sre-ec2-health-check

Run describe-instance-status to check InstanceStatus and SystemStatus, then review NetworkIn CloudWatch metrics for drops to zero and CloudTrail events for recent security group or attribute changes. The decision tree classifies the fault as AWS infrastructure, OS-level, or network isolation.

Query CPUUtilization with get-metric-statistics over the last 30 minutes using 5-minute periods. If the maximum exceeds 95% for two consecutive periods without a matching CloudTrail maintenance event, escalate with the CPU readings and event history.

Read-only permissions suffice: ec2:DescribeInstances, ec2:DescribeInstanceStatus, cloudwatch:GetMetricStatistics, cloudwatch:DescribeAlarmsForMetric, and cloudtrail:LookupEvents. No write or modify permissions are required since the workflow never changes infrastructure.

No. The skill is strictly read-only and never reboots, stops, or terminates instances. It recommends a reboot for OS-level faults but requires explicit approval from the on-call engineer, who executes the action separately.

Yes. Set HERMES_LAB_MODE=mock and add the course/infrastructure/wrappers directory to PATH so mock AWS CLI wrappers return simulated outputs marked with a [MOCK MODE] banner for offline lab practice.

Avoid it for general performance tuning, capacity planning, cost investigation, or application-level debugging. It is scoped to infrastructure-layer incident response triggered by active alerts, not routine monitoring or log analysis.