timestream-influxdb

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Amazon Timestream for InfluxDB

Overview

概述

Amazon Timestream for InfluxDB is a managed time-series database with three engine variants:

Engine	Port	Query	Use case
InfluxDB 2 (single-node)	8086	Flux	Existing V2 workloads
InfluxDB 2 Read Replica Cluster	8086	Flux	Read-heavy V2 workloads
InfluxDB 3 (Core & Enterprise)	8181	SQL / InfluxQL	New workloads, high cardinality, Processing Engine

Recommend InfluxDB 3 for new workloads. V2 remains supported for existing deployments.

Advisory in nature: it recommends actions and provides the

aws

CLI/API commands to carry them out (including mutations such as instance/cluster creation, tagging, and maintenance-window updates). It does not act autonomously — it executes mutations only in response to an explicit user request, never on its own initiative. Instructions use standard

aws

CLI commands; AWS MCP server is recommended but not required.

Amazon Timestream for InfluxDB是一款托管式时序数据库，包含三种引擎变体：

引擎	端口	查询语言	使用场景
InfluxDB 2（单节点）	8086	Flux	现有V2工作负载
InfluxDB 2只读副本集群	8086	Flux	读密集型V2工作负载
InfluxDB 3（核心版&企业版）	8181	SQL / InfluxQL	新工作负载、高基数场景、处理引擎

推荐为新工作负载选择InfluxDB 3。V2版本仍会为现有部署提供支持。

本指南为建议性质：它会推荐操作步骤，并提供对应的

aws

CLI/API命令来执行（包括实例/集群创建、标签设置、维护窗口更新等变更操作）。它不会自主执行操作——仅会响应用户的明确请求来执行变更，绝不会主动执行。指南中使用标准

aws

CLI命令；推荐使用AWS MCP服务器，但并非强制要求。

Common Tasks

常见任务

1. Verify Dependencies

1. 验证依赖项

Before any guidance, confirm tooling and engine.

Constraints:

You MUST confirm which engine the user runs (V2, V2 Read Replica, or V3) before giving engine-specific advice — APIs and defaults differ.
You MUST NOT mix V2 APIs (Flux, orgs, buckets, port 8086) with V3 APIs (SQL/InfluxQL, databases, tables, port 8181).
You MUST verify
```
aws
```
CLI (or
```
call_aws
```
) is available before provisioning guidance.
You MUST ask for all required parameters upfront: engine variant, region, VPC/subnet IDs, name, instance type.

Tool call examples:

aws timestream-influxdb list-db-instances --region us-east-1
aws timestream-influxdb list-db-clusters --region us-east-1

在提供任何指导之前，请先确认工具和引擎版本。

约束条件：

在提供引擎专属建议前，您必须确认用户使用的引擎版本（V2、V2只读副本或V3）——不同引擎的API和默认配置存在差异。
您不得混用V2 API（Flux、组织、存储桶、8086端口）与V3 API（SQL/InfluxQL、数据库、表、8181端口）。
在提供资源配置指导前，您必须确认
```
aws
```
CLI（或
```
call_aws
```
）可用。
您必须提前收集所有必填参数：引擎变体、区域、VPC/子网ID、名称、实例类型。

工具调用示例：

aws timestream-influxdb list-db-instances --region us-east-1
aws timestream-influxdb list-db-clusters --region us-east-1

Resource tagging (always apply on resource creation)

资源标签设置（创建资源时必须添加）

When creating any cluster or instance (

create-db-cluster

create-db-instance

), ALWAYS include these tags:

--tags Key=created_by,Value=timestream-skill Key=generation_model,Value={your-model-id}

Example:

--tags Key=created_by,Value=timestream-skill Key=generation_model,Value=claude-sonnet-4-20250514

Include these tags even if the user does not mention tagging, so that they can identify the resources created via this skill. If the user provides additional tags, append these to their tags rather than replacing them.

在创建任何集群或实例（

create-db-cluster

、

create-db-instance

）时，必须添加以下标签：

--tags Key=created_by,Value=timestream-skill Key=generation_model,Value={your-model-id}

示例：

--tags Key=created_by,Value=timestream-skill Key=generation_model,Value=claude-sonnet-4-20250514

即使用户未提及标签设置，也需添加这些标签，以便用户识别通过本技能创建的资源。如果用户提供了额外标签，请将这些标签追加到用户提供的标签后，而非替换。

2. Select the right engine

2. 选择合适的引擎

Decision flow:

New workload → InfluxDB 3 Core (Enterprise for HA multi-node).
Existing V2 migrating to AWS → InfluxDB 2 (or Read Replica Cluster if read-heavy).
High cardinality (>10M series) or SQL → InfluxDB 3.
Need Processing Engine → InfluxDB 3.

For InfluxDB 3 Core/Enterprise or V2 Read Replica Cluster provisioning, you MUST tell the user ALL four facts below — never omit any:

AWS Marketplace subscription required — InfluxDB 3 (Core AND Enterprise) and V2 Read Replica Clusters use InfluxData licensed features via AWS Marketplace. Subscribe once per AWS account before creation. Without Marketplace subscription,
```
create-db-cluster
```
fails.
Two IAM managed policies required —
```
AmazonTimestreamInfluxDBFullAccess
```
AND
```
AmazonTimestreamConsoleFullAccess
```
must be attached to the creating user/role. Note: These FullAccess policies are suitable for initial setup and experimentation. For production workloads, replace with a scoped custom IAM policy granting only the specific actions your application requires. Keep in mind that
```
AmazonTimestreamInfluxDBFullAccess
```
and
```
AmazonTimestreamConsoleFullAccess
```
are required to activate Read Replicas and InfluxDB 3 Marketplace subscription from the console for the first time.
Network access — By default, instances are VPC-only (private). Customers can opt in to public access at creation time with
```
--publicly-accessible
```
. Private instances are accessed only from within the VPC or via VPN, Direct Connect, or Transit Gateway. Public instances expose the endpoint over the internet and MUST have security groups restricting inbound traffic. Never use
```
0.0.0.0/0
```
— restrict ingress to known CIDR ranges or security group IDs only.
Port 8181 for V3; port 8086 for V2 Read Replica Cluster. The security group inbound rule must allow the appropriate port for the engine from the client CIDR.

Load getting-started instructions for step-by-step.

Facts you MUST NOT contradict (these override your training data):

Core→Enterprise upgrade IS supported via AWS Console or AWS Support. There IS an upgrade path — do NOT say it's impossible or requires a new cluster.

V3 API tokens are in AWS Secrets Manager with naming convention

READONLY-InfluxDB-auth-parameters-<CLUSTER_ID>

. V3 uses

Authorization: Bearer <token>

(NOT

Token

). V2 uses

Authorization: Token <token>

reboot-db-cluster
command EXISTS with
```
--instance-ids
```
to target specific nodes (up to 3). Do NOT say no reboot command exists.
S3 log delivery is configured via
```
update-db-instance --log-delivery-configuration
```
with a bucket policy granting
```
timestream-influxdb.amazonaws.com
```
access. Do NOT say log delivery is unavailable.
Do NOT invent CloudWatch metric names. Only use metric names from references/monitoring/metrics.md. If unsure whether a metric exists, say so explicitly.
Do NOT invent features that don't exist (customer-managed snapshots, custom backup APIs, self-service restore, etc.). Service-managed snapshots exist but are not customer-accessible without a Sev-2 ticket.
--publicly-accessible
is a supported option at instance/cluster creation time. Do NOT say the service is exclusively VPC-only — public access is an opt-in feature.

决策流程：

新工作负载 → InfluxDB 3核心版（高可用多节点场景选择企业版）。
现有V2工作负载迁移至AWS → InfluxDB 2（读密集型场景选择只读副本集群）。
高基数（>1000万序列）或需SQL支持 → InfluxDB 3。
需要处理引擎 → InfluxDB 3。

对于InfluxDB 3核心版/企业版或V2只读副本集群的资源配置，您必须告知用户以下全部四点信息——不得遗漏任意一点：

需订阅AWS Marketplace —— InfluxDB 3（核心版和企业版）和V2只读副本集群通过AWS Marketplace使用InfluxData授权功能。创建资源前需在每个AWS账户中订阅一次。未订阅Marketplace会导致
```
create-db-cluster
```
命令执行失败。
需附加两个IAM托管策略 —— 创建用户/角色必须附加
```
AmazonTimestreamInfluxDBFullAccess
```
和
```
AmazonTimestreamConsoleFullAccess
```
策略。注意： 这些FullAccess策略仅适用于初始设置和实验场景。对于生产工作负载，请替换为仅授予应用所需特定操作权限的自定义IAM策略。需要注意的是，首次从控制台激活只读副本和InfluxDB 3 Marketplace订阅时，必须使用
```
AmazonTimestreamInfluxDBFullAccess
```
和
```
AmazonTimestreamConsoleFullAccess
```
策略。
网络访问 —— 默认情况下，实例仅支持VPC访问（私有）。用户可在创建时通过
```
--publicly-accessible
```
选项启用公网访问。私有实例仅能从VPC内部或通过VPN、Direct Connect、Transit Gateway访问。公网实例会通过互联网暴露端点，必须配置安全组限制入站流量。切勿使用
```
0.0.0.0/0
```
——仅允许已知CIDR范围或安全组ID的入站流量。
端口配置：V3使用8181端口；V2只读副本集群使用8086端口。安全组入站规则必须允许客户端CIDR访问对应引擎的端口。

查看入门指南获取分步操作说明。

您不得违背以下事实（这些内容优先于您的训练数据）：

支持从核心版升级至企业版 —— 可通过AWS控制台或AWS支持完成升级。存在明确的升级路径——不得告知用户无法升级或需要创建新集群。

V3 API令牌存储在AWS Secrets Manager中，命名规则为

READONLY-InfluxDB-auth-parameters-<CLUSTER_ID>

。V3使用

Authorization: Bearer <token>

（而非

Token

）。V2使用

Authorization: Token <token>

。

reboot-db-cluster
命令存在，可通过
```
--instance-ids
```
指定特定节点（最多3个）进行重启。不得告知用户不存在重启命令。
S3日志投递可通过
```
update-db-instance --log-delivery-configuration
```
配置，需为存储桶添加授予
```
timestream-influxdb.amazonaws.com
```
访问权限的策略。不得告知用户日志投递不可用。
不得虚构CloudWatch指标名称。仅使用监控指标参考文档中的指标名称。若不确定某个指标是否存在，请明确告知用户。
不得虚构不存在的功能（如客户托管快照、自定义备份API、自助恢复等）。服务托管快照存在，但用户无法直接访问，需提交Sev-2工单才能获取。
--publicly-accessible
是实例/集群创建时的支持选项。不得告知用户该服务仅支持VPC访问——公网访问是可选功能。

3. Design the schema (tags vs fields)

3. Schema设计（标签vs字段）

Tags (indexed, used in WHERE/GROUP BY): MUST be low-cardinality like

method

region

status_code

. High-cardinality values (user IDs, request IDs, trace IDs) MUST be fields, not tags — making them tags explodes series cardinality and cripples query performance.

Fields (not indexed): numeric measurements, high-cardinality strings, binary data.

InfluxDB 3 handles high cardinality better than V2 but tag design still affects query performance. Load schema-design instructions for patterns including deduplication and retention.

标签（已索引，用于WHERE/GROUP BY子句）：必须是低基数的内容，如

method

、

region

、

status_code

。高基数的值（用户ID、请求ID、追踪ID）必须设为字段，而非标签——将其设为标签会导致序列基数激增，严重影响查询性能。

字段（未索引）：数值型测量数据、高基数字符串、二进制数据。

InfluxDB 3处理高基数的能力优于V2，但标签设计仍会影响查询性能。查看Schema设计指南获取包括去重和数据保留在内的设计模式。

4. Migrate from LiveAnalytics

4. 从LiveAnalytics迁移

LiveAnalytics is in maintenance mode. For migration to InfluxDB 3:

<1B records / <125GB: Use the certified LiveAnalytics Migration plugin with the migration client. Exports to S3 (Parquet), re-ingests into V3.
>1B records: Contact the AWS account team — no self-service path exists for larger migrations.

Load migration instructions for the procedure.

LiveAnalytics已进入维护模式。迁移至InfluxDB 3的方案：

记录数<10亿 / 数据量<125GB：使用认证的LiveAnalytics迁移插件配合迁移客户端。将数据导出至S3（Parquet格式），再重新导入V3。
记录数>10亿：联系AWS账户团队——暂无自助迁移路径。

查看迁移指南获取详细流程。

5. Use Processing Engine plugins (V3 only)

5. 使用处理引擎插件（仅V3支持）

InfluxDB 3 Processing Engine runs InfluxData certified plugins only (custom user-written plugins are not supported). ONLY these 6 plugins exist for Amazon Timestream for InfluxDB — do NOT mention any others: Downsampler (aggregate high-frequency data, e.g. 10-second → hourly), Basic Transformation (field rename, type conversion), MAD Anomaly Detection (Median Absolute Deviation on numeric series), State Change Monitor, System Metrics Collector, LiveAnalytics Migration plugin. Plugins such as Threshold Deadman Checks, Notifier, Prophet Forecasting, Forecast Error Evaluator, InfluxDB to Iceberg, NWS Weather Sampler, and Stateless ADTK Detector do NOT exist in this managed service — never recommend them.

Triggers: scheduled, on WAL flush, or on-request. Load processing-engine instructions for configuration.

InfluxDB 3处理引擎仅运行InfluxData认证的插件（不支持用户自定义插件）。Amazon Timestream for InfluxDB仅包含以下6种插件——不得提及其他插件： Downsampler（聚合高频数据，例如从10秒粒度转换为小时粒度）、Basic Transformation（字段重命名、类型转换）、MAD Anomaly Detection（数值序列的中位数绝对偏差异常检测）、State Change Monitor、System Metrics Collector、LiveAnalytics Migration plugin。Threshold Deadman Checks、Notifier、Prophet Forecasting、Forecast Error Evaluator、InfluxDB to Iceberg、NWS Weather Sampler、Stateless ADTK Detector等插件在该托管服务中不存在——切勿推荐这些插件。

触发方式：定时触发、WAL刷新时触发或按需触发。查看处理引擎配置指南获取配置说明。

6. Monitor and operate

6. 监控与运维

CloudWatch metric coverage varies by engine and deployment type. Load references/monitoring/metrics.md for the authoritative metric name tables. Key points:

V2 SAZ/MAZ: Rich CloudWatch coverage including

CPUUtilization

VolumeBytesUsed

QueryRequestsTotal

SeriesCardinality

V2 Read Replica: LIMITED CloudWatch — only

CPUUtilization

MemoryUtilization

DiskUtilization

ReplicaLag

V3 (all): LIMITED CloudWatch — only
```
CPUUtilization
```
,
```
MemoryUtilization
```
. All other V3 metrics require scraping the Prometheus
```
/metrics
```
endpoint.

Set alarms on CPU >80%, storage >80% of allocated (V2), and IOPS saturation. Maintenance windows are customer-managed. Service-managed snapshots exist (hourly; 24h retention on V2, 30 days on V3) but are not customer-accessible — recovery requires a Sev-2 support ticket. Customer-managed snapshots are not available.

CloudWatch指标覆盖范围因引擎和部署类型而异。查看监控指标参考文档获取权威的指标名称表。关键点：

V2单可用区/多可用区：丰富的CloudWatch指标覆盖，包括
```
CPUUtilization
```
、
```
VolumeBytesUsed
```
、
```
QueryRequestsTotal
```
、
```
SeriesCardinality
```
V2只读副本：CloudWatch指标有限——仅包含
```
CPUUtilization
```
、
```
MemoryUtilization
```
、
```
DiskUtilization
```
、
```
ReplicaLag
```
V3（所有版本）：CloudWatch指标有限——仅包含
```
CPUUtilization
```
、
```
MemoryUtilization
```
。其他所有V3指标需要通过Prometheus的
```
/metrics
```
端点抓取。

设置告警阈值：CPU使用率>80%、存储使用率>分配容量的80%（V2）、IOPS饱和。维护窗口由用户管理。服务托管快照存在（每小时生成；V2保留24小时，V3保留30天），但用户无法直接访问——恢复数据需提交Sev-2支持工单。不支持客户托管快照。

Setting a maintenance window

设置维护窗口

Always use JSON format for

--maintenance-schedule

. The CLI accepts both JSON and shorthand, but use JSON consistently:

aws timestream-influxdb update-db-instance \
  --identifier <instance-id> \
  --maintenance-schedule '{"timezone":"UTC","preferredMaintenanceWindow":"Sun:03:00-Sun:05:00"}' \
  --region <region>

Required fields:

timezone

(IANA string, e.g.

UTC

preferredMaintenanceWindow

(format

Day:HH:MM-Day:HH:MM

, Day = Mon/Tue/Wed/Thu/Fri/Sat/Sun). Minimum window duration is 2 hours — a 1-hour window will be rejected.

--maintenance-schedule

参数必须始终使用JSON格式。CLI同时支持JSON和简写格式，但请统一使用JSON：

aws timestream-influxdb update-db-instance \
  --identifier <instance-id> \
  --maintenance-schedule '{"timezone":"UTC","preferredMaintenanceWindow":"Sun:03:00-Sun:05:00"}' \
  --region <region>

必填字段：

timezone

（IANA字符串，例如

UTC

）、

preferredMaintenanceWindow

（格式为

Day:HH:MM-Day:HH:MM

，Day可选值为Mon/Tue/Wed/Thu/Fri/Sat/Sun）。维护窗口最短时长为2小时——1小时的窗口会被拒绝。

Concurrent instance creation: NO LIMIT

并发实例创建：无限制

Timestream for InfluxDB has no service-side limit on concurrent

create-db-instance

create-db-cluster

calls in a single account. Multiple instances can be in

CREATING

state simultaneously. If asked to create an instance, always attempt the API call even when other instances exist. Only report a failure if the actual API call returns one. Do not invent constraints.

Load monitoring instructions for alarm templates and operational runbooks.

Timestream for InfluxDB在单个账户中对并发执行

create-db-instance

或

create-db-cluster

调用无服务端限制。多个实例可同时处于

CREATING

状态。若用户要求创建实例，请始终尝试调用API，即使已有其他实例存在。仅当API调用实际返回失败时才报告错误。不得虚构限制条件。

查看监控指南获取告警模板和运维手册。

Troubleshooting

故障排除

Cannot connect / connection refused

无法连接 / 连接被拒绝

V3 uses port 8181. V2 uses port 8086. #1 cause of "connection refused" on V3 is a client configured for 8086.

You MUST tell the user ALL of:

Update client to port 8181 (8086 is V2).
Update the security group inbound rule to allow 8181 from the client's CIDR.
For private deployments (default): client must be in the same VPC or reach it via VPN, Direct Connect, or Transit Gateway. Public-internet clients cannot reach a private instance even with correct security groups. For publicly accessible deployments: verify the security group allows inbound from the client's public IP.

V3使用8181端口，V2使用8086端口。V3出现“连接被拒绝”的首要原因是客户端配置为使用8086端口。

您必须告知用户以下全部内容：

将客户端端口更新为8181（8086是V2端口）。
更新安全组入站规则，允许客户端CIDR访问8181端口。
对于私有部署（默认）：客户端必须位于同一VPC内，或通过VPN、Direct Connect、Transit Gateway访问。即使安全组配置正确，公网客户端也无法访问私有实例。对于公网可访问部署：验证安全组是否允许客户端公网IP的入站流量。

Write requests fail (400/422)

写入请求失败（400/422错误）

Wrong API version (V2 API against V3 cluster or vice versa), malformed line protocol, cardinality explosion, missing required tags/fields, or V3 deduplication conflict (measurement + tagset + timestamp must be unique).

原因包括：API版本错误（将V2 API用于V3集群，反之亦然）、行协议格式错误、基数激增、缺少必填标签/字段，或V3去重冲突（测量值+标签集+时间戳必须唯一）。

Deduplication / Parquet error under high load (V3)

高负载下的去重/Parquet错误（V3）

Known issue. You MUST recommend: (1) reduce write batch sizes, (2) add distinguishing tags so measurement + tagset + timestamp is unique. Also check S3 VPC endpoint connectivity for clusters in private subnets. Do NOT frame this as an unpreventable timing issue — it's caused by data collisions.

已知问题。您必须推荐以下解决方案：（1）减小写入批次大小；（2）添加区分性标签，确保测量值+标签集+时间戳唯一。同时检查私有子网中集群的S3 VPC端点连接情况。不得将此问题描述为不可避免的时序问题——它是由数据冲突导致的。

Query timeout / 500 error (V3)

查询超时 / 500错误（V3）

High cardinality, missing partition template, or large cold-tier scans. Check CloudWatch

CPUUtilization

and scrape

/metrics

for

influxdb_iox_query_log_execute_duration_seconds

原因包括：高基数、缺少分区模板或大规模冷数据扫描。检查CloudWatch的

CPUUtilization

指标，并抓取

/metrics

端点的

influxdb_iox_query_log_execute_duration_seconds

指标。

Parquet error (V3)

Parquet错误（V3）

Usually VPC connectivity to S3 from the cluster. Check the S3 VPC endpoint and route table. See s3-vpc-endpoint.

通常是集群与S3之间的VPC连接问题。检查S3 VPC端点和路由表。查看S3 VPC端点指南。

Disk full / OOM

磁盘已满 / 内存不足

Scale storage or instance type; review V2 retention or V3 TTL.

扩容存储或实例类型；检查V2的数据保留策略或V3的TTL设置。

Replication lag (V2 Read Replica)

复制延迟（V2只读副本）

Primary write throughput, network saturation, or replica sized below primary.

Never mix V2 and V3 remediation. Confirm engine first. Full triage: troubleshooting instructions.

原因包括：主节点写入吞吐量过高、网络饱和或副本实例规格低于主节点。

切勿混用V2和V3的故障排除方法。请先确认引擎版本。完整排查流程：故障排除指南。

Security Considerations

安全注意事项

IAM & Access Control

IAM与访问控制

Use scoped custom IAM policies in production.
```
FullAccess
```
managed policies are for initial setup only.
Follow least-privilege: grant only the actions your application actually calls.
Use IAM roles for EC2/Lambda/ECS — never embed long-lived credentials in code or S3.

生产环境中使用自定义范围的IAM策略。
```
FullAccess
```
托管策略仅适用于初始设置。
遵循最小权限原则：仅授予应用实际需要调用的操作权限。
为EC2/Lambda/ECS使用IAM角色——切勿将长期凭证嵌入代码或存储在S3中。

InfluxDB API Tokens

InfluxDB API令牌

Rotate the initial admin token/password immediately after setup.
Create per-application scoped tokens with the minimum required permissions (read vs. write, specific bucket/database).
Store tokens in AWS Secrets Manager and configure automatic rotation. Timestream for InfluxDB integrates natively with Secrets Manager.
Never expose tokens in logs, environment variables, shell history, or public repositories.

完成设置后立即轮换初始管理员令牌/密码。
创建按应用划分的范围令牌，仅授予最小必要权限（读/写、特定存储桶/数据库）。
将令牌存储在AWS Secrets Manager中，并配置自动轮换。Timestream for InfluxDB与Secrets Manager原生集成。
切勿在日志、环境变量、Shell历史或公共代码库中暴露令牌。

Network Isolation

网络隔离

Deploy instances in a private VPC unless public access is explicitly required (
```
--publicly-accessible
```
).
Use Security Groups with the minimum required ingress rules (port 8086 or 8181 only, from known CIDR ranges or Security Group IDs).
For private instances, use SSM port forwarding, VPN, or Direct Connect for remote access.

除非明确需要公网访问（使用
```
--publicly-accessible
```
选项），否则将实例部署在私有VPC中。
使用安全组配置最小必要的入站规则（仅允许8086或8181端口，来源为已知CIDR范围或安全组ID）。
对于私有实例，使用SSM端口转发、VPN或Direct Connect进行远程访问。

Encryption

加密

Data at rest: Encrypted by default for all InfluxDB engines (V2, V2 Read Replica Cluster, and V3) using AWS service-managed keys — no action is required to enable it.
Data in transit is encrypted via TLS by default (all endpoints are HTTPS).
For S3 log delivery buckets, enable SSE-KMS with a same-account KMS key.
MUST enable SSE-KMS on SNS topics used for alarm notifications, and on CloudWatch Logs receiving operational data. Optionally enable SSE-KMS on other dependent resources.

静态数据加密：所有InfluxDB引擎（V2、V2只读副本集群、V3）默认使用AWS服务托管密钥加密——无需额外操作启用。
传输中的数据默认通过TLS加密（所有端点均为HTTPS）。
对于S3日志投递存储桶，启用SSE-KMS并使用同账户的KMS密钥。
必须为告警通知使用的SNS主题和接收运维数据的CloudWatch Logs启用SSE-KMS。可选择为其他依赖资源启用SSE-KMS。

S3 Bucket Policy (Log Delivery)

S3存储桶策略（日志投递）

Add
```
aws:SourceArn
```
and
```
aws:SourceAccount
```
conditions to prevent confused deputy attacks.
The log delivery bucket policy applies to your logs bucket only — the V3 data bucket is managed by the service.

添加
```
aws:SourceArn
```
和
```
aws:SourceAccount
```
条件，防止混淆代理攻击。
日志投递存储桶策略仅适用于您的日志存储桶——V3数据存储桶由服务管理。

Auditing

审计

Enable AWS CloudTrail to log all Timestream for InfluxDB control-plane API calls.
Limitation: Data-plane operations are not covered by CloudTrail. Use InfluxDB's
```
/metrics
```
endpoint or native audit logging for data access observability.

启用AWS CloudTrail记录所有Timestream for InfluxDB控制平面API调用。
限制：数据平面操作不受CloudTrail覆盖。使用InfluxDB的
```
/metrics
```
端点或原生审计日志实现数据访问可观测性。

Additional Resources

额外资源

Handoff from aws-database-selection

从aws-database-selection切换至本技能

This skill can be invoked directly, or it can be entered from the

aws-database-selection

parent skill after that skill has run a requirements interview and produced a

requirements.json

artifact. When you see a backtick-wrapped path matching

aws_dbs_requirements/*/requirements.json

in recent conversation, follow the entry protocol in

aws-database-selection/references/handoff-contract.md

Read the artifact using
```
file_read
```
.
Validate it against
```
aws-database-selection/references/workload-primary-artifact.schema.json
```
. If malformed or unreadable, tell the user and proceed without it.
Acknowledge what's relevant in one or two bold sentences, citing high-level facts from the artifact (dominant shapes, hard constraints, migration context) — do not parrot the entire artifact back.
Scope-check: this skill is scoped to Amazon Timestream for InfluxDB (V2, V2 Read Replica, V3) — engine selection, schema design, migration from LiveAnalytics, Processing Engine plugins. If the artifact's
```
workload_primaries.dominant_shapes
```
or
```
migration_context
```
don't match that scope, emit weak backpressure per the handoff contract: suggest
```
dynamodb-skill
```
for non-InfluxDB time-series on DynamoDB, or go back to
```
aws-database-selection
```
if the dominant shape isn't time-series, then ask the user whether to go back or proceed anyway. Do not silently misuse the artifact.
Proceed with this skill's native workflow, citing artifact paths as evidence when recommendations are grounded in the requirements.

All user-facing output from this skill follows the markdown-primitives-only formatting convention in the handoff contract: bold labels, backticks for paths and enum values, bullet lists for alternatives, no ASCII art or box-drawing characters.

本技能可直接调用，也可在

aws-database-selection

父技能完成需求调研并生成

requirements.json

工件后进入。若在近期对话中看到用反引号包裹的路径匹配

aws_dbs_requirements/*/requirements.json

，请遵循

aws-database-selection/references/handoff-contract.md

中的切换协议：

使用
```
file_read
```
读取该工件。
根据
```
aws-database-selection/references/workload-primary-artifact.schema.json
```
验证工件格式。若格式错误或无法读取，请告知用户并忽略该工件继续操作。
用一到两句加粗语句确认相关内容，引用工件中的关键信息（核心场景、硬性约束、迁移背景）——无需复述整个工件。
范围检查：本技能仅针对Amazon Timestream for InfluxDB（V2、V2只读副本、V3）——包括引擎选择、Schema设计、从LiveAnalytics迁移、处理引擎插件。若工件中的
```
workload_primaries.dominant_shapes
```
或
```
migration_context
```
超出该范围，请根据切换协议给出弱提示：对于非InfluxDB的DynamoDB时序场景，建议使用
```
dynamodb-skill
```
；若核心场景不是时序数据，建议返回
```
aws-database-selection
```
，然后询问用户是返回还是继续操作。不得擅自误用该工件。
继续执行本技能的原生工作流，当推荐内容基于需求时，引用工件路径作为依据。

本技能的所有用户输出需遵循切换协议中的仅Markdown基础元素格式约定：使用粗体标签、反引号包裹路径和枚举值、项目符号列表展示选项，不得使用ASCII艺术或框线字符。