REL01-BP05 Automate quota management
Service quotas, also referred to as limits in AWS services, are the maximum values for the resources in your AWS account. Each AWS service defines a set of quotas and their default values. To provide your workload access to all the resources it needs, you might need to increase your service quota values.
Growth in workload consumption of AWS resources can threaten workload stability and impact the user experience if quotas are exceeded. Implement tools to alert you when your workload approaches the limits and consider creating quota increase requests automatically.
Desired outcome: Quotas are appropriately configured for the workloads running in each AWS account and Region.
Common anti-patterns:
-
You fail to consider and adjust quotas appropriately to meet workload requirements.
-
You track quotas and usage using methods that can become outdated, such as with spreadsheets.
-
You only update service limits on periodic schedules.
-
Your organization lacks operational processes to review existing quotas and request service quota increases when necessary.
Benefits of establishing this best practice:
-
Enhanced workload resiliency: You prevent errors caused by exceeding AWS resource quotas.
-
Simplified disaster recovery: You can reuse automated quota management mechanisms built in the primary Region during DR setup in another AWS Region.
Level of risk exposed if this best practice is not established: Medium
Implementation guidance
View current quotas and track ongoing quota consumption through mechanisms such as AWS Service Quotas console, AWS Command Line Interface (AWS CLI), and AWS SDKs. You can also integrate your configuration management databases (CMDB) and IT service management (ITSM) systems with the AWS Service Quota APIs.
Generate automated alerts if quota usage reaches your defined thresholds, and define a process for submitting quota increase requests when you receive alerts. If the underlying workload is critical to your business, you can automate quota increase requests, but carefully test the automation to avoid the risk of runaway action such as a growth feedback loop.
Smaller quota increases are often automatically approved. Larger quota requests may need to be manually processed by AWS support and can take additional time to review and process. Allow for additional time to process multiple requests or large increase requests.
Implementation steps
-
Implement automated monitoring of service quotas, and issue alerts if your workload's resource utilization growth approaches your quota limits. For example, Quota Monitor for AWS can provide automated monitoring of service quotas. This tool integrates with AWS Organizations and deploys using Cloudformation StackSets so that new accounts are automatically monitored on creation.
-
Use features such as Service Quotas request templates or AWS Control Tower
to simplify Service Quotas setup for new accounts. -
Build dashboards of your current service quota use across all AWS accounts and regions and reference them as necessary to prevent exceeding your quotas. Trusted Advisor Organizational (TAO) Dashboard
, part of the Cloud Intelligence Dashboards , can get you quickly started with such a dashboard. -
Track service limit increase requests. Consolidated Insights from Multiple Accounts(CIMA)
can provide an Organization-level view of all your requests. -
Test alert generation and any quota increase request automation by setting lower quota thresholds in non-production accounts. Do not conduct these tests in a production account.
Resources
Related best practices:
Related documents:
Related videos:
Related tools:
