Service Quota Check

Service Quota Check

Use this skill to check AWS service quota utilization during investigations and before provisioning new resources. It determines whether a quota is nearing its limit (85%+ utilization) and takes action: requesting a quota increase via the Service Quotas API when possible, or recommending a support case when programmatic increases are not supported.

When to Use This Skill

• An error message indicates throttling or limit exceeded (e.g., ThrottlingException, TooManyRequestsException, LimitExceededException, ResourceLimitExceeded).
• A resource creation or scaling operation fails with capacity errors.
• An investigation recommendation involves provisioning additional AWS resources (e.g., adding EC2 instances, creating VPCs, adding NAT Gateways, launching RDS instances).
• Capacity planning or pre-launch readiness checks.
• Proactive monitoring of quota utilization across services.

Prerequisites

• The agent must have permissions to call Service Quotas APIs:
  • servicequotas:ListServices
  • servicequotas:ListServiceQuotas
  • servicequotas:GetServiceQuota
  • servicequotas:RequestServiceQuotaIncrease
  • servicequotas:ListRequestedServiceQuotaChangeHistory
  • servicequotas:CreateSupportCase
• For utilization data via CloudWatch, the agent needs:
  • cloudwatch:GetMetricData
  • cloudwatch:GetMetricStatistics
• Service Quotas is a regional service. Quotas must be checked in the region where resources are deployed.

Step 1: Identify the Service and Quota Context

Determine which service and quota to check based on the investigation context:

1. From error messages — extract the service name and specific limit mentioned.
2. From recommendations — if the recommendation is to provision resources, identify the service (e.g., EC2, VPC, RDS, Lambda, ELB) and the resource type.
3. From alarms — if a CloudWatch alarm indicates capacity pressure, identify the underlying service.

Common service codes

If you do not know the service code, use:

aws service-quotas list-services \
  --query "Services[?contains(ServiceName, '<keyword>')]" \
  --region <region>

Step 2: Retrieve Quota Value and Utilization

Get the applied quota value

aws service-quotas get-service-quota \
  --service-code <service-code> \
  --quota-code <quota-code> \
  --region <region>

The response includes:

• Value — the current quota limit (applied value, or default if no increase was granted)
• Adjustable — whether the quota can be increased
• UsageMetric — CloudWatch metric to check current utilization (if available)

If you do not know the quota code

List all quotas for the service:

aws service-quotas list-service-quotas \
  --service-code <service-code> \
  --region <region>

Filter by quota name keyword:

aws service-quotas list-service-quotas \
  --service-code <service-code> \
  --region <region> \
  --query "Quotas[?contains(QuotaName, '<keyword>')]"

Get current utilization via CloudWatch

If the UsageMetric field is present in the quota response, query CloudWatch for actual usage:

aws cloudwatch get-metric-statistics \
  --namespace "<MetricNamespace>" \
  --metric-name "<MetricName>" \
  --dimensions <MetricDimensions> \
  --start-time "<15-minutes-ago-ISO8601>" \
  --end-time "<now-ISO8601>" \
  --period 300 \
  --statistics <MetricStatisticRecommendation> \
  --region <region>

The UsageMetric object from the quota response provides all the parameters:

• MetricNamespace — typically AWS/Usage
• MetricName — typically ResourceCount
• MetricDimensions — service-specific dimensions (e.g., Class, Resource, Service, Type)
• MetricStatisticRecommendation — either Maximum or Sum

Alternative: count resources directly

If no UsageMetric is available, count resources using the service's Describe/List APIs:

Step 3: Calculate Utilization and Assess Risk

Calculate utilization percentage

utilization_pct = (current_usage / quota_value) × 100

Risk assessment thresholds

Present findings

Always show the user a summary table:

┌─────────────────────────────────────────────────────────────────────┐
│ Service Quota Check                                                  │
├─────────────────────────┬───────────┬─────────┬─────────┬───────────┤
│ Quota Name              │ Limit     │ Used    │ % Used  │ Status    │
├─────────────────────────┼───────────┼─────────┼─────────┼───────────┤
│ Running On-Demand (std) │ 1920 vCPU │ 1740    │ 90.6%   │ ⚠️ HIGH   │
│ VPCs per Region         │ 5         │ 5       │ 100%    │ 🚫 FULL   │
│ NAT Gateways per AZ    │ 5         │ 3       │ 60%     │ ✅ OK     │
└─────────────────────────┴───────────┴─────────┴─────────┴───────────┘

Step 4: Request Quota Increase

When utilization is at 85% or higher, proceed based on whether the quota is adjustable.

Decision Tree

Is utilization >= 85%?
├── NO → Report findings, no action needed
└── YES → Check "Adjustable" field
    ├── Adjustable = true → Proceed to quota increase request
    │   ├── Ask user to confirm the increase
    │   ├── User confirms → Submit request via API (Step 4a)
    │   └── User declines → Report findings only
    └── Adjustable = false → Recommend support case (Step 4b)

Step 4a: Submit Quota Increase Request via API

Before requesting, determine the desired new value. Use this formula:

desired_value = current_quota × 1.5   (50% increase over current limit)

If the quota is already exhausted (100% utilization), recommend:

desired_value = current_quota × 2.0   (double the current limit)

Present the recommendation to the user:

"The quota [QuotaName] is at [X]% utilization ([current_usage]/[quota_value]). I recommend increasing it to [desired_value]. Shall I submit the quota increase request?"

If the user confirms, submit the request:

aws service-quotas request-service-quota-increase \
  --service-code <service-code> \
  --quota-code <quota-code> \
  --desired-value <desired-value> \
  --region <region>

After submitting, check the response:

• Status: PENDING — request submitted successfully. Inform the user that AWS will review the request (typically processed within minutes for auto-approved quotas, or up to a few days for manual review).
• Status: CASE_OPENED — a support case was automatically created.

Report the request ID and status:

"Quota increase request submitted successfully.

• Request ID: [Id]
• Status: [Status]
• Desired value: [DesiredValue]

You can check the status with: aws service-quotas get-requested-service-quota-change --request-id <Id>"