---
title: "Scope workloads and share resilience policies with AWS Resilience Hub"
description: "AWS Resilience Hub’s Next generation, announced September 18, 2026, adds three capabilities to align workload scope and resilience requirements with running environments. Amazon EKS label support selects Kubernetes resources using existing labels with AND logic, establishing precise resource boundaries without reorganizing namespaces. Generative AI-powered Dependency Insights summarizes discovered dependencies and highlights patterns warranting resilience review, such as cross-Region dependencies questioning recovery design. Resilience policy sharing through AWS Organizations lets a central team define requirements once and make them available to member accounts, with policy events tracking adoption. The post walks through scoping a checkout service on EKS using labels, examining dependencies via synthetic traffic, and applying a shared tier-1-critical policy with a 99.9% availability SLO, 5-minute multi-AZ RTO, 1-minute RPO, 15-minute multi-Region RTO, and 60-minute backup intervals."
---

# Scope workloads and share resilience policies with AWS Resilience Hub

[AWS](https://yomu.fyi/company/aws) · Sinisa Mikasinovic · Oct 13, 2026

**Type:** Tutorial

## Summary

AWS Resilience Hub’s Next generation, announced September 18, 2026, adds three capabilities to align workload scope and resilience requirements with running environments. Amazon EKS label support selects Kubernetes resources using existing labels with AND logic, establishing precise resource boundaries without reorganizing namespaces. Generative AI-powered Dependency Insights summarizes discovered dependencies and highlights patterns warranting resilience review, such as cross-Region dependencies questioning recovery design. Resilience policy sharing through AWS Organizations lets a central team define requirements once and make them available to member accounts, with policy events tracking adoption. The post walks through scoping a checkout service on EKS using labels, examining dependencies via synthetic traffic, and applying a shared tier-1-critical policy with a 99.9% availability SLO, 5-minute multi-AZ RTO, 1-minute RPO, 15-minute multi-Region RTO, and 60-minute backup intervals.

## Context

Keeping workload scope and resilience requirements aligned with running environments, especially in shared Kubernetes clusters where resource boundaries are unclear and dependencies change after migrations or deployments.

## Approach / What changed

Use Amazon EKS label selectors to filter Kubernetes resources within namespaces for precise service scoping, employ Generative AI-powered Dependency Insights to summarize and highlight discovered dependencies for resilience review, and share resilience policies across AWS Organizations to centralize requirements and track adoption.

## Takeaways

- EKS label selectors use AND logic within a namespace; without a selector, all supported objects in selected namespaces are discovered.
- Dependency Insights can be regenerated once every 24 hours and uses DNS activity to discover endpoints, but connections made directly by IP address are not discovered.
- A shared policy attachment event confirms adoption, not compliance; a failure mode assessment and resilience testing are needed to determine if the service meets targets.

## FAQ

### How do EKS label selectors work in Resilience Hub?

Label selectors filter Kubernetes resources within selected namespaces using a key, operator, and values. Selectors within a namespace use AND logic: an object must match all of them. Without a selector, all supported objects in the selected namespaces are discovered.

### What are the limitations of Dependency Insights?

Connections made directly by IP address aren't discovered, AWS Lambda functions need VPC connectivity to be covered, and very infrequent calls might not appear in initial results. Results reflect the history available to the service.

### Does applying a shared policy guarantee compliance?

No, a policy attachment event confirms adoption, not compliance. After applying a shared policy, the console changes each target to 'Pending failure mode assessment,' and a failure mode assessment and appropriate resilience testing are needed to determine whether the service meets those targets.

**Tags:** [Amazon EKS](https://yomu.fyi/topic/amazon-eks), [AWS Resilience Hub](https://yomu.fyi/topic/aws-resilience-hub), [Generative AI](https://yomu.fyi/topic/generative-ai), [Kubernetes](https://yomu.fyi/topic/kubernetes)

- Source: [AWS](https://aws.amazon.com/blogs/architecture/scope-workloads-and-share-resilience-policies-with-aws-resilience-hub)
- Source URL: https://aws.amazon.com/blogs/architecture/scope-workloads-and-share-resilience-policies-with-aws-resilience-hub
- Ingested by Yomu: 2026-10-14T00:00:15.159Z

[Read original post](https://aws.amazon.com/blogs/architecture/scope-workloads-and-share-resilience-policies-with-aws-resilience-hub)