Question

A DevOps team runs an automated compliance workflow. Every night at 02:00 UTC, an EventBridge scheduled rule (cron expression) triggers a Lambda function that scans EC2 instances for missing patches and starts an SSM Automation runbook to remediate. The team notices that during nights when the AWS account experiences a large burst of unrelated events, the nightly patch scan sometimes fires several minutes late or, on rare occasions, is skipped entirely. They need the patch scan to fire reliably at a precise time, support a configurable time zone for regional maintenance windows, and avoid running when a maintenance flag is disabled — without maintaining the scheduling logic inside Lambda. Which change best meets these requirements?

Accepted Answer

Migrate the trigger to Amazon EventBridge Scheduler with a cron schedule that specifies the target time zone, enable the schedule's flexible time window as 'off' for precise firing, and use the schedule's enable/disable state to gate execution.

Answer

Keep the EventBridge scheduled rule but increase the Lambda function's reserved concurrency and add a retry policy with a dead-letter queue so missed invocations are replayed.

Answer

Replace the scheduled rule with a CloudWatch alarm on a custom 'PatchScanDue' metric published every minute, and trigger the Lambda when the alarm enters ALARM state.

Answer

Convert the cron rule to an EventBridge rule that matches SSM State Manager association status-change events, so the scan runs whenever an association reports drift.