AWS Health alert integration

AWS Health sends the service events that affect your account (operational issues, scheduled changes, account notifications) to Amazon EventBridge as events with source set to aws.health and detail-type set to AWS Health Event. The Flashduty AWS EventBridge integration handles these events explicitly, so you don’t need a separate AWS Health integration. Create an AWS EventBridge integration in Flashduty and use its push URL as the target of an EventBridge rule.

Configure in AWS

Create an API destination that points to Flashduty in Amazon EventBridge

API destination (recommended)
SNS topic

Where: Amazon EventBridge › Integration › API destinations › Connections › Create connection

Field	Value
Connection name (required)	`Flashduty`
Destination type (required, under Authorization)	`Other`
Authorization type (required)	`API Key`
API key name (required)	`Flashduty`
Value (required)	`{integration_key}`, the `integration_key` in the push URL

Click Create to save.Where: Amazon EventBridge › Integration › API destinations › Create API destination

Field	Value
Name (required)	`Flashduty`
API destination endpoint (required)	`{integration_url}`
HTTP method (required)	`POST`
Connection type (required)	`Use an existing connection`, then select the `Flashduty` connection created above

Click Create to save.

Where: Amazon SNS › Subscriptions › Create subscription (if the topic does not exist yet, go to Topics › Create topic first and set Type to Standard)

Field	Value
Topic ARN (required)	The SNS topic that forwards EventBridge events
Protocol (required)	`HTTPS`
Endpoint (required)	`{integration_url}`, which must be the push URL of this integration

Click Create subscription and wait until the subscription status is Confirmed. Flashduty only visits subscription confirmation URLs on sns.<region>.amazonaws.com, sns.<region>.amazonaws.com.cn and sns.<region>.amazonaws.eu. For the full SNS topic and subscription steps, see the AWS CloudWatch integration.

Create a rule for AWS Health events in Amazon EventBridge

Where: Amazon EventBridge › Rules › Create rule › Advanced Builder

Field	Value
Builder (when the console offers a choice)	`Advanced Builder`
Name (required)	A name of your choice, for example `Flashduty-Health`
Event bus	`AWS default event bus`
Rule type (required)	`Rule with an event pattern`, then click Next
Event source (required)	`AWS events or EventBridge partner events`
Creation method / Method (required)	`Custom pattern (JSON editor)`
Event pattern (required)	Paste the event pattern below, then click Next
Target type (required)	`EventBridge API destination`, choose `Use an existing API destination` and the `Flashduty` one created in the previous step (for the SNS method choose `AWS service` › `SNS topic` and that topic)
Execution role (required)	`Create a new role for this specific resource`
Input transformer	Do not configure; send the full event

Event pattern:

{
  "source": ["aws.health"],
  "detail-type": ["AWS Health Event"]
}

To narrow the scope, add filters under detail. For example, only issue events for Amazon EC2:

{
  "source": ["aws.health"],
  "detail-type": ["AWS Health Event"],
  "detail": {
    "eventTypeCategory": ["issue"],
    "service": ["EC2"]
  }
}

While creating the rule, pick the AWS Health sample events in Sample events and click Test pattern (the Test event pattern panel in older consoles) to confirm the pattern matches.Per AWS: rules only receive events for your own account, and public (PUBLIC) events can take up to an hour to start arriving after you create a rule. For events aggregated through AWS Organizations, see the AWS guide Aggregating AWS Health events.

Do not filter out statusCode in the event pattern, for example by matching only "statusCode": ["open"]. Otherwise the notification that the event closed never arrives and the alert cannot recover.

Send a test AWS Health event and confirm

Where: A terminal that can reach the Flashduty push URLThe rule only forwards events that AWS really emits, and public (PUBLIC) events can take up to an hour to start arriving after you create a rule. To verify right away, POST a test event shaped like the real one to the push URL:

curl -X POST '{integration_url}' \
  -H 'Content-Type: application/json' \
  -d '{"version":"0","id":"flashduty-test-1","detail-type":"AWS Health Event","source":"aws.health","account":"123456789012","region":"us-east-1","resources":[],"detail":{"eventArn":"arn:aws:health:us-east-1::event/EC2/AWS_EC2_OPERATIONAL_ISSUE/flashduty-test","service":"EC2","eventTypeCode":"AWS_EC2_OPERATIONAL_ISSUE","eventTypeCategory":"issue","eventScopeCode":"ACCOUNT_SPECIFIC","statusCode":"open","affectedAccount":"123456789012"}}'

Send it again with statusCode set to closed to confirm that the alert recovers automatically. A few seconds later, go back to Flashduty. The integration shows a latest event time, which means the setup works.

Regions and backup rules

Create a rule in every Region you want to receive events from. Global events (for example IAM-related events) are delivered to US East (N. Virginia), us-east-1
In the standard AWS partition, events are also sent to the backup Region US West (Oregon). If you create rules in both the primary and the backup Region, the same event arrives twice. Both copies share the eventArn and affected account, so Flashduty merges them into one alert through the Alert Key
To keep only the primary Region’s events, add the filter "backupEvent": ["false"] (detail.backupEvent) to the backup Region rule

Field mapping

AWS Health field	Flashduty
`detail.eventArn` + `detail.affectedAccount` (`account` if missing)	Alert Key; later updates of the same event merge into one alert
`detail.statusCode`	`closed` recovers the alert; `open` and `upcoming` trigger or update it
`detail-type` and `source`	The alert title is always `aws.health / AWS Health Event`
`detail.service`, `detail.eventTypeCode`	Labels `service` and `event_type_code`, combined into the `summary` label (`AWS Health <service> <eventTypeCode>`)
`detail.eventTypeCategory`	Label `event_type_category` (`issue`, `accountNotification`, `scheduledChange`, `investigation`)
`detail.eventScopeCode`	Label `event_scope_code` (`ACCOUNT_SPECIFIC` or `PUBLIC`)
`detail.affectedEntities[].entityValue`	Label `affected_entities`; the first value is also written to `resource`
`detail.eventArn`, `detail.statusCode`, `detail.affectedAccount`	Labels `event_arn`, `status_code`, `affected_account`
`region`, `account`, `resources`, `detail`	Labels `region`, `account`, `resources`, `detail` (`detail` holds the event detail as JSON)

Status and severity

EventBridge events carry no common severity field, so every AWS Health event triggers as Warning. To differentiate, rewrite the severity by the event_type_category label in Alert processing, for example issue to Critical and scheduledChange kept at Warning or lowered to Info.

Recovery and deduplication

AWS Health sends an update with statusCode set to closed when the event ends, and Flashduty recovers the alert with the same Alert Key
Scheduled changes (scheduledChange) are sent with status upcoming before they start, so Flashduty triggers alerts ahead of time. If you only care about ongoing incidents, restrict eventTypeCategory to issue in the event pattern
Events with detail-type set to AWS Health Abuse Event have no dedicated handling: each event becomes its own alert keyed by the event id, with no recovery. Matching only AWS Health Event in the pattern avoids them
Events without detail.eventArn are rejected (HTTP 400)

Troubleshooting

The rule does not fire: check the event pattern. Public events can take up to an hour to arrive after you create the rule. Make sure rules exist in the event’s Region, and in us-east-1 for global events
The alert does not recover: confirm the event pattern does not filter out the closed status and that the target has no Input transformer (the full event must be sent)
Two alerts for one event: confirm both events have the same detail.eventArn and affected account; if detail-type was rewritten the event cannot be merged as a Health event
The API destination call fails: confirm the endpoint is the full push URL and HTTP method is POST

For field details, see the AWS documentation AWS Health events Amazon EventBridge schema and Creating EventBridge rules for AWS Region coverage.

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

AWS Health alert integration

In Flashduty On-call

Use a dedicated integration

Use a shared integration

Configure in AWS

Regions and backup rules

Field mapping

Status and severity

Recovery and deduplication

Troubleshooting