Support Case Review

Use this skill when investigating an incident and you need to review AWS Support cases — either the current case associated with the incident or historical cases that may contain relevant context, similar symptoms, or proven remediation steps.

When to Use This Skill

• An active incident shares symptoms with previously resolved issues.
• You need to check if a similar support case was filed in the past 24 months.
• You want to correlate the current incident with known AWS service events.
• You need to retrieve communications and resolution details from a prior case.
• You want to identify recurring patterns across multiple support cases.

Prerequisites

• The AWS account must have a Business Support+, Enterprise Support, or

Unified Operations plan (required for the AWS Support API).

• The agent must have permissions to call support:DescribeCases and

support:DescribeCommunications in the target account.

• Support case data is available for 24 months after creation. Cases older than

24 months cannot be retrieved via the API.

Step 1: Identify the Current Incident Context

Before searching support cases, gather key details from the current incident:

1. Affected AWS services (e.g., EC2, RDS, Lambda, ELB).
2. Error messages or error codes observed in logs or alarms.
3. Timeframe of the incident (start time, duration).
4. Affected resources (instance IDs, ARNs, endpoint names).
5. Symptoms (latency spikes, 5xx errors, connection timeouts, throttling).

Use these details as search criteria when filtering support cases.

Step 2: Search for Related Support Cases

Use the AWS Support API to retrieve cases that may be relevant.

Retrieve all recent cases (open and resolved)

aws support describe-cases \
  --include-resolved-cases \
  --include-communications \
  --after-time "<ISO-8601-start>" \
  --before-time "<ISO-8601-end>" \
  --language "en"

Filter by specific case IDs (if known)

aws support describe-cases \
  --case-id-list "case-123456789010-muen-2024" \
  --include-communications

Key filtering strategies

Step 3: Review Case Communications

The describe-cases response with includeCommunications: true returns the most recent communications for each case in the recentCommunications field (up to 5 messages). Since root cause analysis and resolution steps are typically in the final messages of a resolved case, this is usually sufficient.

If the recentCommunications field includes a nextToken, the case has additional older messages. Only paginate using describe-communications if the recent messages do not contain a clear root cause or resolution — for example, if the last messages are follow-up questions rather than a final answer.

aws support describe-communications \
  --case-id "case-123456789010-muen-2024" \
  --max-results 10 \
  --next-token "<nextToken-from-recentCommunications>"

When reviewing communications, look for:

1. Root cause statements — AWS Support engineers often summarize the root

cause in their final response.

1. Remediation steps — Specific actions taken to resolve the issue (e.g.,

"increased max_connections", "applied security group rule", "scaled up instance type").

1. Configuration recommendations — Best practices or tuning suggestions

provided by AWS.

1. Escalation notes — If the case was escalated, check for deeper technical

analysis from specialized teams.

Step 4: Correlate Findings with Current Incident

After reviewing relevant cases, correlate the findings:

Pattern matching checklist

• [ ] Do past cases share the same affected service and resource type?
• [ ] Are the error messages or codes identical or similar?
• [ ] Did past incidents occur at a similar time of day or day of week (indicating load patterns)?
• [ ] Was the root cause a configuration issue that may still be present?
• [ ] Was the resolution a temporary workaround that has since expired or been reverted?
• [ ] Did AWS identify a service-side issue that may be recurring?

Relevance scoring

Rate each historical case on relevance to the current incident:

Step 5: Summarize Findings

Provide a structured summary including:

1. Number of related cases found — How many past cases matched the search

criteria.

1. Most relevant case(s) — Case ID, subject, status, and creation date of

the top matches.

1. Historical root causes — What caused similar issues in the past.
2. Past resolutions — What remediation steps were applied and whether they

were permanent fixes or temporary workarounds.

1. Recommendations — Based on historical patterns, suggest investigation

paths or remediation steps for the current incident.

1. Recurring pattern alert — If the same issue has occurred multiple times,

flag it as a recurring problem requiring a permanent fix or architectural change.

Decision Tree: Case Search Strategy

Is there a known case ID associated with the current incident?
├── YES → Retrieve that specific case and its communications (Step 2, filter by case ID)
└── NO → Continue below

Is the affected AWS service known?
├── YES → Search cases in the past 90 days for that service, then expand to 12 months if needed
└── NO → Search all cases in the past 30 days and filter by error keywords

Were relevant historical cases found?
├── YES → Review communications (Step 3), correlate findings (Step 4), summarize (Step 5)
└── NO → Broaden search criteria:
         - Expand time window
         - Search by related services (e.g., if ELB is affected, also check EC2 and Target Group cases)
         - Search by error code or symptom keywords in case subjects

Tips for Effective Case Review

• Start narrow, then broaden: Begin with specific filters (service + time

window) and expand only if no relevant cases are found.

• Check resolved cases: The most valuable information often comes from

resolved cases where root cause and fix are documented.

• Note case severity patterns: If past cases for the same issue were filed

at critical severity, the current incident may warrant similar urgency.

• Cross-reference with deployments: If a past case was caused by a

deployment, check if a similar deployment occurred before the current incident.