service-quota-check

Files (7)

• .skilleval.yaml
• CHANGELOG.md
• README.md
• SKILL.md
• eval_queries.json · evals/
• evals.json · evals/
• common-quota-codes.md · references/

SKILL.md (first lines)

# Service Quota Check

Use this skill to check AWS service quota utilization during investigations and before
provisioning new resources. It determines whether a quota is nearing its limit (85%+
utilization) and takes action: requesting a quota increase via the Service Quotas API
when possible, or recommending a support case when programmatic increases are not supported.

## When to Use This Skill

- An error message indicates throttling or limit exceeded (e.g., `ThrottlingException`,
  `TooManyRequestsException`, `LimitExceededException`, `ResourceLimitExceeded`).
- A resource creation or scaling operation fails with capacity errors.
- An investigation recommendation involves provisioning additional AWS resources
  (e.g., adding EC2 instances, creating VPCs, adding NAT Gateways, launching RDS instances).
- Capacity planning or pre-launch readiness checks.
- Proactive monitoring of quota utilization across services.

## Prerequisites

- The agent must have permissions to call Service Quotas APIs:
  - `servicequotas:ListServices`
  - `servicequotas:ListServiceQuotas`
  - `servicequotas:GetServiceQuota`
  - `servicequotas:RequestServiceQuotaIncrease`
  - `servicequotas:ListRequestedServiceQuotaChangeHistory`
  - `servicequotas:CreateSupportCase`
- For utilization data via CloudWatch, the agent needs:
  - `cloudwatch:GetMetricData`
  - `cloudwatch:GetMetricStatistics`
- Service Quotas is a regional service. Quotas must be checked in the region
  where resources are deployed.

---

## Step 1: Identify the Service and Quota Context

Determine which service and quota to check based on the investigation context:

1. **From error messages** — extract the service name and specific limit mentioned.
2. **From recommendations** — if the recommendation is to provision resources, identify
   the service (e.g., EC2, VPC, RDS, Lambda, ELB) and the resource type.
3. **From alarms** — if a CloudWatch alarm indicates capacity pressure, identify the
   underlying service.

### Common service codes

| AWS Service | Service Code |
|-------------|-------------|
| Amazon EC2 | `ec2` |
| Amazon VPC | `vpc` |
| Elastic Load Balancing | `elasticloadbalancing` |
| Amazon RDS | `rds` |
| AWS Lambda | `lambda` |
| Amazon ECS | `ecs` |
| Amazon EKS | `eks` |
| Amazon S3 | `s3` |
| Amazon DynamoDB | `dynamodb` |
| AWS Fargate | `fargate` |
| Amazon CloudWatch | `monitoring` |
| AWS CloudFormation | `cloudformation` |
| Amazon SQS | `sqs` |
| Amazon SNS | `sns` |
| Amazon ElastiCache | `elasticache` |
| Amazon OpenSearch Service | `es` |
| Auto Scaling | `autoscaling` |

If you do not know the service code, use:

```bash
aws service-quotas list-services \
  --query "Services[?contains(ServiceName, '<keyword>')]" \
  --region <region>
```

---

## Step 2: Retrieve Quota Value and Utilization

### Get the applied quota value

```bash
aws service-quotas get-service-quota \
  --service-code <service-code> \
  --quota-code <quota-code> \
  --region <region>
```

The response includes:
- `Value` — the current quota limit (applied value, or default if no increase was granted)
- `Adjustable` — whether the quota can be increased
- `UsageMetric` — CloudWatch metric to check current utilization (if available)

### If you do not know the quota code

List all quotas for the service:

```bash
aws service-quotas list-service-quotas \
  --service-code <service-code> \
  --region <region>
```

Filter by quota name keyword:

```bash
aws service-quotas list-service-quotas \
  --service-code <service-code> \
  --region <region> \
  --query "Quotas[?contains(QuotaName, '<keyword>')]"
```

### Get current utilization via CloudWatch

If the `UsageMetric` field is present in the quota response, query CloudWatch for actual usage:

```bash
aws cloudwatch get-metric-statistics \
  --namespace "<MetricNamespace>" \
  --metric-name "<MetricName>" \

From aws/tools-for-devops-agent, Apache-2.0.

More from aws/tools-for-devops-agent