{
"version": "bedrock-2026-05-14",
"templateId": "health-triage",
"promptTemplate": "Classify {{health_event}} into one of four urgency levels: `BLACK`/`RED`/`YELLOW`/`GREEN`. The criteria are as follows. Black = requires more than a month of effort and a project-level response including the vendor (entails service downtime; e.g., RDS major version upgrade). Red = does not entail service downtime, but requires a response such as impact investigation and has a deadline (e.g., migration to a service role for Amazon CloudWatch cross-account/cross-region). Yellow = currently has no impact on service or operations, but a response is required (e.g., end of Lambda runtime support). Green = no particular impact (e.g., CloudShell data deletion deadline).",
"evaluationSamples": [
{
"inputVariables": [
{
"health_event": "(Aggregate) Health Event: AWS SDK PLANNED LIFECYCLE EVENT in us-east-1 on account 123456789123. - impacting 20 account(s) in the us-east-1 region ... "
}
],
"referenceResponse": "Yellow"
},
{
"inputVariables": [
{
"health_event": "[Action Required] Migration to a service role for Amazon CloudWatch cross-account cross-region ... "
}
],
"referenceResponse": "RED"
},
...
]
}

Classify the following AWS Health event into one of four categories: `BLACK`/`RED`/`YELLOW`/`GREEN`.

**Output format: Respond with only the classification label (BLACK/RED/YELLOW/GREEN) as a single word. No explanations, reasons, bullet points, headings, or recommended actions are needed.**

---

**Follow the decision tree below, evaluating from Step 1 in order, and select the category of the first step that evaluates to Yes:**

**Step 1 → BLACK**: Does it meet any of the following?
- Service downtime, DB instance restart, or downtime occurs during the response work (e.g., OS upgrade, DB major version upgrade, OS in-place upgrade)
- If the response is not completed, API calls / service calls will eventually fail completely in the future (e.g., requests to a model ID fail, an endpoint is retired)
- Requires a project-level response of more than a month involving the vendor and multiple teams (e.g., Windows server version migration)
→ If applicable, **BLACK**

**⚠️ Mandatory check before proceeding to Step 2 (GREEN-priority rule):**
If the required work is ONLY "updating agents such as the SSM Agent / CloudWatch Agent" and/or "adding IAM permissions" → **immediately select GREEN and skip evaluation from Step 2 onward**. This rule applies even if wording such as a deadline, urgency, or "action required" is included.
- **⚠️ Important exclusion condition (this rule does NOT classify as GREEN)**: If the IAM permission addition is forced by "a change to the AWS service-side API spec, a change in authentication behavior, or removal from an allowlist," and existing API calls or functionality will fail / stop working if not addressed, the GREEN-priority rule does not apply. In this case, evaluate Step 2 (RED).
- Example (RED, not GREEN): "For the GetFunction API to return tag data, the lambda:ListTags permission will be required. As of July 7, 2026, it will be removed from the allowlist. If not addressed, the GetFunction API will no longer return tag data." → IAM permission addition is required, but an existing workflow breaks due to an AWS-side API authentication change → **RED**
- Example (GREEN): "For SSM Run Command, update the SSM Agent to the latest version and add IAM permissions (ssmmessages:*). If not addressed by June 16, 2026..." → The work is only an agent update + IAM permission addition → **GREEN**
- Example (GREEN): "Update the SSM Agent to 3.x or later. Deadline: [date]" → **GREEN**

**Step 2 → RED**: Does it meet any of the following? (※ Only evaluate Step 2 if, after fully confirming the Step 1 conditions first, none of them apply)
- **[Important: no need to evaluate Step 2] If the required work is only an agent update / IAM permission addition, the GREEN-priority rule before Step 2 applies. If you reach this line, it is out of scope for Step 2; select GREEN.**
- **[RED pattern for AWS automatic-execution notifications]**: A notification where, if the user does not respond by the deadline, AWS automatically enforces a change, resulting in a billing penalty or an unintended configuration change (e.g., AWS performing an automatic major version upgrade after RDS end of support, incurring extended support charges) → If the user's required work is only version selection or configuration changes and the user does not themselves perform the downtime work, it is RED.
- Service / operations are currently impacted, or an urgent security response is required
- A change to existing operational settings, roles, or API paths is required, and there is a clear deadline (e.g., migration to a service role)
- **Note: If the upgrade work itself entails downtime or a DB restart, select BLACK in Step 1 rather than RED, even if there is a deadline.**
→ If applicable, **RED**

**Step 3 → YELLOW**: Does it meet any of the following?
- There is currently no impact on service or operations, but a future response is required to the retirement or change of peripheral features such as console features, the UI, **a runtime, an SDK, a library, or a client library** (e.g., console retirement, end of runtime support, **end of support for an SDK version**, EOL of a client library)
- **Important pattern**: "Existing applications will continue to work, but the SDK will no longer receive security patches / bug fixes" → currently works, but a future migration is required → **YELLOW** (not GREEN)
- Example (YELLOW): "AWS SDK for Java 1.x will reach end of support on December 31, 2025. Existing applications will continue to work, but security patches will no longer be provided." → **YELLOW**
- Example (GREEN × incorrect): Classifying the SDK EOL notification above as GREEN is **incorrect**. The phrase "continues to work" does not turn YELLOW into GREEN.
- **Platform version / task / instance retirement notifications** (e.g., task retirement due to a Fargate platform version revision, EC2 retirement). Even if the notification text states "no action required," if it entails retirement or deprecation, it is YELLOW.
- **A change such that specific data or search results will no longer be displayed in the current tool / console / API, or will only be accessible via a different tool** (e.g., new Inspector multi-cloud findings not displayed in Security Hub CSPM)
- **Currently working normally, but the configuration is deprecated or in a non-redundant state, and AWS recommends a response** (e.g., a VPN connection using only one tunnel, where AWS recommends enabling both tunnels)
→ If applicable, **YELLOW**

**Step 4 → GREEN**: If none of the above apply
- Examples: a certificate auto-renewal completion notice, an informational-only notice, the addition of a new feature with no impact on existing operations
- **Boundary between GREEN and YELLOW (important)**: The phrase "existing apps / features will continue to work" alone does not make it GREEN. If it entails an SDK EOL, runtime retirement, or end of library support, it is YELLOW even if continued operation is described. GREEN is only for purely informational notices that require absolutely no action, now or in the future.
- Example: a response that is only an agent update or IAM permission addition, with no current service impact and a distant deadline
- Example: a new-feature rollout notice that explicitly states "most users need to do nothing"
- Example: a data-cleanup notice for an inactive resource (a minor response that can be prevented just by logging in)
- Example: a notice of a change to CloudTrail event names / event sources (only an optional update to monitoring scripts / log parsers, with no impact on the service itself) → **GREEN** (not YELLOW; this is a change to CloudTrail metadata, not a service retirement, runtime end, or platform retirement)
→ **GREEN**

---

**Important judgment rules:**

**[BLACK vs RED priority]**
- If the Step 1 (BLACK) conditions are met, select BLACK even if a deadline or billing penalty is stated. The combination of "deadline + billing penalty + DB restart during the upgrade work" is BLACK, not RED.
- Example (BLACK): "RDS for Oracle OS upgrade (mandatory). The DB instance is restarted during the upgrade." → BLACK because downtime is entailed.
- Example (BLACK): "Windows Server in-place upgrade. Service downtime occurs during the work." → BLACK.
- Example (RED): "RDS MySQL 8.0 reaches end of standard support on July 31, 2026. If not addressed by the deadline, AWS will automatically perform a major version upgrade and extended support charges will apply. The upgrade itself is performed automatically by AWS, so the user only needs to make configuration changes / version selections by the deadline." → A notification of a forced automatic upgrade by AWS, where the user's required work is only configuration selection, and there is a clear deadline → RED.
- Example (RED): "Please migrate the service role to the new role. Deadline is [date]." → Configuration change only, no downtime, with a clear deadline → RED.

**[Boundary between GREEN, YELLOW, and RED]**
- If "future upgrade work entails downtime," it is BLACK (even if scheduled for the future, if the response work itself entails service downtime, it is BLACK).
- Even if "there is plenty of time until the deadline" or "the work is technically easy," if it meets the Step 1 conditions, it is BLACK.
- If only the console / UI is retired and there is no impact on the service itself, it is YELLOW (not RED).
- **If a simple agent update or IAM permission addition alone completes the response, it is GREEN even if a deadline is stated** (e.g., the response is complete just by updating the SSM Agent to the latest version, with no current service impact). The existence of a deadline alone does not make it RED. If the response content is only an agent update / IAM permission addition, it is GREEN. However, if that IAM permission addition is forced by an AWS service-side API spec change / authentication change, and existing functionality breaks if not addressed, select RED rather than GREEN (e.g., a notification where an AWS API authentication-behavior change makes an explicit permission necessary, and an existing workflow fails if not addressed by the deadline).
- **If a new feature is added or expanded with no change to existing users' operations and the response is optional, it is GREEN** (e.g., expanding dataset access to a new user type; existing operations are unchanged, and a response is optional only if the administrator wants to restrict access).
- **Even if the event body explicitly states "you don't need to do anything (in most cases)" or "no action required," select YELLOW rather than GREEN if it falls under any of the following: a platform version revision, task retirement, runtime retirement, configuration deprecation, or a data-access change. The phrase "no action required" does not override the nature of the change. Only purely informational notices that entail no retirement, change, or retirement whatsoever are GREEN.**
- **A change such that specific data or search results will no longer be displayed in the console / API, or will only be accessible via a different tool, is YELLOW** (e.g., Inspector search results no longer displayed on a specific Security Hub screen).
- A data-deletion notice for an inactive resource (e.g., CloudShell home directory deletion) is GREEN if there is no impact on the service itself and the response is easy.

---

{{health_event}}