Question

A DevOps team runs an auto-remediation workflow: a CloudWatch alarm on excessive disk usage triggers an EventBridge rule that invokes a Systems Manager Automation runbook to expand the EBS volume and extend the filesystem. Security requires that any remediation touching production instances (tagged Environment=prod) receive human approval before execution, while non-production remediation must remain fully automatic. The team wants to keep a single runbook and avoid maintaining separate Lambda approval logic. What is the MOST appropriate way to implement this?

Accepted Answer

Add an aws:approve step in the Automation runbook guarded by a conditional aws:branch step that routes prod-tagged instances through approval while non-prod instances skip directly to the remediation steps.

Answer

Configure two EventBridge rules with tag-based event pattern filtering so prod alarms invoke a Lambda that emails the team and non-prod alarms invoke the runbook directly.

Answer

Enable a manual approval action in an EventBridge Pipe between the alarm source and the SSM Automation target for all instances.

Answer

Attach an IAM permissions boundary to the Automation service role that denies EBS modifications on prod instances until an administrator manually assumes an elevated role.