Question

A DevOps team runs a fleet of Amazon EC2 Linux instances managed by AWS Systems Manager. Application logs occasionally fill the root volume, causing the application to crash. The CloudWatch agent already publishes a `disk_used_percent` metric per instance. The team wants a fully automated response: when disk usage on an instance exceeds 90%, a runbook should automatically SSH-free execute a cleanup script (rotate and compress old logs) on that specific instance, without manual intervention. Which approach implements this most directly?

Accepted Answer

Create a CloudWatch alarm on `disk_used_percent` per instance; route the alarm state change to an EventBridge rule that triggers an SSM Automation runbook using an `aws:runCommand` step targeting the affected instance ID passed from the event.

Answer

Configure the CloudWatch agent to invoke a Lambda function directly when the disk metric breaches 90%, and have Lambda open an SSH session to the instance to run the cleanup script.

Answer

Create an SSM State Manager association that runs the cleanup script on all instances every 5 minutes regardless of disk usage.

Answer

Set a CloudWatch alarm that publishes to an SNS topic subscribed by the on-call engineer, who then manually runs an SSM Run Command document to clean up the disk.