Understand AWS response teams and support

Support

Support offers a range of plans that provide access to tools and expertise that support the success and operational health of your AWS solutions. If you need technical support and more resources to help plan, deploy, and optimize your AWS environment, you can select a support plan that best aligns with your AWS use case.

Consider the Support Center in the AWS Management Console (sign-in required) as the central point of contact to get support for issues that affect your AWS resources. Access to Support is controlled by IAM. For more information about getting access to AWS Support features, refer to Getting started with Support.

Additionally, if you need to report abuse, contact the AWS Tust and Safety team.

AWS Customer Incident Response Team (CIRT)

The AWS Customer Incident Response Team (CIRT) is a specialized always available global AWS team that provides support to customers during active security events on the customer side of the AWS Shared Responsibility Model.

When the AWS CIRT supports you, you will receive assistance with triage and recovery for an active security event on AWS. They will assist in root cause analysis through the use of AWS service logs and provide you with recommendations for recovery. They will also provide security recommendations and best practices to help you avoid security events in the future.

AWS customers can engage the AWS CIRT through an AWS support case.

• All Customers:

  1. Account and billing

  2. Service: Account

  3. Category: Security

  4. Severity: General question

• Customers with Developer Support plans:

  1. Account and billing

  2. Service: Account

  3. Category: Security

  4. Severity: Important question

• Customers with Business Support plans:

  1. Account and billing

  2. Service: Account

  3. Category: Security

  4. Severity: Urgent business impacting question

• Customers with Enterprise Support plans:

  1. Account and billing

  2. Service: Account

  3. Category: Security

  4. Severity: Critical business risk question

• Customers with AWS Security Incident Response subscriptions: Open the Security Incident Response console at https://console.aws.amazon.com/security-ir/

DDoS response support

AWS offers AWS Shield, which provides a managed distributed denial of service (DDoS) protection service that safeguards web applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that can minimize application downtime and latency, so there is no need to engage Support to benefit from DDoS protection. There are two tiers of AWS Shield: Shield Standard and Shield Advanced. To learn about the differences between these two tiers, refer to the Shield features documentation.

AWS Managed Services (AMS)

AWS Managed Services (AMS) provides ongoing management of your AWS infrastructure so you can focus on your applications. By implementing best practices to maintain your infrastructure, AMS helps reduce your operational overhead and risk. AMS automates common activities such as change requests, monitoring, patch management, security, and backup services, and provides full-lifecycle services to provision, run, and support your infrastructure.

AMS takes responsibility for deploying a suite of security detective controls and provides an every day first line of response to alerts. When an alert is initiated, AMS follows a standard set of automated and manual playbooks to verify a consistent response. These playbooks are shared with AMS customers during onboarding so that they can develop and coordinate a response with AMS.