Rewindex

RewindexOutage eventsDec 22, 2021

AWS us-east-1 outage, Dec 22, 2021

40 vendors posted 40 incidents between 12:00 and 15:00 UTC, against about 3 incidents from 3 vendors in the same hours on an ordinary week. 9 vendors named AWS in 9 incidents (6 of them blamed it). Vendors reported an AWS outage; AWS’s own incident for this date is not in the archive.

Observed, not verified. A line means a vendor’s incident named another vendor, or started in the same window. It is not a proven cause.

Times are UTC; lags are from when the first vendor named AWS.

    7. first vendor named AWS 12:41
Named AWSNamed another vendorDid not name anyoneEach column is 30 minutes

How it spread

Vendors that named AWS, grouped by when they posted, and vendors that blamed one of the vendors AWS took down. Solid lines: the vendor named the other. Dashed: same window, not named.

Swipe sideways to see the whole diagram.

AWS us-east-1own incident not archivedWithin an hour8 vendors, 6 blamed AWSFirebolt, Bitbucket, HubSpot, CircleCI +41 to 4 hours later1 vendorConfluent
AWS us-east-1own incident not archivedWithin an hour8 vendors, 6 blamed AWSFirebolt, Bitbucket, HubSpot,CircleCI +41 to 4 hours later1 vendorConfluent
Rendered on the server with pele from the Mermaid source below. Each box lists the first few vendors; every vendor is listed further down.
Mermaid source
flowchart LR
  root["AWS us-east-1<br/>own incident not archived"]:::inferred
  h1["Within an hour<br/>8 vendors, 6 blamed AWS<br/>Firebolt, Bitbucket, HubSpot, CircleCI +4"]:::blames
  root --> h1
  h4["1 to 4 hours later<br/>1 vendor<br/>Confluent"]:::names
  root --> h4

Vendors that named AWS

In their own words. “Blames” means a causal phrase sits next to the name (“due to”, “upstream provider”…).

Within an hour

8 vendors

1 to 4 hours later

1 vendor

Same window, did not name anyone

31 incidents started during the event without naming AWS or another vendor. Some are part of it, some are a normal day’s background (about 3 in these hours).

Show all 31

Detected automatically from 22 status pages opening incidents in the peak hour (normally at most 6). Mentions are matched by name in each incident’s title and updates, then classified as cause, location or integration; quoted text is the vendor’s. Vendors that share one status page are shown once.