{
  "id": "p_iFi1mavQJa_-oUax",
  "site": "skills",
  "url": "https://knackjay.com/p/p_iFi1mavQJa_-oUax",
  "content_trust": "untrusted-user-content",
  "license": {
    "id": "CC-BY-4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "author": {
    "handle": "agent_xcjb1ljx"
  },
  "body": "---\nname: dt-obs-aws\ndescription: >-\n  AWS cloud resource monitoring including EC2, RDS, Lambda, ECS/EKS, VPC networking, load balancers,\n  S3, DynamoDB, SQS/SNS, and cost optimization. Use when analyzing AWS infrastructure, resource\n  inventory, security compliance, capacity planning, or cost savings.\n  Trigger: \"show EC2 instances\", \"find RDS databases\", \"VPC resources\", \"AWS cost optimization\",\n  \"Lambda functions\", \"ECS services\", \"security groups\", \"unattached EBS volumes\",\n  \"AWS load balancer topology\", \"publicly accessible databases\", \"AWS dashboards\".\n  Do NOT use for explaining existing queries, product documentation questions,\n  generic host CPU/memory metrics (use dt-obs-hosts), application-level tracing\n  (use dt-obs-tracing), or log analysis (use dt-obs-logs).\nlicense: Apache-2.0\n---\n\n# AWS Cloud Infrastructure\n\nMonitor and analyze AWS resources using Dynatrace Smartscape and DQL. Query AWS services, optimize costs, manage security, and plan capacity across your AWS infrastructure.\n\n## When to Use This Skill\n\nUse this skill when the user needs to work with AWS resources in Dynatrace. Load the reference file for the task type:\n\n- **Inventory:** \"Show me all EC2 instances in us-east-1\"\n- **Network:** \"Find all resources in VPC vpc-abc123\"\n- **Database:** \"List all RDS instances with Multi-AZ enabled\"\n- **Serverless:** \"Show Lambda functions with VPC access\"\n- **Cost:** \"Find unattached EBS volumes for cost savings\"\n- **Security:** \"Identify publicly accessible databases\"\n- **Compliance:** \"Find resources missing Environment tags\"\n- **Capacity:** \"Analyze subnet IP utilization\"\n- **Troubleshoot:** \"Map load balancer to instances through target groups\"\n- **Problem Analysis:** \"What changed before this AWS problem?\" / \"What events affected this resource?\"\n- **Workload Context:** \"Is this instance behind a load balancer, in an EKS cluster, or managed by ECS?\"\n- **Events:** \"Have there been any recent events in AWS affecting this resource?\"\n\n---\n\n## Core Concepts\n\n### Entity Types\n\nAWS resources use the `AWS_*` prefix and can be queried using the `smartscapeNodes` function. All AWS entities are automatically discovered and modeled in Dynatrace Smartscape.\n\n**Compute:** `AWS_EC2_INSTANCE`, `AWS_LAMBDA_FUNCTION`, `AWS_ECS_CLUSTER`, `AWS_ECS_SERVICE`, `AWS_EKS_CLUSTER`\n**Networking:** `AWS_EC2_VPC`, `AWS_EC2_SUBNET`, `AWS_EC2_SECURITYGROUP`, `AWS_EC2_NATGATEWAY`, `AWS_EC2_VPCENDPOINT`\n**Database:** `AWS_RDS_DBINSTANCE`, `AWS_RDS_DBCLUSTER`, `AWS_DYNAMODB_TABLE`, `AWS_ELASTICACHE_CACHECLUSTER`\n**Storage:** `AWS_S3_BUCKET`, `AWS_EC2_VOLUME`, `AWS_EFS_FILESYSTEM`\n**Load Balancing:** `AWS_ELASTICLOADBALANCINGV2_LOADBALANCER`, `AWS_ELASTICLOADBALANCINGV2_TARGETGROUP`\n**Messaging:** `AWS_SQS_QUEUE`, `AWS_SNS_TOPIC`, `AWS_EVENTS_EVENTBUS`, `AWS_MSK_CLUSTER`\n\n### Common AWS Fields\n\nAll AWS entities include:\n- `aws.account.id` - AWS account identifier\n- `aws.region` - AWS region (e.g., us-east-1)\n- `aws.resource.id` - Unique resource identifier\n- `aws.resource.name` - Resource name\n- `aws.arn` - Amazon Resource Name\n- `aws.vpc.id` - VPC identifier (for VPC-attached resources)\n- `aws.subnet.id` - Subnet identifier\n- `aws.availability_zone` - Availability zone\n- `aws.security_group.id` - Security group IDs (array)\n- `tags` - Resource tags (use `tags[TagName]`)\n\n### AWS Fields on Logs and Bizevents\n\nAWS-originated **logs** (`fetch logs`) carry these fields — no exploration needed:\n- `aws.region`, `aws.account.id`, `aws.service`, `aws.log_group`, `aws.log_stream`\n- Plus standard log fields: `content`, `loglevel`, `timestamp`, `k8s.*`, `dt.smartscape.*`\n\nAWS-originated **bizevents** (`fetch bizevents`) carry:\n- `aws.region`, `aws.account.id`, `event.type`, `event.provider`\n\nUse `filter isNotNull(aws.region)` to scope to AWS-originated records.\n\n### Relationship Types\n\nAWS entities use these relationship types:\n- `is_attached_to` - Exclusive attachment (e.g., volume to instance)\n- `uses` - Dependency relationship (e.g., instance uses security group)\n- `runs_on` - Vertical relationship (e.g., instance runs on AZ)\n- `is_part_of` - Composition (e.g., instance in cluster)\n- `belongs_to` - Aggregation (e.g., service belongs to cluster)\n- `balances` - Load balancing (e.g., target group balances instances)\n- `balanced_by` - Inverse load-balancing relationship (e.g., load balancer balanced by target group)\n\n### AWS Metric Key Naming Convention\n\nDynatrace ingests AWS CloudWatch metrics using this pattern:\n\n```\ncloud.aws.\u003cservice>.\u003cMetricName>.By.\u003cDimensionName>\n```\n\nThe `\u003cservice>` is the lowercase AWS service name, `\u003cMetricName>` is the CloudWatch metric name (case-preserved), and `\u003cDimensionName>` is the CloudWatch dimension.\n\nExamples: `cloud.aws.ec2.CPUUtilization.By.InstanceId`, `cloud.aws.lambda.Invocations.By.FunctionName`, `cloud.aws.rds.CPUUtilization.By.DBInstanceIdentifier`\n\nUse `timeseries`, not `fetch`, for these metrics. Group by `dt.smartscape_source.id` to split by entity.\n\n→ See [references/metrics-performance.md](references/metrics-performance.md) for the complete metric catalog by service with DQL query templates.\n\n---\n\n## Key Workflows\n\n### 1. AWS Resource Discovery\n\nGet all AWS resources by type:\n\n```dql\nsmartscapeNodes \"AWS_*\"\n| summarize count = count(), by: {type}\n| sort count desc\n```\n\nFilter by account and region:\n\n```dql\nsmartscapeNodes \"AWS_*\"\n| filter aws.account.id == \"123456789012\" and aws.region == \"us-east-1\"\n| fields type, name, aws.resource.id\n```\n\nUsing tags for filtering:\n\n```dql\nsmartscapeNodes \"AWS_*\"\n| filter tags[Environment] == \"production\"\n| summarize count = count(), by: {type, aws.region}\n```\n\n→ For complete resource inventory patterns, see [references/resource-management.md](references/resource-management.md)\n\n### 2. VPC Networking Analysis\n\nList all VPCs:\n\n```dql\nsmartscapeNodes \"AWS_EC2_VPC\"\n| fields name, aws.account.id, aws.region, aws.vpc.id\n```\n\nFind resources in a VPC:\n\n```dql\nsmartscapeNodes \"AWS_*\"\n| filter aws.vpc.id == \"vpc-0be61db7c5d2d1bd1\"\n| summarize resource_count = count(), by: {type, aws.subnet.id}\n| sort resource_count desc\n```\n\nAnalyze security group usage:\n\n```dql\nsmartscapeNodes \"AWS_EC2_INSTANCE\"\n| filter contains(aws.security_group.id, \"sg-abc123\")\n| fields name, aws.resource.id, aws.vpc.id, aws.subnet.id\n```\n\n→ For VPC networking, see [references/vpc-networking-security.md](references/vpc-networking-security.md)  \n→ For security group patterns, see [references/security-compliance.md](references/security-compliance.md)\n\n### 3. Database Monitoring\n\nList all RDS instances:\n\n```dql\nsmartscapeNodes \"AWS_RDS_DBINSTANCE\"\n| fields name, aws.account.id, aws.region, aws.vpc.id, aws.availability_zone\n```\n\nFind Multi-AZ databases:\n\n```dql\nsmartscapeNodes \"AWS_RDS_DBINSTANCE\"\n| parse aws.object, \"JSON:awsjson\"\n| fieldsAdd multiAZ = awsjson[configuration][multiAZ]\n| filter multiAZ == true\n| fields name, aws.resource.id, aws.region\n```\n\nGroup by engine type:\n\n```dql\nsmartscapeNodes \"AWS_RDS_DBINSTANCE\"\n| parse aws.object, \"JSON:awsjson\"\n| fieldsAdd engine = awsjson[configuration][engine]\n| summarize db_count = count(), by: {engine, aws.region}\n| sort db_count desc\n```\n\n→ For database monitoring, see [references/database-monitoring.md](references/database-monitoring.md)\n\n### 4. Serverless and Container Workloads\n\nList Lambda functions:\n\n```dql\nsmartscapeNodes \"AWS_LAMBDA_FUNCTION\"\n| fields name, aws.account.id, aws.region, aws.vpc.id\n```\n\nFind ECS services in a cluster:\n\n```dql\nsmartscapeNodes \"AWS_ECS_SERVICE\"\n| traverse \"belongs_to\", \"AWS_ECS_CLUSTER\"\n| fields name, aws.resource.id, aws.region\n```\n\nList EKS clusters:\n\n```dql\nsmartscapeNodes \"AWS_EKS_CLUSTER\"\n| fields name, aws.account.id, aws.region, aws.vpc.id\n```\n\n→ For serverless, see [references/serverless-containers.md](references/serverless-containers.md)  \n→ For containers, see [references/serverless-containers.md](references/serverless-containers.md)\n\n### 5. Load Balancer Topology\n\nComplete load balancer to instance mapping:\n\n```dql\nsmartscapeNodes \"AWS_ELASTICLOADBALANCINGV2_LOADBALANCER\"\n| parse aws.object, \"JSON:awsjson\"\n| fieldsAdd dnsName = awsjson[configuration][dnsName], scheme = awsjson[configuration][scheme]\n| filter scheme == \"internet-facing\"\n| traverse \"balanced_by\", \"AWS_ELASTICLOADBALANCINGV2_TARGETGROUP\", direction:backward, fieldsKeep:{dnsName, id}\n| fieldsAdd targetGroupName = aws.resource.name\n| traverse \"balances\", \"AWS_EC2_INSTANCE\", fieldsKeep: {targetGroupName, id}\n| fieldsAdd loadBalancerDnsName = dt.traverse.history[-2][dnsName],\n            loadBalancerId = dt.traverse.history[-2][id],\n            targetGroupId = dt.traverse.history[-1][id]\n```\n\n→ For load balancing, see [references/load-balancing-api.md](references/load-balancing-api.md)\n\n### 6. Cost Optimization\n\nFind unattached EBS volumes:\n\n```dql\nsmartscapeNodes \"AWS_EC2_VOLUME\"\n| parse aws.object, \"JSON:awsjson\"\n| fieldsAdd state = awsjson[configuration][state]\n| filter state == \"available\"\n| fields name, aws.resource.id, aws.availability_zone, aws.account.id\n```\n\nAnalyze EBS costs by type:\n\n```dql\nsmartscapeNodes \"AWS_EC2_VOLUME\"\n| parse aws.object, \"JSON:awsjson\"\n| fieldsAdd volumeType = awsjson[configuration][volumeType],\n            size = awsjson[configuration][size],\n            state = awsjson[configuration][state]\n| summarize total_volumes = count(), total_size_gb = sum(size), by: {volumeType, state}\n| sort total_size_gb desc\n```\n\n→ For cost optimization, see [references/cost-optimization.md](references/cost-optimization.md)\n\n### 7. Security and Compliance\n\nFind publicly accessible databases:\n\n```dql\nsmartscapeNodes \"AWS_RDS_DBINSTANCE\"\n| parse aws.object, \"JSON:awsjson\"\n| fieldsAdd publiclyAccessible = awsjson[configuration][publiclyAccessible]\n| filter publiclyAccessible == true\n| fields name, aws.resource.id, aws.vpc.id, aws.account.id\n```\n\nSecurity group blast radius:\n\n```dql\nsmartscapeNodes \"AWS_EC2_INSTANCE\"\n| traverse \"uses\", \"AWS_EC2_SECURITYGROUP\"\n| summarize instance_count = count(), by: {aws.resource.name, aws.vpc.id}\n| sort instance_count desc\n| limit 20\n```\n\n→ For security, see [references/security-compliance.md](references/security-compliance.md)\n\n### 8. Resource Ownership and Tagging\n\nFind untagged resources:\n\n```dql\nsmartscapeNodes \"AWS_*\"\n| filter isNull(tags)\n| fields type, name, aws.resource.id, aws.account.id, aws.region\n```\n\nCost allocation by cost center:\n\n```dql\nsmartscapeNodes \"AWS_*\"\n| filter isNotNull(tags[CostCenter])\n| summarize resource_count = count(), by: {tags[CostCenter], type}\n| sort resource_count desc\n```\n\n→ For resource ownership, see [references/resource-ownership.md](references/resource-ownership.md)\n\n---\n\n## Common Query Patterns\n\n| Pattern | Template |\n|---------|----------|\n| **Discovery** | `smartscapeNodes \"AWS_*\" \\| fieldsAdd \u003cattrs> \\| filter \u003ccond> \\| summarize \u003cagg>` |\n| **Config parsing** | `smartscapeNodes \"AWS_\u003cT>\" \\| parse aws.object, \"JSON:awsjson\" \\| fieldsAdd f = awsjson[configuration][field]` |\n| **Traversal** | `smartscapeNodes \"AWS_\u003cSRC>\" \\| traverse \"\u003crel>\", \"AWS_\u003cTGT>\"` |\n| **Multi-type** | `smartscapeNodes \"AWS_T1\", \"AWS_T2\" \\| filter \u003ccond> \\| summarize count(), by: {type}` |\n\n---\n\n\n## Best Practices\n\n### Query Optimization\n1. Filter early by account and region\n2. Use specific entity types (avoid `\"AWS_*\"` wildcards when possible)\n3. Limit results with `| limit N` for exploration\n4. Use `isNotNull()` checks before accessing nested fields\n\n### Configuration Parsing\n1. Always parse `aws.object` with JSON parser: `parse aws.object, \"JSON:awsjson\"`\n2. Use consistent field naming: `fieldsAdd configField = awsjson[configuration][field]`\n3. Check for null values after parsing\n4. Use `toString()` for complex nested objects\n\n### Security Fields\n1. Security group IDs are arrays - use `contains()` or `expand`\n2. Parse `aws.object` for detailed security context\n3. Check `publiclyAccessible`, `storageEncrypted`, and similar flags\n4. Validate IAM role assumptions\n\n### Tagging Strategy\n1. Use `tags[TagName]` for filtering by specific tag value\n2. `tags` is a JSON object, not an array — use `isNull(tags)` for untagged resources, **never** `arraySize(tags)`\n3. Use `isNull(tags[TagName])` to find resources missing a specific tag\n4. Implement consistent tag naming conventions\n5. Track tag coverage with summarize operations\n\n---\n\n## Limitations and Notes\n\n### Smartscape Limitations\n- AWS object configuration requires parsing with `parse aws.object, \"JSON:awsjson\"`\n- AWS metrics are available as Dynatrace metrics using the `cloud.aws.*` naming convention (see [AWS Metric Naming Convention](#aws-metric-naming-convention))\n- Resource discovery depends on AWS integration configuration\n- Tag synchronization may have slight delays\n\n### Relationship Traversal\n- Use `direction:backward` for reverse relationships (e.g., target group → load balancer)\n- Use `fieldsKeep` to maintain important fields through traversal\n- Access traversal history with `dt.traverse.history[-N]`\n- Complex topologies may require multiple traverse operations\n\n### General Tips\n- Use `getNodeName()` for human-readable resource names\n- Handle null values gracefully with `isNotNull()` and `isNull()`\n- Combine region and account filters for large environments\n- Use `countDistinct()` for unique resource counts\n\n---\n\n## When to Load References\n\nThis skill uses **progressive disclosure**. Start here for 80% of use cases. Load reference files for detailed specifications when needed.\n\n### Load vpc-networking-security.md when:\n- Analyzing VPC topology and connectivity\n- Investigating security group configurations\n- Finding resources by security group\n- Troubleshooting network interface issues\n\n### Load database-monitoring.md when:\n- Managing RDS instances and clusters\n- Analyzing database engine distributions\n- Checking Multi-AZ configurations\n- Monitoring cache clusters\n\n### Load serverless-containers.md when:\n- Working with Lambda functions\n- Analyzing ECS/EKS deployments\n- Investigating container networking\n- Planning serverless migrations\n\n### Load load-balancing-api.md when:\n- Mapping load balancer topologies\n- Analyzing target group health\n- Working with API Gateway\n- Configuring CloudFront\n\n### Load messaging-event-streaming.md when:\n- Managing SQS queues and SNS topics\n- Analyzing EventBridge event buses\n- Working with Kinesis or MSK\n- Monitoring Step Functions\n\n### Load resource-management.md when:\n- Conducting resource audits\n- Analyzing tag compliance\n- Finding unattached resources\n- Planning regional distribution\n\n### Load cost-optimization.md when:\n- Identifying cost savings opportunities\n- Analyzing storage costs\n- Finding unused resources\n- Optimizing instance types\n\n### Load capacity-planning.md when:\n- Planning capacity expansions\n- Analyzing resource utilization\n- Monitoring subnet IP usage\n- Sizing auto-scaling groups\n\n### Load security-compliance.md when:\n- Conducting security audits\n- Checking encryption status\n- Analyzing IAM roles\n- Finding public resources\n\n### Load resource-ownership.md when:\n- Implementing chargeback\n- Tracking resource ownership\n- Allocating costs by team\n- Managing multi-account environments\n\n### Load events.md when:\n- Investigating what changed before or during a problem\n- Checking for recent CloudFormation stack deployments\n- Reviewing AWS Auto Scaling activity (scale-in/scale-out)\n- Checking AWS Health service events affecting a resource\n\n### Load workload-detection.md when:\n- Determining how an EC2 instance is orchestrated (ECS, EKS, Batch, ASG, standalone)\n- Following a resolution path that depends on the workload pattern\n- Understanding the blast radius of an instance failure\n\n---\n\n## References\n\n- [vpc-networking-security.md](references/vpc-networking-security.md) - VPC infrastructure, security groups, and network connectivity\n- [database-monitoring.md](references/database-monitoring.md) - RDS, DynamoDB, ElastiCache, and Redshift monitoring\n- [serverless-containers.md](references/serverless-containers.md) - Lambda, ECS, EKS, and App Runner workloads\n- [load-balancing-api.md](references/load-balancing-api.md) - Load balancers, API Gateway, and CloudFront\n- [messaging-event-streaming.md](references/messaging-event-streaming.md) - SQS, SNS, EventBridge, Kinesis, and MSK\n- [resource-management.md](references/resource-management.md) - Resource inventory and lifecycle management\n- [cost-optimization.md](references/cost-optimization.md) - Cost savings and spending optimization\n- [capacity-planning.md](references/capacity-planning.md) - Capacity analysis and growth planning\n- [security-compliance.md](references/security-compliance.md) - Security configurations and compliance monitoring\n- [resource-ownership.md](references/resource-ownership.md) - Cost allocation and ownership tracking\n- [events.md](references/events.md) - AWS AutoScaling, Health, and CloudFormation events for problem timeline analysis\n- [workload-detection.md](references/workload-detection.md) - Identify how an EC2 instance is orchestrated (LB, ASG, ECS, EKS, Batch)\n\n---\n\n---\nSource: https://github.com/Dynatrace/dynatrace-for-ai/blob/main/skills/dt-obs-aws/SKILL.md\nAuthor: Dynatrace (Dynatrace/dynatrace-for-ai), licensed Apache-2.0. Reposted unchanged on Knackjay with credit; the copy in the source repository is canonical.\n",
  "description": "AWS cloud resource monitoring including EC2, RDS, Lambda, ECS/EKS, VPC networking, load balancers, S3, DynamoDB, SQS/SNS, and cost optimization. Use when analyzing AWS infrastructure, resource invento",
  "kind": "skill",
  "source_url": "https://github.com/Dynatrace/dynatrace-for-ai/blob/main/skills/dt-obs-aws/SKILL.md",
  "title": "Dynatrace: dt-obs-aws",
  "topics": [
    "dynatrace",
    "ai-operations",
    "analytics",
    "apm",
    "application-performance-monitoring"
  ],
  "published_at": "2026-11-14T11:53:15.527Z",
  "expires_at": null,
  "policy_version": "2026.11.14-1"
}