### Example AWS CLI Response for Automatic Management Configuration Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/viewing-automatic-management.md This is an example JSON response detailing the Automatic Management configuration. It shows the opt-in level, type, status, notification ARN, and any excluded services. ```json { "OptInLevel": "ACCOUNT", "OptInType": "NotifyAndAdjust", "OptInStatus": "ENABLED", "NotificationArn": "arn:aws:notifications::{{111122223333}}:configuration/{{abc123def456gh789}}" "ExclusionList": { "dynamodb": [{ "QuotaCode": "{{L-E123ABC4}}", "QuotaName": "Maximum number of tables" }] }} } ``` -------------------------------- ### Start Automatic Management with UNO Configuration - AWS CLI Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/getting-started-auto-mgmt.md Starts Automatic Management for an AWS account in a specified region, configured for notifications only, and includes a User Notification (UNO) ARN for preferred notification channels. Ensure you have the necessary IAM permissions. ```bash aws service-quotas start-auto-management \ --opt-in-level ACCOUNT \ --opt-in-type NotifyOnly \ --region {{ca-central-1}} \ --notification-arn arn:aws:notifications::{{111122223333}}:configuration/{{abc123def456gh789}} ``` -------------------------------- ### Start Automatic Management (Notify Only) - AWS CLI Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/getting-started-auto-mgmt.md Starts Automatic Management for an AWS account in a specified region, configured to only send notifications. Ensure you have the necessary IAM permissions. ```bash aws service-quotas start-auto-management \ --opt-in-level ACCOUNT \ --opt-in-type NotifyOnly \ --region {{ca-central-1}} ``` -------------------------------- ### Specify Service Quotas API actions using a wildcard Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.md Use a wildcard character (*) in the 'Action' element to specify multiple API actions that match a pattern, such as all actions starting with 'Get'. ```json "Action": "servicequotas:Get*" ``` -------------------------------- ### Start Automatic Management and exclude Amazon DynamoDB quota Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/excluding-quotas.md Use this AWS CLI command to start Automatic Management and simultaneously exclude a specific Amazon DynamoDB quota from monitoring. Replace placeholders with your actual service and quota codes, and region. ```bash aws service-quotas start-auto-management \ --opt-in-level ACCOUNT \ --opt-in-type NotifyOnly \ --region {{ca-central-1}} \ --exclusion-list '{"{{dynamodb}}":["{{L-E123ABC4}}"]}' ``` -------------------------------- ### Get Service Quotas using AWS CLI Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/gs-request-quota.md This snippet shows how to retrieve a list of quotas for a specific service using the AWS CLI. It includes details like quota name, ARN, value, and service code. ```bash aws service-quotas list-service-quotas --service-code es --region us-east-1 ``` -------------------------------- ### View Automatic Management Configuration using AWS CLI Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/viewing-automatic-management.md Use this command to retrieve your current Automatic Management configuration. Ensure you replace the placeholder region with your target AWS region. ```bash aws service-quotas get-auto-management-configuration --region {{ca-central-1}} ``` -------------------------------- ### Specify multiple Service Quotas API actions Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.md To grant permissions for multiple specific API actions, list them within square brackets, separated by commas, in the 'Action' element. ```json "Action": [ "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota" ] ``` -------------------------------- ### Specify wildcard for unsupported resource-level permissions Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.md For API actions that do not support resource-level permissions, use a wildcard (*) in the 'Resource' element to indicate all resources. ```json "Resource": "*" ``` -------------------------------- ### List Resource-Level Quotas for OpenSearch Service Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.md Retrieves a list of resource-level quotas for Amazon OpenSearch Service, including their codes and applied values. This is a prerequisite for requesting a quota increase. ```bash $ aws service-quotas list-service-quotas \ --service-code es \ --quota-applied-at-level RESOURCE { "Quotas": [ { "QuotaName": "Instances per domain", "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-6408ABDE", "Value": 100.0, "QuotaAppliedAtLevel": "RESOURCE", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE", "Unit": "None", "QuotaContext": { "ContextScope": "RESOURCE", "ContextScopeType": "AWS::OpenSearchService::Domain", "ContextId": "arn:aws:esus-east-1:123456789012:domain/opensearch-domain-1" } }, { "QuotaName": "Instances per domain", "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-6408ABDE", "Value": 100.0, "QuotaAppliedAtLevel": "RESOURCE", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE", "Unit": "None", "QuotaContext": { "ContextScope": "RESOURCE", "ContextScopeType": "AWS::OpenSearchService::Domain", "ContextId": "arn:aws:esus-east-1:123456789012:domain/opensearch-domain-2" } } ] } ``` -------------------------------- ### View Applied Service Quotas at Account Level with AWS CLI Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/gs-request-quota.md Use the `list-service-quotas` command with the `--quota-applied-at-level` parameter set to `ACCOUNT` to retrieve applied quota values for a specific service at the account level. If a quota's applied value is not available, it will not be returned. ```bash $ aws service-quotas list-service-quotas \ --service-code es \ --quota-applied-at-level ACCOUNT { "Quotas": [ { "QuotaName": "Domains per Region", "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-076D529E", "Value": 100.0, "QuotaAppliedAtLevel": "ACCOUNT", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-076D529E", "Unit": "None" }, { "QuotaName": "Dedicated master instances per domain", "Adjustable": false, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-AE676A72", "Value": 5.0, "QuotaAppliedAtLevel": "ACCOUNT", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-AE676A72", "Unit": "None" }, { "QuotaName": "Warm instances per domain", "Adjustable": false, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-1F053E6F", "Value": 150.0, "QuotaAppliedAtLevel": "ACCOUNT" ``` -------------------------------- ### List Service Quota Change History (AWS CLI) Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/quota-history.md Use the `list-requested-service-quota-change-history` command to view all resource and account level quota requests. This command requires the `QuotaAppliedLevel` parameter. ```bash $ aws service-quotas list-requested-service-quota-change-history \ --quota-applied-at-level ALL { "RequestedQuotas": [ { "QuotaName": "Instances per domain", "Status": "PENDING", "DesiredValue": 200.0, "Created": 1580446904.067, "QuotaArn": "arn:aws:servicequotas:us-east-1:123456789012:es/L-6408ABDE", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE", "Requester": "{\"accountId\":\"123456789012\",\"callerArn\":\"arn:aws:iam::123456789012:root\"}", "QuotaRequestedAtLevel": "RESOURCE", "Id": "a12345", "Unit": "None" "QuotaContext": { "ContextId": "arn:aws:es:us-east-1:123456789012:domain/opensearch-domain-1" "ContextScopeType": "AWS::OpenSearchService::Domain", "ContextScope": "RESOURCE" } }, { "QuotaName": "Instances per domain", "Status": "PENDING", "DesiredValue": 200.0, "Created": 1580446904.067, "QuotaArn": "arn:aws:servicequotas:us-east-1:123456789012:es/L-6408ABDE", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE", "Requester": "{\"accountId\":\"123456789012\",\"callerArn\":\"arn:aws:iam::123456789012:root\"}", "QuotaRequestedAtLevel": "RESOURCE", "Id": "a12345", "Unit": "None" "QuotaContext": { "ContextId": "arn:aws:es:us-east-1:123456789012:domain/opensearch-domain-2", "ContextScopeType": "AWS::OpenSearchService::Domain", "ContextScope": "RESOURCE" } }, { "QuotaName": "Domains per Region", "Status": "PENDING", "DesiredValue": 120.0, "Created": 1580446904.067, "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-076D529E", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-076D529E", "Requester": "{\"accountId\":\"123456789012\",\"callerArn\":\"arn:aws:iam::123456789012:root\"}" "QuotaRequestedAtLevel": "ACCOUNT", "Id": "a123456", "Unit": "None", }, { "QuotaName": "Instances per domain", "Status": "PENDING" "DesiredValue": 300.0, "Created": 1580446904.067, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-6408ABDE", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE", "Requester": "{\"accountId\":\"123456789012\",\"callerArn\":\"arn:aws:iam::123456789012:root\"}" "QuotaRequestedAtLevel": "ACCOUNT", "Id": "a1234567", "Unit": "None", "QuotaContext": { "ContextId": "*", "ContextScopeType": "AWS::OpenSearchService::Domain", "ContextScope": "RESOURCE" } } ] } ``` -------------------------------- ### View Default Service Quotas with AWS CLI Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/gs-request-quota.md Use the `list-aws-default-service-quotas` command to retrieve the default quota values for a specific AWS service. You need to provide the service code. The response includes details like QuotaName, Value, and ServiceCode. ```bash $ aws service-quotas list-aws-default-service-quotas \ --service-code es \ { "Quotas": [ { "QuotaName": "Domains per Region", "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-076D529E", "Value": 100.0, "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-076D529E", "Unit": "None" }, { "QuotaName": "Dedicated master instances per domain", "Adjustable": false, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-AE676A72", "Value": 5.0, "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-AE676A72", "Unit": "None" }, { "QuotaName": "Warm instances per domain", "Adjustable": false, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-1F053E6F", "Value": 150.0, "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-1F053E6F", "Unit": "None" }, { "QuotaName": "Instances per domain", "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-6408ABDE", "Value": 80.0, "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE", "Unit": "None", "QuotaContext": { "ContextScope": "RESOURCE", "ContextScopeType": "AWS::OpenSearchService::Domain" } } ] } ``` -------------------------------- ### Specify all Service Quotas API actions Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.md To grant permissions for all available Service Quotas API actions, use a wildcard character (*) as the value for the 'Action' element. ```json "Action": "servicequotas:*" ``` -------------------------------- ### Request Resource-Level Quota Increase for OpenSearch Service Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.md Requests an increase for a specific resource-level quota, such as 'Instances per domain' for an OpenSearch Service domain. Ensure you have the correct `ServiceCode`, `QuotaCode`, and `ContextId` (resource ARN). ```bash $ aws service-quotas request-service-quota-increase \ --service-code es \ --quota-code L-6408ABDE \ --desired-value 200 \ --context-id arn:aws:es:us-east-1:123456789012:domain/opensearch-domain-1 { "RequestedQuota": { "QuotaName": "Instances per domain", "Status": "PENDING", "DesiredValue": 200.0, "Created": 1580446904.067, "QuotaArn": "arn:aws:servicequotas:us-east-1:123456789012:es/L-6408ABDE", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE" ``` -------------------------------- ### List Service Quotas for Amazon OpenSearch Service Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.md Retrieves a list of quotas for Amazon OpenSearch Service that are applied at the account level. This helps in identifying the correct QuotaCode for subsequent requests. ```bash $ aws service-quotas list-service-quotas \ --service-code es \ --quota-applied-at-level ACCOUNT { "Quotas": [ { "QuotaName": "Domains per Region", "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-076D529E", "Value": 100.0, "QuotaAppliedAtLevel": "ACCOUNT", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-076D529E", "Unit": "None" }, { "QuotaName": "Dedicated master instances per domain", "Adjustable": false, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-AE676A72", "Value": 5.0, "QuotaAppliedAtLevel": "ACCOUNT", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-AE676A72", "Unit": "None" }, { "QuotaName": "Warm instances per domain", "Adjustable": false, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-1F053E6F", "Value": 150.0, "QuotaAppliedAtLevel": "ACCOUNT", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-1F053E6F", "Unit": "None" }, { "QuotaName": "Instances per domain", "Adjustable": true, "QuotaArn": "arn:aws:servicequotas:us-east-1::123456789012:es/L-6408ABDE", "Value": 80.0, "QuotaAppliedAtLevel": "ACCOUNT", "ServiceName": "Amazon OpenSearch Service", "GlobalQuota": false, "ServiceCode": "es", "QuotaCode": "L-6408ABDE", "Unit": "None", "QuotaContext": { "ContextScope": "RESOURCE", "ContextScopeType": "AWS::OpenSearchService::Domain", "ContextId": "*" } ] } ``` -------------------------------- ### CloudTrail Log Entry for Service Quota Increase Request Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/logging-using-cloudtrail.md This log entry shows a user initiating a request to increase a service quota. It details the user, the service, the specific quota, and the desired new value. ```json { "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "AIDA123456789012Example", "arn": "arn:aws:iam::123456789012:user/admin", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": " admin", "sessionContext": { "sessionIssuer": {}, "webIdFederationData": {}, "attributes": { "creationDate": "2022-01-24T16:57:04Z", "mfaAuthenticated": "true" } } }, "eventTime": "2022-01-24T17:00:15Z", "eventSource": "servicequotas.amazonaws.com", "eventName": "RequestServiceQuotaIncrease", "awsRegion": "us-east-1", "sourceIPAddress": "172.21.16.1", "userAgent": "aws-internal/3 aws-sdk-java/1.12.127 Linux/5.4.147-83.259.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.312-b07 java/1.8.0_312 vendor/Oracle_Corporation cfg/retry-mode/standard", "requestParameters": { "serviceCode": "ec2", "quotaCode": "L-CEED54BB", "desiredValue": 10 }, "responseElements": { "requestedQuota": { "id": "cd3ad3d9-2776-4ef1-a904-4c229d1642ee", "serviceCode": "ec2", "serviceName": "Amazon Elastic Compute Cloud (Amazon EC2)", "quotaCode": "L-CEED54BB", "quotaName": "EC2-Classic Elastic IPs", "desiredValue": 10, "status": "PENDING", "created": "Jan 24, 2022 5:00:15 PM", "requester": "{\"accountId\":\"123456789012\",\"callerArn\":\"arn:aws:iam::123456789012:user/admin\"}", "quotaArn": "arn:aws:servicequotas:us-east-1:123456789012:ec2/L-CEED54BB", "globalQuota": false, "unit": "None" } }, "requestID": "3d3f5cdc-af30-4121-b69a-84b2f5c33be5", "eventID": "0cb51588-e460-4e00-bc48-a9d4820cad83", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management" } ``` -------------------------------- ### Request Account-Level Quota Increase for Amazon OpenSearch Service Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.md Submits a request to increase a specific quota for Amazon OpenSearch Service at the account level. Use the QuotaCode obtained from 'list-service-quotas'. ```bash $ aws service-quotas request-service-quota-increase \ --service-code es \ --quota-code L-6408ABDE \ --desired-value 100 { "RequestedQuota": { ``` -------------------------------- ### Resource-Level Quota Increase Request (AWS CLI) Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.md Use this JSON structure when making a resource-level quota increase request via the AWS CLI. Ensure all fields, including account ID, caller ARN, quota ID, unit, and context, are correctly specified. ```json { "QuotaCode": "L-02C7-1234-5678", "ServiceCode": "es", "AwsRegion": "us-east-1", "Requester": "{\"accountId\":\"123456789012\",\"callerArn\":\"arn:aws:iam::123456789012:root\"}", "QuotaRequestedAtLevel": "RESOURCE", "Id": "a12345", "Unit": "None", "QuotaContext": { "ContextId": "arn:aws:es:us-east-1:123456789012:domain/opensearch-domain-1", "ContextScopeType": "AWS::OpenSearchService::Domain", "ContextScope": "RESOURCE" } } ``` -------------------------------- ### Specify a single Service Quotas API action Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.md Use this format in the 'Action' element of an IAM policy statement to grant permission for a specific Service Quotas API action. ```json "Action": "servicequotas:GetServiceQuota" ``` -------------------------------- ### Specify a Service Quotas resource ARN Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.md When an API action supports resource-level permissions, use the resource's ARN in the 'Resource' element to restrict access to a specific quota. ```json "Resource": "arn:aws:servicequotas:{{region-code}}:{{account-id}}:{{service-code}}/{{quota-code}}" ``` -------------------------------- ### CloudTrail Log Entry for Approved Service Quota Increase Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/logging-using-cloudtrail.md This log entry indicates that a service quota increase request has been approved and the request is closed. It includes details about the new quota value and status. ```json { "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012", "invokedBy": "servicequotas.amazonaws.com" }, "eventTime": "2022-01-24T17:02:17Z", "eventSource": "servicequotas.amazonaws.com", "eventName": "UpdateServiceQuotaIncreaseRequestStatus", "awsRegion": "us-east-1", "sourceIPAddress": "servicequotas.amazonaws.com", "userAgent": "servicequotas.amazonaws.com", "requestParameters": null, "responseElements": null, "eventID": "e331b0a0-9395-4895-aeba-73cbab9ebcb0", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "requestId": "cdc5f1f78739459e6642407bb2bZKO8GKUM", "newStatus": "CASE_CLOSED", "createTime": "2022-01-24T17:00:15.363Z", "newQuotaValue": "10.0", "serviceName": "Amazon Elastic Compute Cloud (Amazon EC2)", "quotaName": "EC2-Classic Elastic IPs", "unit": "None" }, "eventCategory": "Management" } ``` -------------------------------- ### Stop Automatic Management Configuration via AWS CLI Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/stopping-automatic-management.md Use this command to disable automatic management of service quotas for a specific AWS region. Ensure you replace the placeholder region with your target region. ```bash aws service-quotas stop-auto-management-configuration --region {{ca-central-1}} ``` -------------------------------- ### Exclude Amazon DynamoDB quota from Automatic Management Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/excluding-quotas.md Use this AWS CLI command to exclude a specific Amazon DynamoDB quota from Automatic Management for an AWS account in a specified region. Replace placeholders with your actual service and quota codes, and region. ```bash aws service-quotas update-auto-management \ --opt-in-type NotifyOnly \ --region {{ca-central-1}} \ --exclusion-list '{"{{dynamodb}}":["{{L-E123ABC4}}"]}' ``` -------------------------------- ### Allow Service Quota Increase Based on Resource Tag Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/sq_tags_access.md This policy allows a principal to request an increase for Amazon Athena applied quotas only if the resource is tagged with Owner: admin. Attach this policy to an IAM role or user. ```json { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["servicequotas:RequestServiceQuotaIncrease"], "Resource": "arn:aws:servicequotas:*:*:athena/*", "Condition": { "StringEquals": {"aws:ResourceTag/Owner": "admin"} } } ] } ``` -------------------------------- ### Service Quotas Event Pattern for EventBridge Source: https://docs.aws.amazon.com/servicequotas/latest/userguide/eventbridge-integration.md This JSON event pattern filters for all Service Quotas events related to threshold breaches, failed increase requests, and approaching thresholds. It specifies the source as 'aws.health', detail-type as 'AWS Health Event', and includes specific fields within the 'detail' object for Service Quotas notifications. ```json { "source": ["aws.health"], "detail-type": ["AWS Health Event"], "detail": { "service": ["SERVICEQUOTAS"], "eventTypeCode": [ "AWS_SERVICEQUOTAS_THRESHOLD_BREACH", "AWS_SERVICEQUOTAS_INCREASE_REQUEST_FAILED", "AWS_SERVICEQUOTAS_APPROACHING_THRESHOLD" ], "eventTypeCategory": ["accountNotification"] } } ```