Provider health events
See what AWS, Azure and Google Cloud tell your own accounts about incidents, maintenance and retirements, tied to your assets.
Your clouds already tell each account about incidents, planned maintenance, retirements and notices: AWS Health, Azure Service Health, and Google Cloud's Service Health and Advisory Notifications. AssetHermit reads them for the accounts your asset sources cover, as health events, ties each to the accounts and assets it names, and tells you in your inbox, by email and in Slack. It's included in the Starter, Team and Enterprise plans.
Provider health events is in beta.
Only your own events are kept: those your clouds send to your accounts, and public incidents in a service and region you use. They're read with the access your asset source already has, and stored in the workspace's region with its data.
Kinds of event
| Kind | What it is | For example |
|---|---|---|
| Issue | Something is wrong now, or is being investigated: a service incident in your accounts or where you run it. | AWS Health issues, Azure service issues, Google Cloud incidents |
| Action | Something needs you before a date: planned maintenance, a scheduled change, a retirement, an abuse report. | EC2 instance retirement, Azure planned maintenance, Compute Engine host maintenance |
| Notice | Something to know, with nothing to do by a date: account, billing and security notifications, advisories. | AWS account notifications, Azure health advisories, Google security and privacy notices |
Each event also has a category (incident, maintenance, lifecycle, security, abuse, billing, account and advisory), a state (upcoming, open or closed), its times, the services and regions it concerns, the provider's own text with its updates, and the resources it names. A resource that's one of your assets links to it; others show as the provider names them.
Setting it up
Each asset source has a Health tab, where a workspace admin turns its feed on or off, sees when it was last read and why it can't be, and checks every step with Check now. Once it's on, events are read every 15 minutes.
AWS
AWS sends every commercial region's health events to one region, us-west-2. The Health tab gives you a small stack to launch there: a rule that keeps those events in a log group for 14 days, which the asset source's read-only discovery role reads. It holds no role and changes nothing else.
- An account launches the stack in that account. An AWS Organization launches it in the management account, or in the account you made AWS Health's delegated administrator, and turns on organizational view in the AWS Health console, so every member account's events arrive there. AssetHermit confirms organizational view once another account's event arrives, and says so if none has after 14 days.
- The asset source's own stack must run its latest template, whose discovery role may read the log group. The Health tab says when it needs updating first.
- It works on every AWS support plan. With a plan that includes the AWS Health API, the first read also brings in the last 90 days; without one, events start on the day you launched the stack.
- The stack is tracked like the asset source's own: when its template changes, you're told and shown what changed. Removing the asset source names the health stack to delete too.
Azure
Azure needs nothing more. The asset source's managed identity already reads Azure Service Health through Resource Graph, so its feed is on from the start; an admin can turn it off. Security advisories whose details need Azure's privileged reader role keep only their title and times.
Azure feeds also read Resource Health: an Azure asset's page shows whether it's available, degraded, unavailable or unknown, with Azure's reason and since when.
Google Cloud
A Google Cloud feed starts off. An admin turns it on from the Health tab, which gives the gcloud commands to run in Cloud Shell: they enable the Service Health API on the asset source's quota project and grant the workspace's asset principal set the Service Health viewer role at the organization or project. Advisory Notifications' viewer role is optional and adds Google's security and privacy notices. At an organization, events cover only the projects that enabled the Service Health API.
While a Google Cloud feed is on, a Compute Engine instance's upcoming host maintenance also becomes an action event for that instance, with no further grant.
Where you see them
- The Health page has tabs for Now, Upcoming, Notices and History, filters for cloud and category, and "Affects my assets". Each event lists what it concerns and when, and who has taken its alert.
- An event's page has its state and times, the provider's text and updates, the accounts it concerns, and the resources it names a page at a time, with Open in inventory for those that are your assets.
- Asset detail's Health tab lists the events that name the asset, open and upcoming first.
- The dashboard's Health card shows open issues that affect your assets and actions due in the next 14 days, and hides itself when there are none.
- An asset source's Health tab has its feed's state, setup and checks.
Workspace admins and viewers see its health events, stakeholders don't, and a viewer limited to some accounts sees only those accounts' events.
Notifications
Health events have a category of their own in your notification settings: by default they reach your inbox, and admins' daily digest too. Each event has one alert, which a provider's update changes without sending again unless it becomes more severe.
| Notification | Sent when | Resolves when |
|---|---|---|
| Provider incident Alert | An issue is open or about to start. Critical when it impairs one of your assets or Azure rates it critical or an error, a warning when it concerns your accounts, and informational, for admins only, when it's a public issue in a service and region you use. | The provider closes it |
| Provider action needed Alert | An action is open or upcoming and nobody has marked it handled. A warning, critical once it starts within 7 days. | Someone marks it handled, or the provider closes it |
| Provider notice Notice | A notice arrives. Informational, a warning for security and abuse notices. | It's a notice |
| Health events can't be read Alert | An asset source's feed fails, or an AWS Organization's events from other accounts don't arrive. For workspace admins, with the collection alerts. | A later read succeeds |
- Handled on an action, from the alert or the event's page, resolves its alert for everyone and says who handled it. Not handled opens it again while the event is open or upcoming.
- Mute this event type stops one provider's event type reaching you, and nobody else.
- Events already there when a feed is first read raise alerts while they're open, but never notices, so turning a feed on doesn't flood you.
See Notifications for taking, snoozing and muting alerts.
Ignoring events
A workspace admin can ignore an event type, or every event of a service, for the whole workspace, with "Ignore events like this" on an event's page, up to 100 rules. Ignored events are still read and kept, but leave the lists, the dashboard, search and the assistant, raise nothing, and resolve their open alerts. The Health page lists the rules, and Show ignored brings their events back into view. Removing a rule brings back its events that are still open.
Slack
A Slack route that takes the Health category can narrow it to some clouds and some accounts, so each team's channel gets only its own accounts' events. The feed's own failing alert routes as before.
In search
$healthEvent finds the assets that current health events name: open and upcoming events, not ignored. Its values match an event's ID or title, and $healthEvent:* is every asset a current event names, so $healthEvent:* $type:compute.vm lists the virtual machines with something coming. It works in asset groups too. SeeSearch.
The assistant
The assistant reads health events as you: ask what's open, what needs action soon, or what concerns an account, a service or a region. AI clients connected through the MCP server can read them the same way.
What it costs
On AWS, the log group takes in a few kilobytes a month, which CloudWatch Logs bills to the holder account. Azure's Resource Graph queries are free. Google Cloud's reads are made on the asset source's quota project.