORKLOAD_EC2_INSTANCE>"
| filter isNotNull(tags[`AmazonECSManaged`])
| fields name, id, tags[`aws:autoscaling:groupName`]

Step 2 — If matched, find the ECS cluster:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter id == "<WORKLOAD_EC2_INSTANCE>"
| traverse {"*"}, {"AWS_ECS_CONTAINERINSTANCE"}, direction:backward
| traverse {"*"}, {"AWS_ECS_CLUSTER"}
| fields name, id, aws.resource.id

Record: ECS cluster name and ID — needed for resolution guidance (e.g., draining the container instance, scaling the ECS service).

---

4. EKS / Kubernetes Node Detection

Detect whether the instance is a Kubernetes worker node managed by EKS, and identify the node management mechanism (Karpenter, Cluster Autoscaler, EKS Managed Node Group, or eksctl).

Step 1 — Detect by tag and extract node manager details:

smartscapeNodes "AWS_EC2_INSTANCE"
| filter id == "<WORKLOAD_EC2_INSTANCE>"
| fieldsAdd tagStr = toString(tags)
| filter matchesPhrase(tagStr, "kubernetes.io/cluster")
| fieldsAdd
    eksClusterName = tags[`aws:eks:cluster-name`],
    nodegroupName = tags[`eks:nodegroup-name`],
    karpenterManagedBy = tags[`karpenter.sh/managed-by`],
    karpenterNodepool = tags[`karpenter.sh/nodepool`],
    casEnabled = tags[`k8s.io/cluster-autoscaler/enabled`],
    eksctlNodegroupName = tags[`alpha.eksctl.io/nodegroup-name`],
    eksctlNodegroupType = tags[`alpha.eksctl.io/nodegroup-type`]
| fields name, id, eksClusterName, nodegroupName, karpenterManagedBy,
         karpenterNodepool, casEnabled, eksctlNodegroupName, eksctlNodegroupType

Step 2 — Find the EKS cluster entity:

smartscapeNodes "AWS_EKS_CLUSTER"
| filter aws.resource.name == "<EKS_CLUSTER_NAME>"
| fields name, id, aws.resource.id, aws.region

Replace <EKS_CLUSTER_NAME> with the value from eksClusterName in Step 1.

Step 3 — Determine the node manager from the extracted fields:

Record: EKS cluster name, node manager type, and node pool / node group name — needed for resolution guidance (e.g., cordon/drain via kubectl, scale Karpenter node pool, or update ASG desired capacity).

---

5. AWS Batch Detection

Detect whether the instance is a compute environment node managed by AWS Batch.

smartscapeNodes "AWS_EC2_INSTANCE"
| filter id == "<WORKLOAD_EC2_INSTANCE>"
| filter isNotNull(tags[`AWSBatchServiceTag`])
| fieldsAdd
    batchJobQueue = tags[`aws:batch:job-queue-name`],
    batchComputeEnv = tags[`aws:batch:compute-environment-name`]
| fields name, id, batchJobQueue, batchComputeEnv, tags

Record: Batch compute environment name (batchComputeEnv) and job queue (batchJobQueue) — needed for resolution guidance (e.g., disabling the compute environment, draining the job queue).