Question

A company runs an auto-remediation pipeline where an EventBridge rule matches AWS Config 'NON_COMPLIANT' notifications for unencrypted EBS volumes and invokes a Systems Manager Automation runbook to encrypt and replace them. During a large-scale deployment, hundreds of non-compliant volumes are created within minutes, generating a burst of Config events. The team observes that many Automation executions fail with throttling errors, and some remediations never run. The DevOps team must ensure every event is eventually processed without overwhelming the Automation service or dropping events. What is the MOST effective solution?

Accepted Answer

Change the EventBridge target from the SSM Automation runbook to an SQS queue, and configure a Lambda function with reserved concurrency and a maxConcurrency-limited event source mapping to invoke the Automation runbook at a controlled rate, retrying on throttling.

Answer

Increase the EventBridge rule's retry attempts and maximum event age so failed invocations are retried more aggressively against the Automation runbook.

Answer

Add a second EventBridge rule targeting the same Automation runbook in another Region to spread the load across Regions.

Answer

Configure the SSM Automation runbook to use the Rate concurrency control with a high MaxConcurrency value so all executions start simultaneously.